CVE-2023-40396 is a high severity (CVSS 7.8) memory handling flaw in Apple's kernel. An app may be able to execute arbitrary code with kernel privileges. Apple fixed it in iOS 17, iPadOS 17, macOS Sonoma 14, watchOS 10 and tvOS 17.
What's affected
Apple's wording is that the issue was addressed with improved memory handling. The fixed releases are iOS 17 and iPadOS 17, macOS Sonoma 14, watchOS 10 and tvOS 17.
The record scores the flaw 7.8 (High) with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: local, low complexity, and a low privilege app on the device. The class in the record is CWE-77, which does not sit naturally with a memory handling description, so treat the class label as NVD's mapping and the Apple text as the description.
Apple's Sonoma 14 page lists the kernel entry as added on 16 July 2024, long after the 26 September 2023 release. The fix itself shipped with the release, and the later entry only added the CVE id to Apple's note.
How to check if you're exposed
On a Mac, read the installed version and look for pending updates:
sw_vers
softwareupdate --list
On an iPhone or iPad, open Settings, then General, then About, and read the iOS or iPadOS version. Apple Watch and Apple TV show their version in Settings under General and About as well.
For a managed fleet, use the OS version report in your mobile device management tool and filter for devices below the fixed release.
Anything below the fixed releases listed above is in scope. For watchOS and tvOS, which are updated less visibly, make sure someone owns the check.
What to do now
- Inventory Apple devices, including Apple TV and Apple Watch units that are easy to forget.
- Update to the fixed releases or later.
- For devices that cannot update, restrict which apps can be installed and review what is already on them.
- Use a managed app store or an allow list on corporate devices, so unknown apps cannot run.
- Add the OS version to your compliance rules.
Why it matters
A kernel flaw is serious because the kernel sits under every security boundary on the device. An app that gets code running there can step past the sandbox and the permission model. The record says the attacker needs an app on the device, so the realistic route is a malicious or compromised app.
That is why app vetting and update speed are the two controls that matter. Apple does not give more detail about the memory bug, and we will not guess. The practical answer is to treat the fixed release as the minimum for any device that runs third party apps.
Quick check
Can this be exploited from a web page?
Not according to the record. The vector is local, and Apple's wording is that an app may be able to run code with kernel privileges.
Why is the Apple page dated 2024?
Apple's note says the entry was added on 16 July 2024. The fix shipped with the September 2023 releases.
Sources
Last reviewed: 19 October 2026.
