CVE-2023-41990
Apple Multiple Products Code Execution Vulnerability
Description
CVE-2023-41990 is a HIGH severity code execution vulnerability in Apple’s font processing subsystem, affecting multiple Apple platforms including iOS, iPadOS, macOS, tvOS, and watchOS. Processing a specially crafted font file can trigger arbitrary code execution due to improper cache handling within the font rendering engine. Apple has confirmed that this vulnerability was actively exploited against iOS versions released before iOS 15.7.1, classifying it as a zero-day used in real-world attacks. The issue is resolved in tvOS 16.3, iOS 16.3 and iPadOS 16.3, macOS Monterey 12.6.8, macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8, macOS Ventura 13.2, and watchOS 9.3. With a CVSS score of 7.8 and confirmed in-the-wild exploitation, CVE-2023-41990 represents a significant threat to unpatched Apple devices.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | ipados | < 15.7.8; >= 16.0, < 16.3 |
| apple | iphone os | < 15.7.8; >= 16.0, < 16.3 |
| apple | macos | < 11.7.9; >= 12.0.0, < 12.6.8; >= 13.0, < 13.2 |
| apple | tvos | < 16.3 |
| apple | watchos | < 9.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://support.apple.com/en-us/HT213599(Vendor Advisory)
- https://support.apple.com/en-us/HT213601(Vendor Advisory)
- https://support.apple.com/en-us/HT213605(Vendor Advisory)
- https://support.apple.com/en-us/HT213606(Vendor Advisory)
- https://support.apple.com/en-us/HT213842(Vendor Advisory)
- https://support.apple.com/en-us/HT213844(Vendor Advisory)
- https://support.apple.com/en-us/HT213845(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41990(US Government Resource)
Weakness Type
No specific CWE classification has been assigned to CVE-2023-41990 by NVD. Based on the vulnerability description, the issue involves improper cache handling during font file processing that leads to memory corruption or logic errors enabling arbitrary code execution. This class of vulnerability typically arises when cached state is not properly validated or invalidated, allowing an attacker-controlled font file to trigger unintended code paths.
Learn more: CWE — Common Weakness Enumeration
Impact Analysis
CVE-2023-41990 carries a CVSS 3.1 score of 7.8 (HIGH), with the attack vector classified as Local and requiring user interaction, meaning a target must open or process a malicious font file. Despite being a local attack vector, the exploitation of this vulnerability in the wild against iOS devices before version 15.7.1 demonstrates it was weaponized likely through document or media delivery vectors, such as malicious attachments or web content that trigger font rendering. Confidentiality (High): Successful exploitation can expose sensitive user data stored on the device. Integrity (High): Attackers can modify system data, install malware, or tamper with applications. Availability (High): The vulnerability can be used to crash or disable device functions. CISA has added this to the Known Exploited Vulnerabilities catalog with a remediation deadline of January 29, 2024.
Exploit Maturity
CVE-2023-41990 has been confirmed as actively exploited in the wild. Apple publicly acknowledged awareness of a report indicating this issue was used against iOS versions released before iOS 15.7.1, marking it as a zero-day at the time of discovery. CISA added this vulnerability to the Known Exploited Vulnerabilities catalog, confirming active exploitation and mandating remediation by January 29, 2024. No public exploit code or proof-of-concept has been identified in the available references, suggesting the exploit may have been used by sophisticated, targeted threat actors rather than widely distributed. The EPSS score of 2.69% reflects relatively low broader exploitation probability, consistent with a targeted rather than mass-exploitation scenario.
Remediation
- Apply vendor patches immediately: Per the CISA KEV required action, apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Update all affected Apple devices to the patched versions: iOS 16.3 / iPadOS 16.3, iOS 15.7.8 / iPadOS 15.7.8, macOS Ventura 13.2, macOS Monterey 12.6.8, macOS Big Sur 11.7.9, tvOS 16.3, or watchOS 9.3.
- Prioritize legacy devices: Devices that cannot receive iOS 16.x updates should be updated to at minimum iOS 15.7.8 or iPadOS 15.7.8, which also contain the fix.
- Restrict untrusted font file handling: Until patched, minimize exposure to untrusted font files, documents, and media. Avoid opening attachments from unknown sources on unpatched devices.
- Monitor for indicators of compromise: Review device logs and use Mobile Device Management (MDM) solutions to detect anomalous process executions or unexpected privilege escalation, particularly on devices that remained unpatched past the exploit window.
- Enable automatic updates: Configure Apple devices to receive automatic security updates to minimize the time window between patch release and deployment.
Technical Details
CVE-2023-41990 results from a flaw in Apple’s font processing code, specifically in how caches are managed during font file parsing. The vulnerability has a CVSS vector of CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating that while the attack is local in nature, it requires no privileges and only minimal user interaction (opening a font-bearing file). The attack complexity is Low, meaning no special preconditions or race conditions need to be satisfied. The improper cache handling creates a condition where a maliciously crafted font file can corrupt memory or redirect execution flow, ultimately achieving arbitrary code execution within the context of the processing application or system component. This vulnerability affects the font rendering stack shared across Apple’s operating system family, explaining why fixes were simultaneously released across iOS, iPadOS, macOS (multiple versions), tvOS, and watchOS.
Frequently Asked Questions
Is CVE-2023-41990 being actively exploited?
Yes. Apple confirmed that CVE-2023-41990 was actively exploited against iOS versions released before iOS 15.7.1. CISA subsequently added it to the Known Exploited Vulnerabilities catalog, requiring federal agencies to remediate by January 29, 2024. This makes patching urgent for all affected Apple device users.
What products are affected by CVE-2023-41990?
CVE-2023-41990 affects a broad range of Apple platforms: iOS and iPadOS (versions before 16.3 and 15.7.8), macOS Ventura (before 13.2), macOS Monterey (before 12.6.8), macOS Big Sur (before 11.7.9), tvOS (before 16.3), and watchOS (before 9.3).
How do I fix CVE-2023-41990?
Update all affected Apple devices to the patched versions released in January 2023 and beyond: iOS 16.3, iPadOS 16.3, iOS 15.7.8, macOS Ventura 13.2, macOS Monterey 12.6.8, macOS Big Sur 11.7.9, tvOS 16.3, and watchOS 9.3. Enable automatic updates to ensure timely protection going forward.
How severe is CVE-2023-41990?
CVE-2023-41990 is rated HIGH severity with a CVSS 3.1 score of 7.8. The vulnerability enables arbitrary code execution through a malicious font file. Combined with confirmed in-the-wild exploitation and CISA KEV listing, this vulnerability should be treated as a critical priority for patching across all affected Apple platforms.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.