CVE-2023-38571

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2023-38571 is a symlink validation weakness that affects multiple macOS releases. The flaw resides in the handling of symbolic links used by the Privacy preferences mechanism and was corrected by improved validation checks in macOS Big Sur 11.7.9, macOS Monterey 12.6.8, and macOS Ventura 13.5. Successful exploitation allows an application to circumvent the restrictions configured in Privacy preferences, producing a high-integrity impact without requiring user interaction.

An unauthenticated attacker can deliver or execute an application over the network that leverages the symlink issue to alter or evade privacy controls. Because the vulnerability carries a CVSS vector of AV:N/AC:L/PR:N/UI:N, the attack can be mounted remotely and does not depend on local user privileges or explicit user actions.

Apple security advisories HT213843, HT213844, and HT213845 describe the issue and direct administrators to install the listed macOS updates as the primary mitigation. The associated EPSS score has remained in a narrow band between 0.1107 and 0.1288 with no pronounced upward movement after disclosure.