CVE-2023-41990: Apple font cache handling flaw allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with confirmed possible in-the-wild exploitation and a CVSS of 7.8, though the local vector and required user interaction limit mass exploitation.

What it is

Apple fixed a cache-handling defect across iOS, iPadOS, macOS, tvOS and watchOS where processing a font file can lead to arbitrary code execution. Apple stated it was aware of a report that the issue may have been actively exploited against iOS versions released before 15.7.1, making it a real-world targeted threat rather than a theoretical bug.

Impact

An attacker who gets a crafted font file processed can execute arbitrary code in the context of the affected process, with high impact to confidentiality, integrity and availability. On mobile devices this can mean full compromise of the user's data and device.

Attack surface

The vector is local (AV:L) with user interaction required (UI:R) and no privileges needed (PR:N), so the victim must open or render a malicious font file delivered by some means such as a message, document or web content. No authentication is required, but the user must trigger processing of the file.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2024-01-08 with a 2024-01-29 remediation due date, and Apple acknowledged possible active exploitation; EPSS is low at roughly 1.4 percent for the next 30 days, and no ransomware use is documented.

What to do

• Update to the fixed releases: iOS 16.3 and iPadOS 16.3, iOS 15.7.8 and iPadOS 15.7.8, macOS Ventura 13.2, macOS Monterey 12.6.8, macOS Big Sur 11.7.9, tvOS 16.3, watchOS 9.3.
• Prioritize patching devices still running iOS or iPadOS before 15.7.1, since exploitation was reported against those versions.
• Treat font files from untrusted or unexpected sources as hostile; block or strip embedded fonts at email and web gateways where feasible.
• Track KEV remediation deadlines and confirm all managed Apple devices meet the required patch level.
• For devices that cannot be updated, restrict exposure to untrusted content and consider discontinuing use per CISA guidance.

Detection

• Hunt for processes such as font rendering or document viewers spawning unexpected child processes or making unusual network connections.
• Monitor for anomalous crashes in font parsing or CoreText-related components on unpatched Apple devices.
• Review endpoint telemetry for suspicious file writes or persistence created shortly after a user opened a document or message containing fonts.
• Audit asset inventory for Apple devices reporting OS versions below the fixed releases listed in the advisories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.