CVE-2024-11128

Insufficient Hardened Runtime or Library Validation signing in Bitdefender Virus Scanner for macOS

State: Published
Severity: 8.4 High
Published: Jan 13, 2025
Updated: Jan 14, 2025
Reserved: Nov 12, 2024

Description

A vulnerability in the BitdefenderVirusScanner binary as used in Bitdefender Virus Scanner for MacOS may allow .dynamic library injection (DYLD injection) without being blocked by AppleMobileFileIntegrity (AMFI). This issue is caused by the absence of Hardened Runtime or Library Validation signing. This issue affects Bitdefender Virus Scanner versions before 3.18.

Scores

CVSS	Score	Vector	Source
4.0	8.4 High	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N	Bitdefender

Weaknesses

CWE-269 Improper Privilege Management

Affected Products

Product	Versions
Virus ScannerBitdefender	before 3.18Affected

References

https://www.bitdefender.com/support/security-advisories/insufficient-hardened-runtime-or-library-validation-signing-in-bitdefender-virus-scanner-for-macos/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.