CVE-2023-41974
Apple iOS and iPadOS Use-After-Free Vulnerability
Description
CVE-2023-41974 is a HIGH severity use-after-free vulnerability (CWE-416) in Apple iOS and iPadOS that allows a malicious application to execute arbitrary code with kernel privileges. The vulnerability was addressed with improved memory management in iOS 17, iPadOS 17, iOS 15.8.7, and iPadOS 15.8.7. With a CVSS 3.1 score of 7.8 and a vector of AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, the flaw requires local access and user interaction (installing a malicious app) but has low attack complexity and high impact across all three security dimensions. CISA added CVE-2023-41974 to the Known Exploited Vulnerabilities catalog on March 5, 2026, with a remediation deadline of March 26, 2026. The EPSS score of 0.007 (0.7th percentile) indicates limited broad exploitation, but the KEV listing confirms that the vulnerability has been actively exploited in targeted attacks.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | ipados | < 15.8.7; >= 16.0, < 17.0 |
| apple | iphone os | < 15.8.7; >= 16.0, < 17.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://support.apple.com/en-us/120949(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/126632(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT213938(Release Notes, Vendor Advisory)
- https://support.apple.com/kb/HT213938(Release Notes, Vendor Advisory)
- https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41974(US Government Resource)
Weakness Type
CWE-416: Use After Free
Use After Free (CWE-416) is a memory corruption vulnerability class where a program continues to reference memory after it has been freed. When freed memory is subsequently reallocated, the dangling pointer can be used to read or write data belonging to a different object, corrupt kernel data structures, or redirect execution flow. In the context of operating system kernels, use-after-free vulnerabilities are particularly dangerous because they can enable privilege escalation from user space to kernel space.
In CVE-2023-41974, the use-after-free exists in a kernel component of iOS and iPadOS. A malicious application running on the device can trigger a sequence of operations that causes a kernel object to be freed while a reference to it persists. By carefully manipulating memory allocation patterns, the attacker can cause the freed memory to be reallocated with attacker-controlled data. When the kernel subsequently accesses the dangling pointer, it operates on the attacker's data, enabling the attacker to corrupt kernel memory structures and achieve arbitrary code execution with kernel privileges. This represents a complete compromise of the device's security model, as kernel-level code execution bypasses all application sandboxing and security restrictions.
Impact Analysis
CVE-2023-41974 carries a CVSS 3.1 base score of 7.8 (HIGH), reflecting the severe consequences of kernel-level code execution despite the local attack vector.
Confidentiality (High): Code execution with kernel privileges provides unrestricted access to all data on the device. This includes data from all applications regardless of sandboxing, the full filesystem including protected system areas, encryption keys stored in memory, and all user data including messages, photos, contacts, and credentials. Kernel access also enables interception of all network communications and sensor data.
Integrity (High): Kernel-level code execution allows modification of any data on the device, including system files, application data, and security configuration. An attacker with kernel privileges can install persistent backdoors, modify system behavior, tamper with security mechanisms, and alter audit logs to conceal the compromise. The attacker can also modify the device's trust store to enable further man-in-the-middle attacks.
Availability (High): An attacker with kernel privileges can render the device inoperable, corrupt the filesystem, disable security features, or cause repeated crashes. While a device wipe and restore can typically recover from such attacks, the disruption to the user and potential data loss represent significant availability impact.
Scope (Unchanged): Although the CVSS scope is unchanged, the practical impact of kernel code execution on a mobile device is extremely broad. The attacker effectively controls all aspects of the device's operation, transcending all application-level security boundaries.
Exploit Maturity
Active Exploitation: CVE-2023-41974 is confirmed as actively exploited. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on March 5, 2026, with a federal remediation deadline of March 26, 2026. Kernel use-after-free vulnerabilities in iOS are high-value targets for commercial spyware vendors and state-sponsored threat actors.
Ransomware Association: CVE-2023-41974 is not associated with traditional ransomware campaigns. Kernel-level iOS vulnerabilities are primarily used in targeted surveillance operations, where the goal is persistent access to a specific individual's device rather than mass extortion.
Public Exploits: Apple's security advisories confirm that this vulnerability may have been exploited before patches were available. Technical details about the specific kernel component affected and exploitation techniques are available in the security research community, though full exploit chains are not widely published.
