Actively exploited · Published Jun 23, 2023 · Assigned by apple
CVE-2023-32434
High 7.8 Exploited
In plain English
A high-severity integer overflow in iOS and iPadOS from Apple. Attackers are actively exploiting it in the wild (listed by CISA on June 23, 2023). The chance it is exploited in the next 30 days is estimated at 51.5% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jul 14, 2023.
Official description
An integer overflow was addressed with improved input validation. This issue is fixed in watchOS 9.5.2, macOS Big Sur 11.7.8, iOS 15.7.7 and iPadOS 15.7.7, macOS Monterey 12.6.7, watchOS 8.8.1, iOS 16.5.1 and iPadOS 16.5.1, macOS Ventura 13.4.1. An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apple | macOS | unspecified – before 12.6 |
| Apple | iOS and iPadOS | unspecified – before 15.7 |
| Apple | iOS and iPadOS | unspecified – before 16.5 |
| Apple | watchOS | unspecified – before 8.8 |
| Apple | watchOS | unspecified – before 9.5 |
| Apple | macOS | unspecified – before 13.4 |
| Apple | macOS | unspecified – before 11.7 |
Weakness: CWE-190 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://support.apple.com/en-us/HT213810
- https://support.apple.com/en-us/HT213811
- https://support.apple.com/en-us/HT213814
- https://support.apple.com/en-us/HT213808
- https://support.apple.com/en-us/HT213812
- https://support.apple.com/en-us/HT213813
- https://support.apple.com/en-us/HT213809
- https://support.apple.com/kb/HT213990
- http://seclists.org/fulldisclosure/2023/Oct/20
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-32434 government-resource