CVE-2023-23526

This was addressed with additional checks by Gatekeeper on files downloaded from an iCloud shared-by-me folder

Critical · published May 8, 2023

CVSS v3.1
9.8
EPSS
1%
Percentile
53.6
In the wild
Unconfirmed
What it is

🔥 An iCloud shared-by-me folder could be the sneaky door that bypasses Gatekeeper! Think of Gatekeeper as a bouncer at a club, checking IDs before letting anyone in. Now imagine that someone sneaks in via an invitation that nobody double-checked. That's what this vulnerability does! An attacker could potentially slip malicious files onto your system without raising any alarms. This means they could execute harmful actions, access sensitive data, or compromise your whole device without you even knowing it! 🚨 That's absolutely devastating!

Put simply

Think of Gatekeeper as a bouncer at a club, checking IDs before letting anyone in. Now imagine that someone sneaks in via an invitation that nobody double-checked. That's what this vulnerability does! This vulnerability allows files from an iCloud shared-by-me folder to bypass Gatekeeper checks, which are designed to prevent untrusted applications from running on macOS, iOS, and iPadOS. This weakness could enable unverified files to execute on your device, posing significant security risks.

What to do

An attacker could potentially slip malicious files onto your system without raising any alarms. This means they could execute harmful actions, access sensitive data, or compromise your whole device without you even knowing it! 🚨 That's absolutely devastating! To safeguard yourself, immediately update to macOS Ventura 13.3, iOS 16.4, or iPadOS 16.4. Don't wait—ensure your devices are protected against this vulnerability! Regularly check your software updates to stay secure. You've got this! Stay vigilant and keep your devices updated for a safer experience. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00726 · 53.6th percentile
Published
2023-05-08T00:00Z
EPSS history
Timeline
  • 08 MAY 00:00Z
    This was addressed with additional checks by Gatekeeper on files downloaded from an iCloud shared-by-me folder
    cvelistv5