CVE-2023-42867 is a high severity (CVSS 7.8) flaw in Apple GarageBand for macOS. An app may be able to gain root privileges because the process entitlement and Team ID were not validated well enough. Apple fixed it in GarageBand 10.4.9. Update GarageBand on every Mac that still has an older copy installed.
What's affected
Apple's bulletin for GarageBand 10.4.9, released November 6, 2023, lists the issue for macOS Ventura and macOS Sonoma. The fix is in GarageBand 10.4.9, so any older GarageBand build on those systems is in scope.
The record shows one affected product, Apple GarageBand, and one weakness, CWE-281. The CVE was published in December 2024, more than a year after the Apple release, so a Mac that was patched in late 2023 is already covered.
GarageBand is easy to forget. It ships on many Macs, rarely gets opened on work machines, and can sit on an old version for years if App Store updates are off.
How to check if you're exposed
On a Mac, the Terminal can print the installed macOS version and list pending updates:
sw_vers
softwareupdate --list
About This Mac in the Apple menu shows the same version number.
To read the GarageBand version, open GarageBand and choose GarageBand, then About GarageBand. You can also check from the Terminal without opening the app:
mdls -name kMDItemVersion /Applications/GarageBand.app
Anything below 10.4.9 needs the update.
What to do now
- Open the App Store on each Mac and install the GarageBand update, or run the system update tool.
- Confirm the version is 10.4.9 or later with the command above.
- If your fleet tool reports installed applications, search it for GarageBand below 10.4.9.
- Remove GarageBand from machines where nobody uses it, which also removes the exposure.
- Keep standard users from installing apps that were not reviewed, since the flaw needs a local app to act.
Why it matters
This is a local privilege escalation. The vector in the record needs a local attacker and some user interaction, and the impact is high on confidentiality, integrity and availability. The weakness class, CWE-281, is about a program that does not correctly manage the permissions of a process or resource.
On a shared or managed Mac, local escalation matters because malware that lands as an ordinary user can use a flaw like this to reach root. Apple describes the cause as weak validation of the process entitlement and Team ID, the identity checks macOS relies on to decide what a binary may do. Patching closes the gap. The KEV flag is false.
Quick check
Does this affect iPhone or iPad?
No. Apple lists GarageBand 10.4.9 for macOS Ventura and macOS Sonoma. The bulletin does not cover the iOS app.
Sources
- Apple: About the security content of GarageBand 10.4.9
- Apple: security content of GarageBand 10.4.9 (legacy link)
Last reviewed: 19 October 2026.
