CVE-2023-38610 is a high severity (CVSS 7.1) memory corruption flaw in the Wi-Fi component of Apple iOS, iPadOS and macOS, where an app may cause unexpected system termination or write kernel memory. Apple fixed it in iOS 17, iPadOS 17 and macOS Sonoma 14, so update to those or later.
What's affected
The affected products are Apple iOS, iPadOS and macOS. The record says a memory corruption issue was addressed by removing the vulnerable code, and that an app may be able to cause unexpected system termination or write kernel memory. The record is dated 2024-01-10 and scores 7.1, High, with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H.
Apple's security notes for macOS Sonoma 14 and for iOS 17 and iPadOS 17 list the fix under the Wi-Fi component. The macOS entry says the update was released on 26 September 2023, and the Wi-Fi entry for this CVE was added on 22 December 2023, which explains why NVD published it in January 2024. Apple lists the devices as iPhone XS and later and several iPad generations for iOS 17 and iPadOS 17, and Mac models from 2018 and later, plus iMac Pro and others, for macOS Sonoma 14. Apple's notes give no interim mitigation, so the fix is the update.
Weakness class: CWE-787.
How to check if you're exposed
On a Mac, read the macOS version.
sw_vers
Any macOS earlier than 14 (Sonoma) is affected per Apple's note. On an iPhone or iPad, open Settings, then General, then About, and read the software version. Anything earlier than 17 is affected. Devices that cannot run iOS 17 or macOS 14 are not fixed by this update, so check Apple's support documents for later patches on older operating system lines.
What to do now
- Inventory iPhones, iPads and Macs, with their operating system versions.
- Update to iOS 17, iPadOS 17 or macOS Sonoma 14, or the newest available release.
- Enforce a minimum operating system version through device management.
- Replace or isolate devices that can no longer receive updates.
- Read Apple's security notes for other fixes included in the same releases.
Why it matters
Memory corruption in a kernel level component is serious because kernel memory controls the whole device. The Wi-Fi code runs with high privilege and handles input from nearby networks and from apps. Apple's description says an app may write kernel memory, which is why the integrity and availability impact are rated high.
Apple removed the vulnerable code, which is the strongest kind of fix. The CVE is not on the CISA Known Exploited Vulnerabilities list, and Apple's notes do not report exploitation. Updating is routine, but unmanaged devices drift, so a minimum version rule in device management is the practical control.
An out-of-bounds write puts data outside the memory the program meant to use. It is one of the most serious memory safety classes because it can corrupt neighbouring data or control structures. Bounds checks, memory-safe languages and fuzzing of parsers are the standard defences.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers the dependencies a code project declares. It does not see firmware, desktop software or vendor appliances, so keep this item in your asset inventory and track the vendor's advisory.
Quick check
Which releases contain the fix?
Apple lists macOS Sonoma 14, iOS 17 and iPadOS 17.
Does this need a person to do something?
The vector includes user interaction, and Apple's description says an app is the trigger.
Sources
- Apple: About the security content of iOS 17 and iPadOS 17
- Apple: About the security content of macOS Sonoma 14
Last reviewed: 19 October 2026.
