Apple · iOS and iPadOS
CVE-2023-42824
Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability
What it is
The issue was addressed with improved checks. This issue is fixed in iOS 16.7.1 and iPadOS 16.7.1. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6.
CISA: Apple iOS and iPadOS contain an unspecified vulnerability that allows for local privilege escalation.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: October 26, 2023
- Added to the CISA list
- October 5, 2023
- Published
- October 4, 2023
- Severity
- High 7.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 1.0% in the top 38.3% of all known vulnerabilities
- More details
- NVD · CVE.org · CISA
All references (1)
More exploited flaws from Apple
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Mar 5, 2026 | Use-After-Free | iOS and iPadOS | High 7.8 | 2.0% |
| Feb 12, 2025 | Incorrect Authorization | iOS and iPadOS | Medium 6.1 | 4.5% |
| Oct 25, 2022 | Out-of-Bounds Write | iOS and iPadOS | High 7.8 | 1.1% |
| Jun 27, 2022 | Buffer Overflow | iOS and iPadOS | High 7.8 | 2.9% |
| Sep 29, 2026 | Out-of-Bounds Write | Multiple Products | High 8.8 | 26% |
| Aug 18, 2026 | Improper Authentication | macOS | Critical 9.8 | 1.7% |
| Mar 20, 2026 | Buffer Overflow | Multiple Products | High 8.8 | 1.7% |
| Mar 20, 2026 | Improper Locking | Multiple Products | High 7.8 | 0.4% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.