# Sonoma 14.4

Sonoma 14.4, released March 7, 2024, fixes 76 CVEs in Sonoma. 2 of them are being exploited (CVE-2024-23225); 2 on CISA KEV. Patch Radar priority: Patch now.

- Web page: https://patchblox.com/security/fix/macos/sonoma-14.4
- Platform: macOS
- Released: Mar 7, 2024
- Priority: Patch now (Closes CVE-2024-23225, exploited (CISA KEV))
- CVEs: 76, exploited: 2, on CISA KEV: 2
- Vendor advisory: https://support.apple.com/en-us/120895

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [Sonoma](https://patchblox.com/security/data/product/macos/sonoma.md) |  | 14.4 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2024-23225](https://patchblox.com/security/data/cve/CVE-2024-23225.md) | Patch now | Kernel: An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections. Apple is aware of a report that this issue may have been exploited. | 7.8 | 0.0148 | CISA KEV |
| [CVE-2024-23296](https://patchblox.com/security/data/cve/CVE-2024-23296.md) | Patch now | RTKit: An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections. Apple is aware of a report that this issue may have been exploited. | 7.8 | 0.0141 | CISA KEV |
| [CVE-2024-23286](https://patchblox.com/security/data/cve/CVE-2024-23286.md) | Urgent | ImageIO: Processing an image may lead to arbitrary code execution | 9.8 | 0.0124 |  |
| [CVE-2024-23265](https://patchblox.com/security/data/cve/CVE-2024-23265.md) | Urgent | Kernel: An app may be able to cause unexpected system termination or write kernel memory | 9.8 | 0.0072 |  |
| [CVE-2024-23255](https://patchblox.com/security/data/cve/CVE-2024-23255.md) | Urgent | Photos: Photos in the Hidden Photos Album may be viewed without authentication | 9.1 | 0.0067 |  |
| [CVE-2023-48795](https://patchblox.com/security/data/cve/CVE-2023-48795.md) | High | OpenSSH: Multiple issues in OpenSSH | 7.5 | 0.9355 |  |
| [CVE-2024-23263](https://patchblox.com/security/data/cve/CVE-2024-23263.md) | High | WebKit: Processing maliciously crafted web content may prevent Content Security Policy from being enforced | 8.1 | 0.0150 |  |
| [CVE-2024-23280](https://patchblox.com/security/data/cve/CVE-2024-23280.md) | High | WebKit: A maliciously crafted webpage may be able to fingerprint the user | 7.5 | 0.0128 |  |
| [CVE-2024-23226](https://patchblox.com/security/data/cve/CVE-2024-23226.md) | High | WebKit: Processing web content may lead to arbitrary code execution | 8.8 | 0.0119 |  |
| [CVE-2024-23261](https://patchblox.com/security/data/cve/CVE-2024-23261.md) | High | Time Zone: An attacker may be able to read information belonging to another user | 7.5 | 0.0091 |  |
| [CVE-2024-23246](https://patchblox.com/security/data/cve/CVE-2024-23246.md) | High | UIKit: An app may be able to break out of its sandbox | 8.1 | 0.0069 |  |
| [CVE-2024-23291](https://patchblox.com/security/data/cve/CVE-2024-23291.md) | High | Accessibility: A malicious app may be able to observe user data in log entries related to accessibility notifications | 7.5 | 0.0063 |  |
| [CVE-2024-23235](https://patchblox.com/security/data/cve/CVE-2024-23235.md) | High | Kernel: An app may be able to access user-sensitive data | 8.1 | 0.0050 |  |
| [CVE-2024-23278](https://patchblox.com/security/data/cve/CVE-2024-23278.md) | High | libxpc: An app may be able to break out of its sandbox | 7.7 | 0.0049 |  |
| [CVE-2024-27886](https://patchblox.com/security/data/cve/CVE-2024-27886.md) | High | AppKit: An unprivileged app may be able to log keystrokes in other apps including those using secure input mode | 7.5 | 0.0048 |  |
| [CVE-2024-23268](https://patchblox.com/security/data/cve/CVE-2024-23268.md) | High | PackageKit: An app may be able to elevate privileges | 8.4 | 0.0042 |  |
| [CVE-2024-23253](https://patchblox.com/security/data/cve/CVE-2024-23253.md) | High | Image Capture: An app may be able to access a user's Photos Library | 7.5 | 0.0041 |  |
| [CVE-2024-23247](https://patchblox.com/security/data/cve/CVE-2024-23247.md) | High | ColorSync: Processing a file may lead to unexpected app termination or arbitrary code execution | 7.8 | 0.0038 |  |
| [CVE-2024-23276](https://patchblox.com/security/data/cve/CVE-2024-23276.md) | High | Admin Framework: An app may be able to elevate privileges | 8.4 | 0.0028 |  |
| [CVE-2024-23270](https://patchblox.com/security/data/cve/CVE-2024-23270.md) | High | Image Processing: An app may be able to execute arbitrary code with kernel privileges | 7.8 | 0.0028 |  |
| [CVE-2024-23294](https://patchblox.com/security/data/cve/CVE-2024-23294.md) | High | QuartzCore: Processing malicious input may lead to code execution | 7.8 | 0.0028 |  |
| [CVE-2024-23288](https://patchblox.com/security/data/cve/CVE-2024-23288.md) | High | AppleMobileFileIntegrity: An app may be able to elevate privileges | 8.4 | 0.0027 |  |
| [CVE-2024-0258](https://patchblox.com/security/data/cve/CVE-2024-0258.md) | High | libxpc: An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges | 8.2 | 0.0027 |  |
| [CVE-2024-23234](https://patchblox.com/security/data/cve/CVE-2024-23234.md) | High | Intel Graphics Driver: An app may be able to execute arbitrary code with kernel privileges | 7.8 | 0.0026 |  |
| [CVE-2024-23285](https://patchblox.com/security/data/cve/CVE-2024-23285.md) | High | Music: An app may be able to create symlinks to protected regions of the disk | 7.8 | 0.0025 |  |
| [CVE-2024-23299](https://patchblox.com/security/data/cve/CVE-2024-23299.md) | High | Disk Images: An app may be able to break out of its sandbox | 8.6 | 0.0024 |  |
| [CVE-2024-23258](https://patchblox.com/security/data/cve/CVE-2024-23258.md) | High | ImageIO: Processing an image may lead to arbitrary code execution | 7.8 | 0.0024 |  |
| [CVE-2024-23233](https://patchblox.com/security/data/cve/CVE-2024-23233.md) | High | AppleMobileFileIntegrity: Entitlements and privacy permissions granted to this app may be used by a malicious app | 7.8 | 0.0022 |  |
| [CVE-2024-23238](https://patchblox.com/security/data/cve/CVE-2024-23238.md) | High | Sandbox: An app may be able to edit NVRAM variables | 7.1 | 0.0021 |  |
| [CVE-2024-27888](https://patchblox.com/security/data/cve/CVE-2024-27888.md) | High | PackageKit: An app may be able to modify protected parts of the file system | 7.1 | 0.0018 |  |
| [CVE-2023-51385](https://patchblox.com/security/data/cve/CVE-2023-51385.md) | Routine | OpenSSH: Multiple issues in OpenSSH | 6.5 | 0.1975 |  |
| [CVE-2024-23284](https://patchblox.com/security/data/cve/CVE-2024-23284.md) | Routine | WebKit: Processing maliciously crafted web content may prevent Content Security Policy from being enforced | 6.5 | 0.0147 |  |
| [CVE-2024-23254](https://patchblox.com/security/data/cve/CVE-2024-23254.md) | Routine | WebKit: A malicious website may exfiltrate audio data cross-origin | 6.5 | 0.0125 |  |
| [CVE-2024-23259](https://patchblox.com/security/data/cve/CVE-2024-23259.md) | Routine | Safari: Processing web content may lead to a denial-of-service | 6.5 | 0.0085 |  |
| [CVE-2024-23264](https://patchblox.com/security/data/cve/CVE-2024-23264.md) | Routine | Metal: An application may be able to read restricted memory | 5.3 | 0.0080 |  |
| [CVE-2024-23273](https://patchblox.com/security/data/cve/CVE-2024-23273.md) | Routine | Safari Private Browsing: Private Browsing tabs may be accessed without authentication | 4.3 | 0.0073 |  |
