iTunes for Windows vulnerabilities

7 known vulnerabilities in iTunes for Windows from Apple. 7 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  iTunes for Windows: Improper Preservation of Permissions

  CVE-2024-44193Oct 2, 2024Apple

  A logic issue was addressed with improved restrictions. This issue is fixed in iTunes 12.13.3 for Windows. A local attacker may be able to elevate their privileges.

• 7.8 High severity

  iTunes for Windows: Improper Control of Generation of Code

  CVE-2024-27793May 14, 2024Apple

  The issue was addressed with improved checks. This issue is fixed in iTunes 12.13.2 for Windows. Parsing a file may lead to an unexpected app termination or arbitrary code execution.

• 7.8 High severity

  iTunes for Windows: Protection Mechanism Failure

  CVE-2022-48611Apr 26, 2024Apple

  A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.12.4 for Windows. A local attacker may be able to elevate their privileges.

• 7.8 High severity

  iTunes for Windows: Protection Mechanism Failure

  CVE-2023-42938Mar 14, 2024Apple

  A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.13.1 for Windows. A local attacker may be able to elevate their privileges.

• 7.8 High severity

  iTunes for Windows: Protection Mechanism Failure

  CVE-2022-26774May 26, 2022Apple

  A logic issue was addressed with improved state management. This issue is fixed in iTunes 12.12.4 for Windows. A local attacker may be able to elevate their privileges.

• 7.1 High severity

  iTunes for Windows: Improper Authorization

  CVE-2022-26773May 26, 2022Apple

  A logic issue was addressed with improved state management. This issue is fixed in iTunes 12.12.4 for Windows. An application may be able to delete files for which it does not have permission.

• 8.8 High severity

  Apple Multiple Products Type Confusion Exploited

  CVE-2019-8506Dec 18, 2019AppleEPSS 16.2%

  A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code