CVE-2023-23536

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The issue was addressed with improved bounds checks. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, macOS Big Sur 11.7.5, iOS 15.7.4 and iPadOS 15.7.4, macOS Monterey 12.6.4, tvOS 16.4, watchOS 9.4. An app may be able to execute arbitrary code with kernel privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Apple	macOS	>= unspecified, < 13.3
Apple	iOS and iPadOS	>= unspecified, < 16.4
Apple	macOS	>= unspecified, < 12.6
Apple	watchOS	>= unspecified, < 9.4
Apple	tvOS	>= unspecified, < 16.4
Apple	macOS	>= unspecified, < 11.7
Apple	iOS and iPadOS	>= unspecified, < 15.7

References

https://support.apple.com/en-us/HT213670Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT213673Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT213674
https://support.apple.com/en-us/HT213675
https://support.apple.com/en-us/HT213676Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT213677
https://support.apple.com/en-us/HT213678
https://support.apple.com/en-us/HT213670Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT213673Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT213674
https://support.apple.com/en-us/HT213675
https://support.apple.com/en-us/HT213676Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT213677
https://support.apple.com/en-us/HT213678

Timeline

Published: May 8, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-235375.5A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and CVE-2023-235385.5A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4. An app may be able to mo CVE-2023-235397.8A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.2. Mounting a maliciously craft CVE-2023-23545.4The CHP Ads Block Detector plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings reachable though an AJAX act CVE-2023-235407.8The issue was addressed with improved memory handling. This issue is fixed in iOS 15.7.8 and iPadOS 15.7.8, macOS Monterey 12.6.4, iOS 16.4 CVE-2023-235413.3A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS CVE-2023-235425.5A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventura 13.3, macOS Montere CVE-2023-235433.6The issue was addressed with additional restrictions on the observability of app states. This issue is fixed in macOS Ventura 13.3, iOS 15.7 CVE-2023-235455.3Missing authentication for critical function exists in T&D Corporation and ESPEC MIC CORP. data logger products, which may allow a remote un CVE-2023-235468.1A misconfiguration vulnerability exists in the urvpn_client functionality of Milesight UR32L v32.3.0.5. A specially-crafted man-in-the-middl CVE-2023-235476.5A directory traversal vulnerability exists in the luci2-io file-export mib functionality of Milesight UR32L v32.3.0.5. A specially crafted n CVE-2023-235486.1Reflected XSS in business intelligence in Checkmk <2.2.0p8, <2.1.0p32, <2.0.0p38, <=1.6.0p30.