CVE-2023-41060 is a high severity type confusion flaw that Apple fixed in iOS 17, iPadOS 17 and macOS Sonoma 14. NVD scores it 8.8. A remote user may be able to cause kernel code execution. Update affected iPhones, iPads and Macs to those releases or later.
What's affected
Apple's note for iOS 17 and iPadOS 17 (released 18 September 2023) says: "A remote user may be able to cause kernel code execution. A type confusion issue was addressed with improved checks." The record gives the fixed versions as macOS Sonoma 14, iOS 17 and iPadOS 17. The weakness is CWE-843, access of a resource using an incompatible type.
Devices and earlier operating system versions that have not taken those updates are the affected population. Apple's page lists the supported devices for each release, so use it for your fleet. Apple's iOS 17 page says this entry was added on 22 December 2023, and NVD published its record on 10 January 2024, well after the fixes shipped.
The NVD vector is network, low complexity, low privileges, no user interaction, giving 8.8. Apple's own text says "a remote user", and the vector requires low privileges, so read the scoring as a general risk rating. Apple does not publish its own CVSS score. I fetched the iOS 17 page only. The record also cites a macOS page (HT213940) that I did not open.
It is not in CISA's KEV catalog, and Apple's note does not say it is exploited in the wild.
How to check if you're exposed
On an iPhone or iPad, open Settings, then General, then About, and read the software version. Anything below 17 on a device that supports iOS 17 is out of date.
On a Mac, read the version from the terminal:
sw_vers
macOS releases below Sonoma 14 are not covered by this particular fix, though Apple ships other security updates for older macOS lines. If you run an older Mac, check Apple's security notes for the latest update for your version and confirm that it lists this CVE.
For managed fleets, use your device management tool to report operating system versions and sort the report by version. Devices that cannot update to the fixed release, because Apple no longer supports them, are the ones that need a separate decision.
What to do now
- Report the iOS, iPadOS and macOS versions across your managed fleet.
- Update supported devices to iOS 17, iPadOS 17 or macOS Sonoma 14 or later, and preferably to the newest release for each line.
- For older macOS lines, check Apple's security notes for the latest update and confirm it names this CVE.
- Identify devices that Apple no longer supports with updates, and plan to replace them or limit what they can reach.
- Enforce a minimum operating system version through your device management policy.
Why it matters
Type confusion happens when code treats a piece of memory as one kind of object when it is really another. The code then reads or writes in ways its author did not plan, which can corrupt memory. In a kernel, that can mean code execution with the highest privileges on the device.
Apple's wording, "improved checks", is typical: the fix adds the missing type checks. The CVSS vector shows a network attack path, which is why the score is high, but Apple does not describe how the bug is reached. The reliable defence is simple and boring: run supported operating system versions and update promptly.
Quick check
Which releases fix CVE-2023-41060?
The record and Apple's iOS 17 note list iOS 17, iPadOS 17 and macOS Sonoma 14.
Is it exploited in the wild?
Not according to the record or Apple's note, and it is not in CISA's KEV catalog.
Sources
- Apple security content for iOS 17 and iPadOS 17
- Apple security content for macOS Sonoma 14 (listed by NVD, not opened)
- Safeguard Gold entry for CVE-2023-41060
Last reviewed: 19 October 2026.
