CVE-2018-4200

Public exploit available. Not confirmed exploited in the wild yet. Fixed versions are out.

CVSS 3.08.8High EPSS percentile95th8.7% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source Fix5 products5 fixed builds listed below

Published 2018-06-08Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Apple SafariAffected: < 11.1Upgrade to: 11.1Stated by: NVD
Apple Iphone OsAffected: < 11.3.1Upgrade to: 11.3.1Stated by: NVD
Apple TvosAffected: < 11.4Upgrade to: 11.4Stated by: NVD
Apple IcloudAffected: < 7.5Upgrade to: 7.5Stated by: NVD
Apple ItunesAffected: < 12.7.5Upgrade to: 12.7.5Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check which devices and apps you use that match CVE-2018-4200: Safari, iOS, tvOS, iCloud for Windows, and iTunes for Windows.
Verify your versions and confirm whether they are older than the fixed releases (Safari 11.1, iOS 11.3.1, tvOS 11.4, iCloud 7.5, iTunes 12.7.5).
Update each affected Apple product to the fixed version listed below.
If you can’t update right away, reduce risk by avoiding unknown/malicious links and web pages on the affected devices until updates are applied.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

An issue was discovered in certain Apple products. iOS before 11.3.1 is affected. Safari before 11.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site that triggers a WebCore::jsElementScrollHeightGetter use-after-free.

In plain language

Written by AI from the record

CVE-2018-4200 is a Web browser/device bug that can be triggered by visiting a malicious website, potentially letting an attacker take over or crash the affected Apple software—so you should update if you run affected Safari/iOS/tvOS/iCloud/iTunes versions.

CVE-2018-4200 is a remote, no-additional-login exploit in Apple WebKit/WebCore that can be triggered by a user visiting a crafted website, leading to a memory “use-after-free” that may enable arbitrary code execution or denial of service (crashes) in affected Safari/iOS/tvOS and Windows iCloud/iTunes.

If you're affected

Device or browser takeover
App or service crashes
Lost access to business systems

What is it

This bug lives inside Apple’s web browsing engine (WebKit). If someone tricks you into opening a specially made website, the website can trigger a software error that may let an attacker take control or simply crash the device/app—like a “poisoned web page” that causes the browser to misbehave.

Who is affected

This matters if you use affected Apple products: Safari, iOS, tvOS, iCloud for Windows, or iTunes for Windows on unpatched versions. It’s driven by a user visiting a specific malicious website, and it does not require you to already be logged in to anything special. Treat it as a risk only if your installed version is older than the fixed versions listed (and the affected app is reachable in normal web browsing on that device).

How urgent is it

This is an actively weaponizable, high-impact web bug with a public exploit available, meaning attackers can craft websites to trigger it. Even though it requires a user to visit a malicious site, businesses should treat it as urgent to update affected Safari/iOS/tvOS and Windows iCloud/iTunes installs because the impact includes takeover or crashes.

What to do — in detail

Confirm exposure

Identify every system where users browse the web or sync/media with these apps: Safari (macOS/iOS context as applicable), iOS devices, tvOS devices, iCloud for Windows, and iTunes for Windows.
For each one, record the exact version.
Determine whether you are running a version older than the fixed versions:
- Safari: fixed in 11.1
- iOS: fixed in 11.3.1
- tvOS: fixed in 11.4
- iCloud (Windows): fixed in 7.5
- iTunes (Windows): fixed in 12.7.5

Patch / upgrade (target versions)

Update any affected Safari/iOS/tvOS devices and any affected Windows installs of iCloud and iTunes to the corresponding fixed versions above.
Use Apple’s official remediation guidance referenced for this issue:

If you can’t update immediately

Block or avoid opening unknown links and unexpected attachments that could lead to malicious pages.
Restrict web access for any device/app that you already confirmed is on an affected version until updates are applied.

What to monitor

After updates, watch for reduced frequency of unexpected browser/app crashes.
If you suspect a user opened a malicious link on an affected device, prioritize reviewing device logs and ensuring the device is fully updated.

KEV / known exploitation note

This CVE is not listed in CISA KEV, but public exploits exist; prioritize patching based on version exposure.

Technical context

CVE-2018-4200 (CWE-416) is a memory safety flaw (use-after-free) in Apple’s WebKit/WebCore component. The attack vector is remote: a crafted website triggers a specific WebCore JavaScript element scroll height getter path that can cause use-after-free, leading to either denial of service (crash) or potentially arbitrary code execution.

Findings indicate:

Exploitation status: public exploit available (1 known); press attention has resurfaced.
Authentication: no special authentication beyond standard web access; user must visit the malicious website.
Affected versions are explicitly bounded by the product and “fixed in” versions: Safari 11.1, iOS 11.3.1, tvOS 11.4, iCloud 7.5 (Windows), iTunes 12.7.5 (Windows).
KEV: not listed in CISA KEV, so widespread, officially tracked exploitation is not confirmed via that channel.

EPSS is provided as a prediction (not used as proof of exploitation here). Use the fixed versions above as the authoritative remediation targets.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS95th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

8.7% chance of exploitation activity in the next 30 days, which ranks it in the 95th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 471 days before any public exploit.

2026-09-23EPSS band changemoderate → 0epss band change
2026-09-21EPSS band change0 → moderateepss band change
2026-09-06EPSS band changemoderate → 0epss band change
2026-09-05EPSS band change0 → moderateepss band change
2026-08-31EPSS band changemoderate → 0epss band change
2026-08-28EPSS band change0 → moderateepss band change

Affected products

applecommercial · USaka apple computer, apple inc.
- safariDesktop AppOn-premConsumer Software / browser
- iphone osOSEmbeddedOperating Systems / mobile-os
- tvosOSEmbeddedOperating Systems / mobile-os
- icloudSaaS ServiceSaaSCloud & SaaS / saas-application
- itunesDesktop AppConsumer Software / media-player
canonicalcommercial · GBaka canonical ltd.
- ubuntu linuxOSOn-premOperating Systems / linux-distro

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 8.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable