CVE-2023-40398 is a high severity (CVSS 8.8) sandbox flaw in Apple's CoreServices. A sandboxed process may be able to circumvent sandbox restrictions. Apple fixed it in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5, iOS 16.4 and iPadOS 16.4.
What's affected
The record lists these fixed releases: macOS Monterey 12.6.4, macOS Big Sur 11.7.5, macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4. Apple's note for macOS Ventura 13.3, which we read, lists the CoreServices entry for macOS Ventura and says it was added on 16 July 2024.
The record scores the flaw 8.8 (High) with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The S:C part means scope changed, which fits a sandbox escape: the impact goes beyond the process that was contained. The record carries no CWE for this entry.
This one is older than the others in this batch. The fixed releases are from before the Sonoma and iOS 17 generation, and the CVE appeared in Apple's notes in 2024. Systems on current releases already carry the fix.
How to check if you're exposed
On a Mac, read the installed version and look for pending updates:
sw_vers
softwareupdate --list
On an iPhone or iPad, open Settings, then General, then About, and read the iOS or iPadOS version. Apple Watch and Apple TV show their version in Settings under General and About as well.
For a managed fleet, use the OS version report in your mobile device management tool and filter for devices below the fixed release.
Because the fixed releases are early 2023 updates, almost any device kept on a supported release is already fixed. The interesting machines are ones pinned to an old build for software compatibility reasons.
What to do now
- Search your Mac inventory for macOS Ventura below 13.3, Monterey below 12.6.4 and Big Sur below 11.7.5.
- Search mobile inventory for iOS or iPadOS below 16.4.
- Update them, or move the pinned machines to a supported release.
- If a machine must stay on an old build, restrict what runs on it and keep it off sensitive networks.
- Add a minimum OS rule to your compliance policy so pinned machines show up.
Why it matters
A sandbox keeps an app inside a small set of permissions. An escape lets code that was meant to be contained reach files and services it should not. On its own it is not a way in, because the attacker needs code running first. Chained with another bug, it removes a protection layer.
Apple's text is short: improved checks. That tells us a validation was missing, not which one. We do not have more detail, so the practical lesson is to keep the OS current and to treat any machine pinned to an old release as holding fewer protections than the rest.
Quick check
Which releases carry the fix?
The record lists macOS Monterey 12.6.4, macOS Big Sur 11.7.5, macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4. Later releases than those are the ones to run.
Why does the record show no CWE?
The NVD record leaves the weakness list empty. Apple's description gives only improved checks, which is not enough to assign a class.
Sources
Last reviewed: 19 October 2026.
