CVE-2023-41990
📋 TL;DR
This vulnerability allows arbitrary code execution by processing a malicious font file on Apple devices. It affects iOS, iPadOS, tvOS, watchOS, and macOS systems running vulnerable versions. Apple has confirmed active exploitation against pre-iOS 15.7.1 versions.
💻 Affected Systems
- iPhone
- iPad
- Mac
- Apple TV
- Apple Watch
📦 What is this software?
Ipados by Apple
Ipados by Apple
Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Tvos by Apple
Watchos by Apple
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attacker to execute arbitrary code with user privileges, potentially leading to data theft, surveillance, or ransomware deployment.
Likely Case
Targeted attacks against specific users to install spyware or gain persistent access to devices.
If Mitigated
No impact if devices are fully patched or font processing is restricted.
🎯 Exploit Status
Apple confirmed active exploitation in the wild. Exploitation requires user interaction to process malicious font file.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: tvOS 16.3, iOS 16.3, iPadOS 16.3, macOS Monterey 12.6.8, macOS Big Sur 11.7.9, iOS 15.7.8, iPadOS 15.7.8, macOS Ventura 13.2, watchOS 9.3
Vendor Advisory: https://support.apple.com/en-us/HT213599
Restart Required: Yes
Instructions:
1. Go to Settings > General > Software Update on iOS/iPadOS/tvOS/watchOS. 2. Install available updates. 3. For macOS: Apple menu > System Settings > General > Software Update. 4. Restart device after installation.
🔧 Temporary Workarounds
Restrict font installation
allPrevent installation of untrusted fonts through MDM or configuration profiles
Web content filtering
allBlock font file downloads from untrusted websites
🧯 If You Can't Patch
- Isolate vulnerable devices from internet and untrusted networks
- Implement application allowlisting to prevent execution of suspicious processes
🔍 How to Verify
Check if Vulnerable:
Check device version against affected versions list. On iOS/iPadOS: Settings > General > About > Version. On macOS: Apple menu > About This Mac.Check Version:
iOS/iPadOS/tvOS/watchOS: Settings > General > About > Version. macOS: sw_vers or Apple menu > About This MacVerify Fix Applied:
Verify device version matches or exceeds patched versions listed in fix_official section.📡 Detection & Monitoring
Log Indicators:
- Unexpected font file processing
- Crash reports from font-related processes
- Unusual process execution following font handling
Network Indicators:
- Downloads of font files from suspicious sources
- Unusual outbound connections after font processing
SIEM Query:
process_name:fontd AND (parent_process:unexpected OR cmdline:contains:malicious_font)🔗 References
- https://support.apple.com/en-us/HT213599
- https://support.apple.com/en-us/HT213601
- https://support.apple.com/en-us/HT213605
- https://support.apple.com/en-us/HT213606
- https://support.apple.com/en-us/HT213842
- https://support.apple.com/en-us/HT213844
- https://support.apple.com/en-us/HT213845
- https://support.apple.com/en-us/HT213599
- https://support.apple.com/en-us/HT213601
- https://support.apple.com/en-us/HT213605
- https://support.apple.com/en-us/HT213606
- https://support.apple.com/en-us/HT213842
- https://support.apple.com/en-us/HT213844
- https://support.apple.com/en-us/HT213845
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41990
