Apple · iOS, iPadOS, and macOS
CVE-2023-28206
Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write Vulnerability
What it is
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.6.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1, iOS 15.7.5 and iPadOS 15.7.5, macOS Big Sur 11.7.6. An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.
CISA: Apple iOS, iPadOS, and macOS IOSurfaceAccelerator contain an out-of-bounds write vulnerability that allows an app to execute code with kernel privileges.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 1, 2023
More exploited flaws from Apple
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Aug 21, 2025 | Out-of-Bounds Write | iOS, iPadOS, and macOS | Critical 10.0 | 65% |
| Sep 11, 2023 | ImageIO Buffer Overflow | iOS, iPadOS, and macOS | High 7.8 | 53% |
| Mar 30, 2023 | Out-of-Bounds Write | iOS, iPadOS, and macOS | High 7.8 | 5.2% |
| Sep 14, 2022 | Remote Code Execution | iOS, iPadOS, and macOS | High 7.8 | 5.6% |
| Sep 8, 2022 | Input Validation | iOS, iPadOS, and macOS | Medium 5.5 | 3.2% |
| Feb 11, 2022 | Webkit Use-After-Free | iOS, iPadOS, and macOS | High 8.8 | 16% |
| Nov 3, 2021 | WebKit Remote Code Execution | iOS, iPadOS, and macOS | Critical 9.8 | 7.7% |
| Nov 3, 2021 | WebKit Remote Code Execution | iOS, iPadOS, and macOS | Critical 9.8 | 7.0% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.