CVE-2018-4241

Public exploit available. Not confirmed exploited in the wild yet. Fixed versions are out.

CVSS 3.07.8High EPSS percentile95th8.0% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 2 sources Fix5 products3 fixed builds listed below

Published 2018-06-08Updated 2024-11-21Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Apple Mac Os XAffected: < 10.13.5Upgrade to: 10.13.5Stated by: NVD
Apple WatchosAffected: < 4.3.1Upgrade to: 4.3.1Stated by: NVD
Apple Iphone OsAffected: < 11.4Upgrade to: 11.4Stated by: NVD
Apple TvAffected: < 11.4Upgrade to: 11.4Stated by: NVD
Apple Inc. tvOSAffected: до 11.4Upgrade to: not statedStated by: BDU

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check each Apple device you use for business (iOS, macOS, tvOS, watchOS) and note its current version.
Update iOS to 11.4 or later.
Update macOS to 10.13.5 or later.
Update tvOS to 11.4 or later.
Update watchOS to 4.3.1 or later.
If you cannot update right away, reduce exposure by preventing unknown app installs and avoiding opening apps from untrusted sources until updates are applied.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "Kernel" component. A buffer overflow in mptcp_usr_connectx allows attackers to execute arbitrary code in a privileged context via a crafted app.

In plain language

Written by AI from the record

CVE-2018-4241 is a kernel “crash-to-takeover” bug in older iOS, macOS, tvOS, and watchOS—if someone can get the device unlocked and launch a crafted app, they may be able to take full control, so you should update.

CVE-2018-4241 is a kernel buffer overflow (CWE-119) in Apple products where a local attacker can trigger privileged code execution by getting a user to launch a specially crafted application; fixed in iOS 11.4, macOS 10.13.5, tvOS 11.4, and watchOS 4.3.1.

If you're affected

Full device takeover
Business data theft risk
Ransomware on device risk
Service disruption

What is it

This is a serious security bug in the “core” part of Apple’s operating system (the kernel). A malicious app can be used to trigger a memory overflow and potentially let an attacker take over the device. Think of it like a weakness at the very center of the operating system—if the right (and crafted) app gets launched, the attacker may gain control.

Who is affected

This matters if your business uses Apple devices running older iOS (<11.4), macOS (<10.13.5), tvOS (<11.4), or watchOS (<4.3.1). It is not something that happens just by visiting a website; an attacker needs local access to the device and needs to get the device user to open a specifically crafted app. It is only a risk when that crafted app can be launched on a reachable, real device session.

How urgent is it

This should be treated as urgent for affected devices because public exploits exist and the bug can lead to full system control. While it requires a user to launch a crafted app (so it’s not purely drive-by), the practical risk rises quickly when devices are not kept updated. Update to the fixed versions as soon as possible.

What to do — in detail

Confirm whether you’re exposed

For each device used for business, check the OS version.
- iOS: Settings → General → About → iOS Version.
- macOS: Apple menu → System Settings/Preferences → About → macOS Version.
- tvOS: Settings → General → About → Software Version.
- watchOS: Watch app on iPhone → General → About → Version.
Compare to the affected ranges from the finding: iOS before 11.4, macOS before 10.13.5, tvOS before 11.4, watchOS before 4.3.1.

Upgrade to the fixed versions

iOS: update to 11.4 or later.
macOS: update to 10.13.5 or later.
tvOS: update to 11.4 or later.
watchOS: update to 4.3.1 or later.

If you can’t patch immediately

Stop unknown/untrusted app installation as much as your organization allows (e.g., restrict where apps can be installed from).
Ensure staff know not to open prompts for “untrusted” or unexpected apps.
Treat any device that has had suspicious app installs as higher risk and prioritize updating.

What to monitor

Device activity related to newly installed apps around the time of any suspicious behavior.
User reports of unexpected app prompts or unusual device behavior.

KEV / CISA note

This CVE is not listed in CISA KEV (per the provided findings), but public exploit availability means you should still prioritize patching based on your exposure.

Technical context

Severity is high (CVSS 7.8 reported). The weakness is CWE-119 (a buffer overflow). The mechanism described in the findings is a kernel buffer overflow in a network connection function (mptcp_usr_connectx in the backstop) that can be triggered by a local attacker using a crafted application, resulting in arbitrary code execution in a privileged context. The attack requires local access and user interaction to launch the crafted app, and it is reachable in default configuration per the findings. Public exploitation exists (2 known), and the verdict for this CVE is AMBER. KEV is not listed for this CVE per the findings; exploitation maturity is therefore supported mainly by the “public exploit available” finding rather than KEV confirmation. EPSS was provided as a prediction (trend flat), but public exploit availability and the AMBER verdict drive action despite that prediction.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS95th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

2 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

8.0% chance of exploitation activity in the next 30 days, which ranks it in the 95th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 471 days before any public exploit.

2026-09-23EPSS band changemoderate → lowepss band change
2026-09-21EPSS band changelow → moderateepss band change
2026-09-06EPSS band changemoderate → 0epss band change
2026-09-05EPSS band change0 → moderateepss band change
2026-08-31EPSS band changemoderate → 0epss band change
2026-08-28EPSS band change0 → moderateepss band change

Affected products

Apple Inc.commercial · USaka apple, apple computer
- MacOSOSOn-premOperating Systems / unix-bsd
- tvOSOSOperating Systems / mobile-os
- watchOSOSEmbeddedOperating Systems / mobile-os
- iOSOSEmbeddedOperating Systems / mobile-os
- apple tvOperating Systems

And 4 more affected products. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable