CVE-2014-4404
Apple OS X Heap-Based Buffer Overflow Vulnerability
Published Sep 18, 2014 · updated Jun 16, 2026 · apple iphone os
Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an application that provides crafted key-mapping properties.
Timeline
Detection, updates, and resolution for this record.
Sep 18, 2014 · Catalog
Detected
Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an application that provides crafted key-mapping properties.
Feb 10, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Aug 10, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an application that provides crafted key-mapping properties.
Required action
Apply updates per vendor instructions.
CISA due date Aug 10, 2022
Affected
- cpe apple/iphone osversion unspecified
- cpe apple/mac os xversion unspecified
- cpe apple/tvosversion unspecified
- vendor Apple OS Xversion unspecified
Sources
- CISA KEVCVE-2014-4404
Heap-based buffer overflow in IOHIDFamily in Apple OS X, which affects, iOS before 8 and Apple TV before 7, allows attackers to execute arbitrary code in a privileged context.
cisa.gov - CVE.orgCVE-2014-4404
Official CVE identifier
cve.org - FIRST EPSSCVE-2014-4404
30-day exploitation probability 48.9%
first.org - Exploit Database35440
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesexploit_osx/local/iokit_keyboard_root
Public module reference (manual). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2014-4404
Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an application that provides crafted key-mapping properties.
nvd.nist.gov