Apple · OS X
CVE-2014-4404
Apple OS X Heap-Based Buffer Overflow Vulnerability
What it is
Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an application that provides crafted key-mapping properties.
CISA: Heap-based buffer overflow in IOHIDFamily in Apple OS X, which affects, iOS before 8 and Apple TV before 7, allows attackers to execute arbitrary code in a privileged context.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: August 10, 2022
- Added to the CISA list
- February 10, 2022
- Published
- September 18, 2014
- Severity
- High 7.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 49% in the top 1.1% of all known vulnerabilities
- Weakness
- CWE-119
- More details
- NVD · CVE.org · CISA
All references (12)
- http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html
- http://archives.neohapsis.com/archives/bugtraq/2014-09/0107.html
- http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
- http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html
- https://support.apple.com/HT204659
- http://support.apple.com/kb/HT6441
- http://www.securitytracker.com/id/1030866
- http://www.securityfocus.com/bid/69947
- http://support.apple.com/kb/HT6442
- http://www.securityfocus.com/bid/69882
- https://exchange.xforce.ibmcloud.com/vulnerabilities/96111
- https://support.apple.com/kb/HT6535
More exploited flaws from Apple
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Feb 10, 2022 | Authentication Bypass | OS X | High 7.8 | 9.9% |
| Sep 29, 2026 | Out-of-Bounds Write | Multiple Products | High 8.8 | 26% |
| Aug 18, 2026 | Improper Authentication | macOS | Critical 9.8 | 1.7% |
| Mar 20, 2026 | Buffer Overflow | Multiple Products | High 8.8 | 1.7% |
| Mar 20, 2026 | Improper Locking | Multiple Products | High 7.8 | 0.4% |
| Mar 20, 2026 | Classic Buffer Overflow | Multiple Products | Medium 5.5 | 0.4% |
| Mar 5, 2026 | Integer Overflow or Wraparound | Multiple Products | High 8.8 | 7.0% |
| Mar 5, 2026 | Use-After-Free | iOS and iPadOS | High 7.8 | 2.0% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.