| [CVE-2024-23277](https://patchblox.com/security/data/cve/CVE-2024-23277.md) | Routine | Bluetooth: An attacker in a privileged network position may be able to inject keystrokes by spoofing a keyboard | 5.9 | 0.0071 |  |
| [CVE-2022-48554](https://patchblox.com/security/data/cve/CVE-2022-48554.md) | Routine | file: Processing a file may lead to a denial-of-service or potentially disclose memory contents | 5.5 | 0.0068 |  |
| [CVE-2024-23287](https://patchblox.com/security/data/cve/CVE-2024-23287.md) | Routine | Messages: An app may be able to access user-sensitive data | 6.5 | 0.0067 |  |
| [CVE-2024-27789](https://patchblox.com/security/data/cve/CVE-2024-27789.md) | Routine | Foundation: An app may be able to access user-sensitive data | 5.3 | 0.0062 |  |
| [CVE-2024-54658](https://patchblox.com/security/data/cve/CVE-2024-54658.md) | Routine | WebKit: Processing web content may lead to a denial-of-service | 6.5 | 0.0054 |  |
| [CVE-2024-23290](https://patchblox.com/security/data/cve/CVE-2024-23290.md) | Routine | Sandbox: An app may be able to access user-sensitive data | 5.3 | 0.0050 |  |
| [CVE-2024-23248](https://patchblox.com/security/data/cve/CVE-2024-23248.md) | Routine | ColorSync: Processing a file may lead to a denial-of-service or potentially disclose memory contents | 6.5 | 0.0047 |  |
| [CVE-2024-23257](https://patchblox.com/security/data/cve/CVE-2024-23257.md) | Routine | ImageIO: Processing an image may result in disclosure of process memory | 3.3 | 0.0045 |  |
| [CVE-2024-23241](https://patchblox.com/security/data/cve/CVE-2024-23241.md) | Routine | Spotlight: An app may be able to leak sensitive user information | 6.5 | 0.0044 |  |
| [CVE-2024-23245](https://patchblox.com/security/data/cve/CVE-2024-23245.md) | Routine | Shortcuts: Third-party shortcuts may use a legacy action from Automator to send events to apps without user consent | 5.4 | 0.0043 |  |
| [CVE-2024-23239](https://patchblox.com/security/data/cve/CVE-2024-23239.md) | Routine | Sandbox: An app may be able to leak sensitive user information | 5.9 | 0.0043 |  |
| [CVE-2023-51384](https://patchblox.com/security/data/cve/CVE-2023-51384.md) | Routine | OpenSSH: Multiple issues in OpenSSH | 5.5 | 0.0043 |  |
| [CVE-2024-23293](https://patchblox.com/security/data/cve/CVE-2024-23293.md) | Routine | Siri: An attacker with physical access may be able to use Siri to access sensitive user data | 4.6 | 0.0041 |  |
| [CVE-2024-23289](https://patchblox.com/security/data/cve/CVE-2024-23289.md) | Routine | Siri: A person with physical access to a device may be able to use Siri to access private calendar information | 5.5 | 0.0029 |  |
| [CVE-2024-23229](https://patchblox.com/security/data/cve/CVE-2024-23229.md) | Routine | Find My: A malicious application may be able to access Find My data | 5.5 | 0.0028 |  |
| [CVE-2024-23216](https://patchblox.com/security/data/cve/CVE-2024-23216.md) | Routine | PackageKit: An app may be able to overwrite arbitrary files | 6.7 | 0.0027 |  |
| [CVE-2024-23231](https://patchblox.com/security/data/cve/CVE-2024-23231.md) | Routine | Share Sheet: An app may be able to access user-sensitive data | 3.3 | 0.0027 |  |
| [CVE-2024-23283](https://patchblox.com/security/data/cve/CVE-2024-23283.md) | Routine | Notes: An app may be able to access user-sensitive data | 6.2 | 0.0026 |  |
| [CVE-2024-23292](https://patchblox.com/security/data/cve/CVE-2024-23292.md) | Routine | Shortcuts: An app may be able to access information about a user's contacts | 3.3 | 0.0025 |  |
| [CVE-2024-23279](https://patchblox.com/security/data/cve/CVE-2024-23279.md) | Routine | MediaRemote: An app may be able to access user-sensitive data | 5.3 | 0.0025 |  |
