CVE-2023-41992

CVE-2023-41992 is a kernel privilege escalation flaw in Apple iOS, iPadOS and macOS that Apple fixed with improved checks in iOS 16.7, iPadOS 16.7, macOS Ventura 13.6 and macOS Monterey 12.7. A local attacker who already has some unprivileged access to a device can trigger the flaw to elevate their privileges, gaining high-impact access to confidentiality, integrity and availability (CVSS 7.8, local vector, low privileges, no user interaction). Anyone running affected pre-fix versions of iPhone OS, iPadOS or macOS is exposed; because the vector is local, remote attackers would typically need to chain it with another flaw or gain local access first. Apple reported the issue may have been actively exploited against iOS versions before 16.7, and CISA added it to the Known Exploited Vulnerabilities catalog on 2023-09-25; no public proof-of-concept is known and ransomware use is unconfirmed. Contemporaneous headlines about Predator/Intellexa spyware campaigns suggest targeted spyware operators were among the likely users of this and related Apple zero-days, though the data does not name specific victims for this CVE.

What to do: Upgrade affected devices to iOS 16.7 or later, iPadOS 16.7 or later, macOS Ventura 13.6 or later, or macOS Monterey 12.7 or later, prioritizing iPhones and iPads since the confirmed exploitation targeted pre-16.7 iOS. This satisfies the CISA KEV required action; no workarounds are described, and because exploitation is local, prioritize patching devices used by at-risk or high-value users and check for signs of spyware (e.g., Predator/Intellexa indicators) on devices that are not yet updated.