CVE-2023-35993

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to execute arbitrary code with kernel privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published
Jul 27, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-359947.8Multiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A speciaCVE-2023-359957.8Multiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A speciaCVE-2023-359967.8Multiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A speciaCVE-2023-359977.8Multiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A speciaCVE-2023-359984.6A missing authorization check in multiple SOAP endpoints of the Insider Threat Management Server enables an attacker on an adjacent network CVE-2023-36008.8During the worker lifecycle, a use-after-free condition could have occurred, which could have led to a potentially exploitable crash. This vCVE-2023-360006.5A missing authorization check in the MacOS agent configuration endpoint of the Insider Threat Management Server enables an anonymous attackeCVE-2023-360024.3A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server enables an anonymous attacker on CVE-2023-360037.3XAML Diagnostics Elevation of Privilege VulnerabilityCVE-2023-360047.5Windows DPAPI (Data Protection Application Programming Interface) Spoofing VulnerabilityCVE-2023-360058.1Windows Telephony Server Elevation of Privilege VulnerabilityCVE-2023-360068.8Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2023-35993: High severity, CVSS 7.8 | Vulnix