CVE-2023-42824highunder attack

CVE-2023-42824: high-severity vulnerability in Apple iOS and iPadOS

Published · Updated

71Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 7.8epss 1.0%
from disclosure to weapon864 days
Published on NVDOct 4
1st PoC+864d
CISA KEV+1d
exploitation probability
1.0%top 38% of all CVEs
observed exploitation
yesCISA + VulnCheck
1 public exploit(s)
Action required by CISAfederal deadline: 2023-10-26

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

A flaw in iOS and iPadOS allows someone with local access to the device to gain higher privileges than they should have. This is a serious issue because it means a limited user account could take control of the entire system.

Technical detail

A privilege escalation vulnerability in iOS/iPadOS 16.x (before 16.7.1) allows a local attacker to elevate privileges through improved checks that were not enforced. The vulnerability requires local access to the device and has been observed in active exploits targeting versions prior to iOS 16.6, resulting in unauthorized system-level control.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The issue was addressed with improved checks. This issue is fixed in iOS 16.7.1 and iPadOS 16.7.1. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Apple · iOS and iPadOS
public PoCs found — 1
vulncheckvulncheck.com/xdb/f9a15a8c37bfunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Apple iOS and iPadOS

In the same product, most dangerous first.

CVE-2023-41064HIGHCVE-2023-41064EPSS 53.4%KEVCVE-2023-32434HIGHCVE-2023-32434EPSS 51.5%KEVCVE-2025-43300CRITICALCVE-2025-43300EPSS 32.0%KEVCVE-2023-28205HIGHCVE-2023-28205EPSS 27.1%KEVCVE-2023-32439HIGHCVE-2023-32439EPSS 24.0%KEVCVE-2023-28206HIGHCVE-2023-28206EPSS 23.2%KEV
References
https://support.apple.com/en-us/HT213972https://support.apple.com/kb/HT213961https://support.apple.com/kb/HT213972https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-42824