Buffer overflow in macOS - CVE-2023-42898
Published: December 11, 2023
Vulnerability identifier: #VU84074
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-42898
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the ImageIO component. A remote attacker can create a specially crafted image file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
macOS
watchOS
tvOS
iPadOS
Apple iOS
watchOS
tvOS
iPadOS
Apple iOS
How to mitigate CVE-2023-42898
Install updates from vendor's website.
macOS - update to 14.2 23C64
watchOS - update to 10.2
tvOS - update to 17.2
iPadOS - update to 17.2 21C62
Apple iOS - update to 17.2 21C62
watchOS - update to 10.2
tvOS - update to 17.2
iPadOS - update to 17.2 21C62
Apple iOS - update to 17.2 21C62