| [CVE-2024-23227](https://patchblox.com/security/data/cve/CVE-2024-23227.md) | Routine | Airport: An app may be able to read sensitive location information | 6.2 | 0.0025 |  |
| [CVE-2024-23269](https://patchblox.com/security/data/cve/CVE-2024-23269.md) | Routine | AppleMobileFileIntegrity: An app may be able to modify protected parts of the file system | 6.2 | 0.0025 |  |
| [CVE-2024-23272](https://patchblox.com/security/data/cve/CVE-2024-23272.md) | Routine | Storage Services: A user may gain access to protected parts of the file system | 5.5 | 0.0024 |  |
| [CVE-2024-23250](https://patchblox.com/security/data/cve/CVE-2024-23250.md) | Routine | CoreBluetooth - LE: An app may be able to access Bluetooth-connected microphones without user permission | 5.5 | 0.0024 |  |
| [CVE-2024-27887](https://patchblox.com/security/data/cve/CVE-2024-27887.md) | Routine | NSSpellChecker: An app may be able to access user-sensitive data | 6.2 | 0.0023 |  |
| [CVE-2024-23244](https://patchblox.com/security/data/cve/CVE-2024-23244.md) | Routine | Dock: An app from a standard user account may be able to escalate privilege after admin user login | 6.7 | 0.0023 |  |
| [CVE-2024-23281](https://patchblox.com/security/data/cve/CVE-2024-23281.md) | Routine | System Settings: An app may be able to access sensitive user data | 6.2 | 0.0023 |  |
| [CVE-2024-23266](https://patchblox.com/security/data/cve/CVE-2024-23266.md) | Routine | Kerberos v5 PAM module: An app may be able to modify protected parts of the file system | 5.5 | 0.0023 |  |
| [CVE-2022-42816](https://patchblox.com/security/data/cve/CVE-2022-42816.md) | Routine | PackageKit: An app may be able to modify protected parts of the file system | 5.5 | 0.0023 |  |
| [CVE-2024-23267](https://patchblox.com/security/data/cve/CVE-2024-23267.md) | Routine | PackageKit: An app may be able to bypass certain Privacy preferences | 5.5 | 0.0023 |  |
| [CVE-2024-23232](https://patchblox.com/security/data/cve/CVE-2024-23232.md) | Routine | Screen Capture: An app may be able to capture a user's screen | 3.3 | 0.0022 |  |
| [CVE-2024-23205](https://patchblox.com/security/data/cve/CVE-2024-23205.md) | Routine | ExtensionKit: An app may be able to access sensitive user data | 5.5 | 0.0022 |  |
| [CVE-2024-23260](https://patchblox.com/security/data/cve/CVE-2024-23260.md) | Routine | TV App: An app may be able to access user-sensitive data | 5.5 | 0.0022 |  |
| [CVE-2023-42853](https://patchblox.com/security/data/cve/CVE-2023-42853.md) | Routine | PackageKit: An app may be able to access user-sensitive data | 5.5 | 0.0021 |  |
| [CVE-2024-23242](https://patchblox.com/security/data/cve/CVE-2024-23242.md) | Routine | Synapse: An app may be able to view Mail data | 3.3 | 0.0021 |  |
| [CVE-2024-23230](https://patchblox.com/security/data/cve/CVE-2024-23230.md) | Routine | SharedFileList: An app may be able to access sensitive user data | 5.5 | 0.0021 |  |
| [CVE-2024-27809](https://patchblox.com/security/data/cve/CVE-2024-27809.md) | Routine | Music: An app may be able to access user-sensitive data | 5.5 | 0.0020 |  |
| [CVE-2024-27853](https://patchblox.com/security/data/cve/CVE-2024-27853.md) | Routine | libarchive: A maliciously crafted ZIP archive may bypass Gatekeeper checks | 4.4 | 0.0019 |  |
| [CVE-2024-23275](https://patchblox.com/security/data/cve/CVE-2024-23275.md) | Routine | PackageKit: An app may be able to access protected user data | 4.7 | 0.0017 |  |
| [CVE-2024-27792](https://patchblox.com/security/data/cve/CVE-2024-27792.md) | Routine | TCC: An app may be able to access user-sensitive data | 5.5 | 0.0017 |  |

---

Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.