CVE-2023-41990

Deeper analysis

CVE-2023-41990 is a vulnerability in Apple's font file processing logic that stems from improper cache handling. It affects multiple Apple operating systems prior to the listed fixed versions, including tvOS before 16.3, iOS and iPadOS before 16.3 and 15.7.8, macOS Monterey before 12.6.8, macOS Big Sur before 11.7.9, macOS Ventura before 13.2, and watchOS before 9.3. The flaw received a CVSS score of 7.8 and can result in arbitrary code execution when a malicious font file is processed.

An attacker can exploit the issue by supplying a crafted font file that the victim opens or that is rendered by an affected application. Because the attack requires local access and user interaction, it is typically delivered via documents, web content, or other vectors that trigger font rendering on the target device. Successful exploitation grants the attacker the ability to execute arbitrary code with the privileges of the affected process.

Apple security advisories HT213599, HT213601, HT213605, HT213606, and HT213842 state that the issue was resolved by improved cache handling and list the exact build numbers for each affected platform. Users are advised to install the updates for iOS 16.3 / iPadOS 16.3, iOS 15.7.8 / iPadOS 15.7.8, macOS Ventura 13.2, macOS Monterey 12.6.8, macOS Big Sur 11.7.9, tvOS 16.3, and watchOS 9.3.

Apple has confirmed that the vulnerability was actively exploited in the wild against iOS versions released before 15.7.1. The EPSS score has remained low and stable, with a current value of 0.0268 and a peak of 0.0276.