CVE-2023-41992KEV · OVERDUE

Apple Multiple Products Kernel Privilege Escalation Vulnerability

High · published September 21, 2023

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 95.4th percentile for exploit probability.

1104
days past CISA
deadline
CVSS v3.1
7.8
EPSS
10%
Percentile
95.4
In the wild
Confirmed
What it is

⚡ A clever local attacker could snag elevated privileges on your device with just the right moves! Think of it like a hotel concierge who can access the VIP lounges without the proper keycard — when a system flaw allows this, it's a serious security breach! If exploited, a local attacker could take control of your device with permissions they shouldn't have, potentially accessing sensitive information or making unauthorized changes. This could lead to data leaks or even a complete takeover of your device, which is absolutely devastating! 🚨

Put simply

Think of it like a hotel concierge who can access the VIP lounges without the proper keycard — when a system flaw allows this, it's a serious security breach! This vulnerability involves insufficient checks that could allow a local attacker to elevate their privileges on macOS and iOS devices, enabling them to gain access to restricted areas of the system.

What to do

If exploited, a local attacker could take control of your device with permissions they shouldn't have, potentially accessing sensitive information or making unauthorized changes. This could lead to data leaks or even a complete takeover of your device, which is absolutely devastating! 🚨 To protect yourself, update your devices immediately to macOS Monterey 12.7, iOS 16.7, or iPadOS 16.7. If you're on macOS Ventura, make sure you're running version 13.6. Don't wait — secure your devices now! You've got this! Follow these steps, and you'll fortify your defenses in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.09515 · 95.4th percentile
Published
2023-09-21T18:23Z
KEV added
2023-09-25 · due 2023-10-16
EPSS history
Timeline
  • 25 SEP 00:00Z
    Added to CISA KEV — remediate by Oct 16
    kev
  • 21 SEP 18:23Z
    The issue was addressed with improved checks
    cvelistv5