CVE-2023-41974: Apple iOS and iPadOS use-after-free allows kernel code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw gives kernel-level code execution and is listed in CISA KEV with a confirmed exploit reference, though it requires local access and user interaction rather than being remotely reachable.

What it is

A use-after-free flaw in Apple iOS and iPadOS was fixed through improved memory management in iOS 17, iPadOS 17, iOS 15.8.7 and iPadOS 15.8.7. Because the corruption occurs in kernel memory, a malicious app can turn it into arbitrary code execution at kernel privilege, the highest level on the device. The record does not name the specific kernel component involved.

Impact

An attacker who gets a crafted app onto the device can execute arbitrary code with kernel privileges, effectively taking full control of the operating system and bypassing app sandbox protections.

Attack surface

The CVSS vector is local (AV:L) with user interaction required (UI:R) and no privileges required (PR:N), so the flaw is reached by running a malicious or compromised app on the target device. No remote network path or prior authentication is described.

Exploitation

CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2026-03-05, and a Google Threat Intelligence reference is tagged as an exploit, indicating real-world exploitation. EPSS is low at roughly 1.4 percent (71st percentile), so mass scanning is unlikely, but targeted exploitation is confirmed.

What to do

• Update to iOS 17 or iPadOS 17, or to iOS 15.8.7 or iPadOS 15.8.7 for devices on the older branch, per Apple advisories.
• Treat unpatched devices as compromised-capable and prioritize them for immediate upgrade, following CISA KEV remediation deadlines.
• Restrict app installation to trusted sources and enforce mobile device management policies that block sideloaded or untrusted apps.
• Monitor for and remove suspicious or unknown applications that could carry the exploit payload.
• If patching is not possible, isolate or discontinue use of the affected device per CISA guidance.

Detection

• Inventory iOS and iPadOS versions across managed devices and flag any below the fixed releases.
• Alert on unexpected kernel-level crashes, panics or memory corruption reports from endpoint or MDM telemetry.
• Hunt for sideloaded, enterprise-signed or otherwise untrusted apps installed outside approved channels.
• Correlate device logs with known exploit-kit indicators such as the Coruna iOS exploit kit activity referenced by Google Threat Intelligence.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.