EPSS Context: The EPSS score of 0.007 (0.7th percentile) is low, reflecting the targeted nature of iOS kernel exploitation. The exploitation of kernel use-after-free vulnerabilities requires significant technical expertise and is typically performed by well-resourced threat actors against specific targets rather than in broad campaigns.
KEV Deadline: The CISA remediation deadline is March 26, 2026. All iOS and iPadOS devices should be updated immediately to patched versions.
Remediation
-
Update to patched iOS and iPadOS versions. Install iOS 17 or later and iPadOS 17 or later on all supported devices. For older devices that cannot run iOS/iPadOS 17, install iOS 15.8.7 or iPadOS 15.8.7. Apply updates through Settings > General > Software Update.
-
Enable automatic updates. Configure all iOS and iPadOS devices to automatically download and install security updates, including Rapid Security Responses for critical patches delivered outside regular update cycles.
-
Enforce minimum OS versions through MDM. Organizations managing iOS and iPadOS device fleets should configure Mobile Device Management policies that require minimum OS versions and restrict access to corporate resources from devices running vulnerable software.
-
Enable Lockdown Mode for high-risk users. Apple's Lockdown Mode provides additional protections against targeted exploitation by restricting device functionality that is commonly used in attack chains. Enable Lockdown Mode on devices belonging to users who may be targets of sophisticated threat actors.
-
Restrict app installation sources. Minimize the risk of users installing malicious applications by restricting app installation to the App Store only and disabling sideloading capabilities. Organizations can enforce this through MDM profiles.
-
Monitor for indicators of compromise. Deploy endpoint detection solutions capable of identifying signs of kernel exploitation on iOS devices, including unexpected reboots, unusual process behavior, and suspicious network connections. Consider using Apple's iMessage Contact Key Verification for users at risk of targeted attacks.
Technical Details
CVE-2023-41974 is a use-after-free vulnerability in the kernel of Apple iOS and iPadOS that allows a locally installed application to escalate privileges to kernel-level code execution. The vulnerability exists because a kernel object is freed during a specific sequence of operations while another kernel component retains a reference to the freed memory.
The use-after-free occurs in the device's kernel when a malicious application triggers a particular pattern of system calls or I/O operations that causes the kernel to free an internal data structure prematurely. The application can then perform heap manipulation techniques (known as heap spraying or heap grooming) to cause the freed memory region to be reallocated with attacker-controlled content. When the kernel subsequently uses the dangling pointer to access what it expects to be the original object, it instead operates on the attacker's crafted data.
The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects that exploitation requires local access (a malicious app installed on the device) and user interaction (the user must install or run the app). The low attack complexity indicates that once the malicious app is on the device, triggering the vulnerability is straightforward. The high impact across all three dimensions reflects the complete device compromise that kernel code execution provides.
Apple addressed the vulnerability with improved memory management, likely by implementing additional reference counting, lifetime tracking, or synchronization mechanisms to ensure that kernel objects are not freed while still being referenced. The fix was backported to iOS 15.8.7 and iPadOS 15.8.7, indicating that the vulnerable code path exists in the kernel across multiple iOS generations.
Frequently Asked Questions
What is CVE-2023-41974?
CVE-2023-41974 is a use-after-free vulnerability in the iOS and iPadOS kernel that allows a malicious application to execute arbitrary code with kernel privileges. This means an attacker who can get a malicious app installed on the device can completely compromise it, bypassing all application sandboxing and security restrictions to access all data and functionality.
Which Apple devices are affected?
All iPhones and iPads running iOS or iPadOS versions before iOS 17 / iPadOS 17 are affected. Apple also backported the fix to iOS 15.8.7 and iPadOS 15.8.7 for older devices that cannot run iOS/iPadOS 17. Check your device's current software version in Settings > General > About.
How do I fix CVE-2023-41974?
Update your iPhone or iPad to iOS 17 / iPadOS 17 or later. If your device cannot run iOS 17, update to iOS 15.8.7 or iPadOS 15.8.7. Enable automatic updates to receive future patches promptly. For organizations, use MDM to enforce minimum OS versions and restrict app installation to the App Store.
How serious is a kernel-level vulnerability on iOS?
Extremely serious. The iOS kernel controls all aspects of device operation and enforces all security boundaries between applications. An attacker with kernel code execution can access all data on the device (messages, photos, credentials, encrypted content), install persistent surveillance tools, intercept communications, and bypass all security features. Kernel vulnerabilities are the most valuable exploits in the iOS ecosystem and are actively sought by both defensive security researchers and offensive threat actors.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.