CVE-2023-42873 is a high severity (CVSS 7.8) bounds checking flaw in the ProRes video component of Apple systems. An app may be able to execute arbitrary code with kernel privileges. Apple fixed it in macOS Sonoma 14.1, iOS 17.1, tvOS 17.1, macOS Monterey 12.7.1 and Ventura 13.6.1, plus iOS 16.7.2.
What's affected
The fixed releases listed in the record are macOS Sonoma 14.1, tvOS 17.1, macOS Monterey 12.7.1, iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS 17.1, and macOS Ventura 13.6.1.
Apple lists the entry under the component it spells "Pro Res". The iOS 17.1 and iOS 16.7.2 bulletins and the macOS Monterey 12.7.1 bulletin carry it. Apple added the entry to those bulletins on February 16, 2024, about three months after the releases shipped, so devices updated in November 2023 already have it.
The weakness is CWE-787, an out-of-bounds write. Apple's wording is "improved bounds checks".
How to check if you're exposed
On an iPhone or iPad, open Settings, then General, then About, and read the iOS or iPadOS version. Settings, General, Software Update shows whether a newer release is waiting.
On a Mac, the Terminal can print the installed macOS version and list pending updates:
sw_vers
softwareupdate --list
About This Mac in the Apple menu shows the same version number.
On Apple TV, Settings, then System, then Software Updates, shows the installed tvOS version.
What to do now
- Update iPhone and iPad to iOS or iPadOS 17.1 or later, or 16.7.2 or later on the 16 line.
- Update Macs to Sonoma 14.1, Ventura 13.6.1 or Monterey 12.7.1 or later.
- Update Apple TV to tvOS 17.1 or later.
- Treat media files from untrusted senders with the same care as other attachments until patched.
- Confirm completion in your device management console and chase the stragglers.
Why it matters
Media codecs parse complex file formats, and a mistake in size checks can let a crafted input write beyond a buffer. The vector in the record is local with user interaction, and the stated impact is code execution with kernel privileges.
CWE-787 is a well known class: the program writes to memory outside the space it allocated. Because the target here is kernel level, an app that triggers it could escape the usual app limits. The KEV flag is false.
The wide list of fixed releases is a useful reminder. Apple patched three operating system lines at once, so check the version for your branch, not just the newest one.
Quick check
Which iOS 16 release has the fix?
iOS 16.7.2 and iPadOS 16.7.2, according to the record and Apple's bulletin. The iOS 17 line has it from 17.1.
Sources
- Apple: About the security content of iOS 16.7.2 and iPadOS 16.7.2
- Apple: About the security content of iOS 17.1 and iPadOS 17.1
- Apple: About the security content of macOS Monterey 12.7.1
Last reviewed: 19 October 2026.
