ZDI-CAN-23795: ZDI-25-092: (Pwn2Own) Apple Safari B3 JIT Compiler Integer Underflow Remote Code Execution Vulnerability

Published Feb 24, 2025

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple Safari. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 5.4. The following CVEs are assigned: CVE-2024-27833.

Affected Software

1 affected component

Safari

Event History

Feb 24, 2025

Advisory Published

via ZDI·06:00 AM

Data Sourced

via ZDI·06:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-23795?

The ZDI-CAN-23795 vulnerability has a CVSS rating of 5, indicating medium severity.

How do I fix ZDI-CAN-23795?

To mitigate ZDI-CAN-23795, ensure that you are using the latest version of Apple Safari and regularly apply security updates.

What is the impact of ZDI-CAN-23795?

ZDI-CAN-23795 allows remote attackers to execute arbitrary code if the user visits a malicious page or opens a malicious file.

Is user interaction required for ZDI-CAN-23795 to be exploited?

Yes, user interaction is required for ZDI-CAN-23795 as the victim must visit a malicious page or open a malicious file.

Which software is affected by ZDI-CAN-23795?

ZDI-CAN-23795 affects Apple Safari installations.