Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-4156: Apple iOS/macOS let malicious app gain system rights

CVE-2018-4156 · published 8 years ago

Summary

Devices running iOS versions older than 11.3 or macOS versions older than 10.13.4 contain a flaw in the PluginKit component. Because of a timing error, a specially crafted app could cause the system to execute the attacker’s code with high‑level privileges. Update the operating system to the latest version or apply Apple’s security patches to fix the problem.

What to do

Update apple iphone_os to version 11.3 or later.
Update apple mac_os_x to version 10.13.4 or later.

Affected software

Vendor	Product	Affected versions
apple	iphone_os	< 11.3 `cpe:2.3:o:apple:iphone_os::::::::`
apple	mac_os_x	< 10.13.4 `cpe:2.3:o:apple:mac_os_x::::::::`

Original advisory text

An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. The issue involves the "PluginKit" component. A race condition allows attackers to ...

References

http://www.securityfocus.com/bid/103581 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1040604 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1040608 Third Party Advisory VDB Entry
https://support.apple.com/HT208692 Vendor Advisory
https://support.apple.com/HT208693 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

7.0 High

Exploitation

1% chance of attack within 30 days

Type

CWE-362Race Condition

Timeline

Published3 Apr 2018

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2018-4156 · NVD

Track software like this

Free during beta