CVE-2024-54512 is a critical severity (CVSS 9.1) authorization issue in Apple iOS, iPadOS and watchOS, where a system binary could be used to fingerprint a user Apple Account. Apple fixed it by removing the relevant flags in iOS 18.2, iPadOS 18.2 and watchOS 11.2. Update affected devices.
What's affected
Apple lists the fix in iOS 18.2 and iPadOS 18.2, released December 11, 2024, and in watchOS 11.2. The security notes list the component as Accounts and the impact as a system binary that could be used to fingerprint a user Apple Account.
Apple says the issue was addressed by removing the relevant flags. The notes for iOS 18.2 and iPadOS 18.2 apply to iPhone XS and later and to a long list of iPad models.
The CVSS score of 9.1 is high compared to the plain language description, which only talks about fingerprinting an account. Read the vendor wording as the guide to real impact.
How to check if you're exposed
On an iPhone or iPad, open Settings, then General, then About, and read the software version. If it is below 18.2 for iOS or iPadOS, update. For an Apple Watch, check the version in the Watch app under General and About, and look for watchOS 11.2 or later.
For a fleet, use your mobile device management console to report the operating system versions and list devices below 18.2 or 11.2.
What to do now
- Report the OS version of all managed iPhones, iPads and Apple Watches.
- Update to iOS 18.2, iPadOS 18.2 and watchOS 11.2 or later.
- Use your device management tool to enforce a minimum OS version.
- Set automatic updates on for devices that are not managed.
- Retire devices that can no longer take the update if they hold sensitive accounts.
Why it matters
The weakness is CWE-863 (Incorrect Authorization). Something that should have been restricted was allowed, here a system binary that exposed information about the signed in account. Apple removed the relevant flags in the fix.
Fingerprinting an account does not read data directly, but it can help an attacker link activity to a person. The score is high because the CVSS vector is generous, so the plain wording from Apple is the better guide to risk. The record does not flag exploitation, and the CVE is not on the KEV list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-54512.
Quick check
Which updates fix CVE-2024-54512?
iOS 18.2, iPadOS 18.2 and watchOS 11.2, according to the Apple security notes.
Does this expose my files?
Apple describes the impact as fingerprinting a user Apple Account, not reading files.
Sources
- Apple security content for iOS 18.2 and iPadOS 18.2
- Apple security content for watchOS 11.2 (listed in the NVD record)
- Gold entry for CVE-2024-54512
Last reviewed: 19 October 2026.
