All vulnerabilities
CVE-2023-28206

Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write Vulnerability

Apple iOS, iPadOS, and macOSOperating systems
Open in ThreatlineRecord JSON
CVSS
8.6High
ExploitationExploited in the wildAdded to KEV 10 Apr 2023CISA KEV
Exploit odds (EPSS)23.2%Chance of exploitation activity in the next 30 days, higher than 97% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in15.7Also 11.7, 12.6 and 2 moreCVE List
Federal deadline1 May 2023Remediation due date for US federal agenciesCISA KEV
CISA required actionApply updates per vendor instructions. CISA KEV

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 10 Apr 2023, 00:00 UTCPublishedCVE List
  2. 10 Apr 2023Added to CISA KEVCISA KEV

Description

Apple iOS, iPadOS, and macOS IOSurfaceAccelerator contain an out-of-bounds write vulnerability that allows an app to execute code with kernel privileges.

Text from CVE List

Affected versions 5

  • iOS and iPadOSaffected: unspecified before 15.7CVE List
  • macOSaffected: unspecified before 11.7CVE List
  • macOSaffected: unspecified before 12.6CVE List
  • macOSaffected: unspecified before 13.3CVE List
  • iOS and iPadOSaffected: unspecified before 16.4CVE List

References 8