CVE-2023-41990KEV · OVERDUE

Apple Multiple Products Code Execution Vulnerability

High · published September 11, 2023

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 72.0th percentile for exploit probability.

998
days past CISA
deadline
CVSS v3.1
7.8
EPSS
1%
Percentile
72.0
In the wild
Confirmed
What it is

🚨 An unassuming font file can be the entry point for disaster! This vulnerability allows attackers to execute arbitrary code on your Apple devices. 🔥 Think of it like receiving a seemingly harmless package that, once opened, unleashes chaos in your living room! Just as you wouldn’t want a surprise party gone wrong, an exploited font can cause mayhem on your system. An attacker could craft a malicious font file, leading to arbitrary code execution on your device. This means they could run any code they want, potentially compromising your personal data, accessing sensitive information, or even taking control of your device altogether! Absolutely devastating!

Put simply

Think of it like receiving a seemingly harmless package that, once opened, unleashes chaos in your living room! Just as you wouldn’t want a surprise party gone wrong, an exploited font can cause mayhem on your system. This vulnerability arises from improper handling of font files, which can allow an attacker to execute arbitrary code when the font is processed by vulnerable versions of iOS, iPadOS, or macOS.

What to do

An attacker could craft a malicious font file, leading to arbitrary code execution on your device. This means they could run any code they want, potentially compromising your personal data, accessing sensitive information, or even taking control of your device altogether! Absolutely devastating! Update all affected devices to the latest versions: tvOS 16.3, iOS 16.3, iPadOS 16.3, macOS Monterey 12.6.8, macOS Big Sur 11.7.9, or macOS Ventura 13.2. It’s crucial to ensure you’re on these versions to eliminate the risk. Patch now to secure your devices! You've got this! By updating your devices, you’re taking a strong step towards protecting yourself and your data! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01388 · 72.0th percentile
Published
2023-09-11T23:29Z
KEV added
2024-01-08 · due 2024-01-29
EPSS history
Timeline
  • 08 JAN 00:00Z
    Added to CISA KEV — remediate by Jan 29
    kev
  • 11 SEP 23:29Z
    The issue was addressed with improved handling of caches
    cvelistv5