VulnerabilitycriticalExploited in the wild

Operation Triangulation: The last (hardware) mystery

Kaspersky Securelistby @SecurelistDec 27, 2023 · 14:00 UTC (Dec 27, 2023)16 min read9 · 4 reads

Read at securelist.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2023-41990 CVE-2023-32434 CVE-2023-38606 CVE-2023-32435

Tags: cve-2023-41990 cve-2023-32434 cve-2023-38606 cve-2023-32435 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2023-32435 +1 related CVE CVE-2023-32434	Memory Corruption in Apple WebKit (iOS, iPadOS, macOS, Safari) Enables Code Execution	8.8 group max	23%	KEV	Jun 23, 2023 KEV Jun 23, 2023
CVE-2023-38606	Kernel State-Tampering Flaw in Apple iOS, iPadOS, macOS, tvOS and watchOS	5.5	3%	KEV	Jul 27, 2023 KEV Jul 26, 2023
CVE-2023-41990	Font Parsing Code Execution Flaw in Apple iOS, iPadOS, macOS, tvOS, watchOS	7.8	1%	KEV	Sep 12, 2023 KEV Jan 8, 2024

From the original article

16 min read at securelist.com

UPD 23. 04. 2025: MITRE created a page for Operation Triangulation as part of its ATT&CK framework.

Kaspersky Securelist

By @Securelist · securelist.com

Read the full article at Kaspersky Securelist

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.