← Vulnerability feed

Vulnerability record · CVE-2023-32434 · published 23 June 2023

CVE-2023-32434: Apple iOS, iPadOS, macOS and watchOS integer overflow allows kernel code execution

Apple · Ipados

An integer overflow in Apple's kernel, addressed through improved input validation, affects iOS, iPadOS, macOS and watchOS. Apple states it is aware of a report that the issue may have been actively exploited against iOS versions before 15.7, making it a confirmed in-the-wild kernel privilege escalation.

7.8 CVSS 3.1 High CISA KEV since 23 Jun 2023 EPSS 52% · top 1.1% CWE-190 · Integer overflow
7.8CVSS 3.1 base score
52%EPSS exploitation probability, 30 days
YesIn CISA KEV, fix deadline passed
4Affected product versions listed by NVD
19References
17 Jun 2026Last modified by NVD

Description

An integer overflow was addressed with improved input validation. This issue is fixed in watchOS 9.5.2, macOS Big Sur 11.7.8, iOS 15.7.7 and iPadOS 15.7.7, macOS Monterey 12.6.7, watchOS 8.8.1, iOS 16.5.1 and iPadOS 16.5.1, macOS Ventura 13.4.1. An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a KEV-listed kernel code execution flaw with confirmed in-the-wild exploitation and a very high EPSS score, though it requires local access and user interaction.

What it is

An integer overflow in Apple's kernel, addressed through improved input validation, affects iOS, iPadOS, macOS and watchOS. Apple states it is aware of a report that the issue may have been actively exploited against iOS versions before 15.7, making it a confirmed in-the-wild kernel privilege escalation.

Impact

An attacker who gets a crafted app to run can execute arbitrary code with kernel privileges, effectively taking full control of the device.

Attack surface

The CVSS vector is local (AV:L) with user interaction required (UI:R) and no privileges (PR:N), so the flaw is reached by running a malicious app on the target device rather than over the network.

Exploitation

The vulnerability is listed in CISA KEV with a 2023-07-14 remediation due date, and EPSS gives a 30-day exploitation probability of about 0.52 (98.9th percentile), indicating observed exploitation and high likelihood of continued targeting.

What to do

  • Apply the Apple updates that fix this issue: iOS 16.5.1 and iPadOS 16.5.1, iOS 15.7.7 and iPadOS 15.7.7, macOS Ventura 13.4.1, macOS Monterey 12.6.7, macOS Big Sur 11.7.8, watchOS 9.5.2 and watchOS 8.8.1.
  • Prioritize patching devices still running iOS versions before 15.7, which Apple identified as the actively exploited range.
  • Restrict installation of untrusted or sideloaded apps and enforce app-store or managed-software policies to reduce the local attack path.
  • Track KEV remediation deadlines and verify fleet-wide patch compliance for all affected Apple platforms, including watches and older macOS releases.

Detection

  • Monitor for unexpected kernel-level crashes or panics on unpatched Apple devices, which can accompany integer overflow exploitation attempts.
  • Audit installed OS versions across iOS, iPadOS, macOS and watchOS to identify endpoints below the fixed releases.
  • Review endpoint telemetry for suspicious app behavior that escalates to kernel privileges shortly after user-initiated app launches.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Exploitation in the wild

CISA added CVE-2023-32434 to the Known Exploited Vulnerabilities catalog on 23 June 2023 as "Apple Multiple Products Integer Overflow Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 14 July 2023.

Affected products

4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://seclists.org/fulldisclosure/2023/Oct/20 Mailing ListThird Party Advisory
https://support.apple.com/en-us/HT213808 Vendor Advisory
https://support.apple.com/en-us/HT213809 Vendor Advisory
https://support.apple.com/en-us/HT213810 Vendor Advisory
https://support.apple.com/en-us/HT213811 Vendor Advisory
https://support.apple.com/en-us/HT213812 Vendor Advisory
https://support.apple.com/en-us/HT213813 Vendor Advisory
https://support.apple.com/en-us/HT213814 Vendor Advisory
https://support.apple.com/kb/HT213990 Vendor Advisory
http://seclists.org/fulldisclosure/2023/Oct/20 Mailing ListThird Party Advisory
https://support.apple.com/en-us/HT213808 Vendor Advisory
https://support.apple.com/en-us/HT213809 Vendor Advisory
https://support.apple.com/en-us/HT213810 Vendor Advisory
https://support.apple.com/en-us/HT213811 Vendor Advisory
https://support.apple.com/en-us/HT213812 Vendor Advisory
https://support.apple.com/en-us/HT213813 Vendor Advisory
https://support.apple.com/en-us/HT213814 Vendor Advisory
https://support.apple.com/kb/HT213990 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-32434 US Government Resource

Track CVE-2023-32434 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2025-43300Apple iOS, iPadOS and macOS out-of-bounds write via malicious imageAn out-of-bounds write in Apple iOS, iPadOS and macOS is triggered when processing a malicious image file, causing memory corruption. Apple states th…KEVEPSS 22%analysed10.0CVE-2025-24201Apple WebKit out-of-bounds write allows sandbox escapeCVE-2025-24201 is an out-of-bounds write in Apple's WebKit that was addressed with improved checks. Maliciously crafted web content may break out of …KEVEPSS 3.8%analysed10.0CVE-2025-24085Apple iOS, iPadOS, macOS, tvOS, visionOS, watchOS Use-After-Free Privilege EscalationA use-after-free flaw in Apple's operating systems was fixed through improved memory management in iOS 18.3, iPadOS 18.3 and 17.7.6, macOS Sequoia 15…KEVEPSS 18%analysed9.8CVE-2026-65400Apple macOS Screen Sharing authentication bypassAn improper authentication flaw in Apple macOS Screen Sharing allows a network attacker to authenticate without valid credentials. Apple fixed it via…KEVEPSS 1.2%analysed9.8CVE-2025-31200Apple OS media parsing memory corruption allows code executionA memory corruption flaw in Apple's audio stream processing was fixed with improved bounds checking across iOS, iPadOS, macOS, tvOS, visionOS and wat…KEVEPSS 19%analysed9.8CVE-2025-31201Apple OS Pointer Authentication bypass via arbitrary read/writeApple removed vulnerable code that allowed an attacker holding arbitrary read and write capability to bypass Pointer Authentication across iOS, iPadO…KEVEPSS 14%analysed9.8CVE-2022-22587Apple iOS, iPadOS and macOS kernel memory corruption via out-of-bounds writeAn out-of-bounds write (CWE-787) in Apple iOS, iPadOS and macOS is caused by insufficient input validation and can corrupt memory. Apple states it is…KEVEPSS 12%analysed9.8CVE-2021-1870Apple WebKit logic flaw allows remote code executionA logic issue in Apple's WebKit was addressed with improved restrictions, affecting macOS Big Sur, Catalina, Mojave, iOS and iPadOS, plus WebKitGTK a…KEVEPSS 7.7%analysed

Source: NIST National Vulnerability Database (record CVE-2023-32434), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.