CVE-2023-42870 is a high severity (CVSS 7.8) use-after-free in the Apple kernel. An app may be able to execute arbitrary code with kernel privileges. Apple fixed it in macOS Sonoma 14, iOS 17 and iPadOS 17 with improved memory management. Devices on earlier major releases should be updated.
What's affected
Affected products in the record are iPadOS, iPhone OS and macOS. The fixed releases are macOS Sonoma 14, iOS 17 and iPadOS 17.
Apple's two bulletins list a Kernel entry with the impact "An app may be able to execute arbitrary code with kernel privileges" and the cause "A use-after-free issue was addressed with improved memory management". The iOS 17 bulletin covers iPhone XS and later and several iPad generations. The macOS bulletin covers recent Mac Studio, iMac, Mac Pro, Mac mini, MacBook Air and MacBook Pro models.
The weakness is CWE-416. Apple updated the entries on December 22, 2023.
How to check if you're exposed
On an iPhone or iPad, open Settings, then General, then About, and read the iOS or iPadOS version. Settings, General, Software Update shows whether a newer release is waiting.
On a Mac, the Terminal can print the installed macOS version and list pending updates:
sw_vers
softwareupdate --list
About This Mac in the Apple menu shows the same version number.
What to do now
- Update to iOS or iPadOS 17 or later, and macOS Sonoma 14 or later. Apple's later releases include this fix.
- Where a device cannot take the newest major release, apply the latest security update available for its line and check Apple's security releases page for its status.
- Review which apps are installed from outside the App Store or the Mac App Store, since the attack needs a local app.
- Enforce a minimum OS version in your mobile device management policy.
- Re-run your device compliance report after the update window closes.
Why it matters
A kernel use-after-free is a high value bug. The kernel runs with the most trust on the device, so code that executes there can override the protections that normally confine an app. The vector in the record is local, needs no account and needs user interaction, usually installing or running an app.
The weakness, CWE-416, is the kind where memory is freed and then used again, letting an attacker influence what the program does next. The KEV flag is false. Treat this as a patch-with-the-cycle item rather than an emergency, but do not let devices drift on old major versions.
Quick check
Is a remote attacker enough to use this?
Not by itself. The record describes a local attack path that needs user interaction, typically a malicious app on the device.
Sources
- Apple: About the security content of iOS 17 and iPadOS 17
- Apple: About the security content of macOS Sonoma 14
- Apple: iOS 17 bulletin (legacy link)
Last reviewed: 19 October 2026.
