CVE-2023-42888

MEDIUM

iPadOS 16.0-16.7.5 - Exposure of Sensitive Information via Maliciously Crafted Image

Title source: llm
STIX 2.1

Description

The issue was addressed with improved checks. This issue is fixed in iOS 16.7.5 and iPadOS 16.7.5, watchOS 10.2, macOS Ventura 13.6.4, macOS Sonoma 14.2, macOS Monterey 12.7.3, iOS 17.2 and iPadOS 17.2. Processing a maliciously crafted image may result in disclosure of process memory.

References (14)

Core 14
Core References
Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT214035
Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT214036
Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT214041
Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT214057
Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT214058
Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT214063
Release Notes, Vendor Advisory
https://support.apple.com/kb/HT214035
Release Notes, Vendor Advisory
https://support.apple.com/kb/HT214036
Release Notes, Vendor Advisory
https://support.apple.com/kb/HT214041

Scores

CVSS v3 5.5
EPSS 0.0003
EPSS Percentile 8.8%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-200
Status published
Products (4)
apple/ipados 16.0 - 16.7.5
apple/iphone_os 16.0 - 16.7.5
apple/macos 12.0 - 12.7.3
apple/watchos < 10.2
Published Jan 23, 2024
Tracked Since Feb 18, 2026