CVE-2023-41992highunder attackCWE-754

CVE-2023-41992: high-severity vulnerability in Apple macOS

Published · Updated

Follow this CVE+ Monitor macOS+ Monitor iOS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

78Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 7.8epss 12%
from disclosure to weapon599 days
Published on NVDSep 21
1st PoC+599d
CISA KEV+4d
Action required by CISAfederal deadline: 2023-10-16

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

A local attacker on an Apple device could gain higher privileges (admin-like access) by exploiting a flaw in system checks. This was actively being exploited in the wild before the fix was released.

Technical detail

Privilege escalation vulnerability affecting macOS and iOS through insufficient validation checks (CWE-754). Requires local access; fixed in macOS Monterey 12.7, Ventura 13.6, and iOS/iPadOS 16.7. CVSS 7.8 reflects significant impact on system integrity and confidentiality.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, macOS Ventura 13.6. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Apple · iOS and iPadOSApple · macOS
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Apple macOS

In the same product, most dangerous first.

CVE-2021-30860HIGHCVE-2021-30860EPSS 76.0%KEVCVE-2021-30657MEDIUMCVE-2021-30657EPSS 68.5%KEVCVE-2025-43300CRITICALCVE-2025-43300EPSS 63.2%KEVCVE-2023-32434HIGHCVE-2023-32434EPSS 58.2%KEVCVE-2023-41064HIGHCVE-2023-41064EPSS 53.4%KEVCVE-2021-30807HIGHCVE-2021-30807EPSS 28.8%KEV