CVE-2014-4404

CVE-2014-4404 is a heap-based buffer overflow (CWE-119) in the IOHIDFamily component of Apple OS X, and the flaw also affects iOS versions before 8 and Apple TV software before 7. IOHIDFamily is the OS X/iOS kernel component that handles Human Interface Device (HID) processing; the source data does not specify the exact trigger, but the overflow occurs when this kernel component handles crafted HID-related input or data. A successful attacker gains the ability to execute arbitrary code in a privileged context, effectively kernel-level privileges on the affected device. Affected populations are Apple OS X systems (per CISA), iOS devices running iOS 7 or earlier, and Apple TV units on software prior to version 7. Exploitation is confirmed in the wild: the flaw was added to the CISA Known Exploited Vulnerabilities catalog on 2022-02-10, and EPSS assigns a 49% probability of exploitation in the next 30 days (99th percentile).

What to do: Apply updates per vendor instructions: upgrade iOS devices to iOS 8 or later and Apple TV to software 7 or later, and ensure Macs run an OS X build containing Apple's IOHIDFamily fix (verify against Apple's security update list, as the source data does not name the fixed OS X version). Inventory your estate for legacy iOS, Apple TV, and OS X installations, since these are 2014-era version ranges and the flaw is on CISA's KEV list, which mandates remediation per vendor instructions. Treat kernel-level code execution as full device compromise when triaging any suspected exploitation.