Apple Garageband vulnerabilities

9 CVEs affecting Apple Garageband, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-44142, published 2025-01-30.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-2372, published 2017-02-20. High severity, CVSS 8.8. EPSS: 2% chance of exploitation in the next 30 days. An issue was discovered in certain Apple products. GarageBand before 10.1.5 is affected. Logic Pro X before 10.3 is affected. The issue involves the "Projects" component, which allows remote…
CVE-2009-2198, published 2009-08-04. Medium severity, CVSS 4.3. EPSS: 1.5% chance of exploitation in the next 30 days. Apple GarageBand before 5.1 reconfigures Safari to accept all cookies regardless of domain name, which makes it easier for remote web servers to track users.
CVE-2017-2374, published 2017-02-20. High severity, CVSS 7.8. EPSS: 1.5% chance of exploitation in the next 30 days. An issue was discovered in certain Apple products. GarageBand before 10.1.6 is affected. The issue involves the "Projects" component. It allows remote attackers to execute arbitrary code or cause a…
CVE-2022-22664, published 2022-03-18. High severity, CVSS 7.8. EPSS: 1.1% chance of exploitation in the next 30 days. An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Logic Pro 10.7.3, GarageBand 10.4.6, macOS Monterey 12.3. Opening a maliciously crafted file may lead to…
CVE-2022-22657, published 2022-03-18. High severity, CVSS 7.8. EPSS: 1.1% chance of exploitation in the next 30 days. A memory initialization issue was addressed with improved memory handling. This issue is fixed in Logic Pro 10.7.3, GarageBand 10.4.6, macOS Monterey 12.3. Opening a maliciously crafted file may lead…
CVE-2024-44142, published 2025-01-30. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. The issue was addressed with improved bounds checks. This issue is fixed in GarageBand 10.4.12. Processing a maliciously crafted image may lead to arbitrary code execution.
CVE-2024-23300, published 2024-03-12. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. A use-after-free issue was addressed with improved memory management. This issue is fixed in GarageBand 10.4.11. Processing a maliciously crafted file may lead to unexpected app termination or…
CVE-2021-30654, published 2021-09-08. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. This issue was addressed by removing additional entitlements. This issue is fixed in GarageBand 10.4.3. A local attacker may be able to read sensitive information.
CVE-2023-42867, published 2024-12-20. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. This issue was addressed with improved validation of the process entitlement and Team ID. This issue is fixed in GarageBand 10.4.9. An app may be able to gain root privileges.