CVE-2023-42871 is a high severity (CVSS 7.8) memory handling flaw in the Apple Neural Engine, the machine learning hardware path on Apple devices. An app may be able to execute arbitrary code with kernel privileges. Apple fixed it in macOS Sonoma 14, iOS 17 and iPadOS 17. Update devices that are still on older releases.
What's affected
The record names iPadOS, iPhone OS and macOS, with fixes in macOS Sonoma 14, iOS 17 and iPadOS 17.
Apple's iOS 17 bulletin scopes the entry to devices with an Apple Neural Engine: iPhone XS and later, and recent iPad Pro, iPad Air, iPad and iPad mini models. On the Mac side the macOS Sonoma 14 bulletin lists Mac Studio, iMac, Mac Pro, Mac mini, MacBook Air and MacBook Pro hardware.
The weakness is CWE-787. Apple's description is "improved memory handling". Apple updated the entries on December 22, 2023.
How to check if you're exposed
On an iPhone or iPad, open Settings, then General, then About, and read the iOS or iPadOS version. Settings, General, Software Update shows whether a newer release is waiting.
On a Mac, the Terminal can print the installed macOS version and list pending updates:
sw_vers
softwareupdate --list
About This Mac in the Apple menu shows the same version number.
What to do now
- Move devices with a Neural Engine to iOS or iPadOS 17 or later, and Macs to Sonoma 14 or later.
- For hardware that cannot run those releases, read Apple's security releases page to see what fix, if any, applies to it.
- Limit app installation sources on managed devices.
- Add the OS floor to your compliance policy so older devices are flagged automatically.
- Document any device you accept at risk, with an owner and a review date.
Why it matters
Drivers and accelerators for machine learning run close to the kernel, and they accept data from apps. A bounds mistake there can let an app write outside its intended memory. CWE-787 is the record's weakness class for this: an out-of-bounds write.
The impact in the record is high across confidentiality, integrity and availability, with a local vector and some user interaction. That points to an installed app as the starting point, not a drive-by network attack. The KEV flag is false. Patching with the normal OS cycle is the right response.
Quick check
Do I need a special setting to be protected?
No. The fix is part of the operating system update. Install a fixed release and the flaw is closed.
Sources
- Apple: About the security content of iOS 17 and iPadOS 17
- Apple: About the security content of macOS Sonoma 14
- Apple: iOS 17 bulletin (legacy link)
Last reviewed: 19 October 2026.
