CVE-2023-42876 is a high severity (CVSS 7.1) bounds checking flaw in the BOM component of macOS. Processing a file may lead to a denial of service or potentially disclose memory contents. Apple fixed it in macOS Sonoma 14. Macs on earlier releases should be updated.
What's affected
The record lists macOS as the affected product, fixed in macOS Sonoma 14. Apple's Sonoma 14 bulletin shows the entry under BOM, with the impact "Processing a file may lead to a denial-of-service or potentially disclose memory contents" and the description "The issue was addressed with improved bounds checks". The bulletin entry was added on December 22, 2023.
The record carries no CWE for this CVE. The vector shows high confidentiality and availability impact and no integrity impact, which matches the description: crash or read, but no stated code execution.
The Sonoma bulletin covers recent Mac Studio, iMac, Mac Pro, Mac mini, MacBook Air and MacBook Pro hardware.
How to check if you're exposed
On a Mac, the Terminal can print the installed macOS version and list pending updates:
sw_vers
softwareupdate --list
About This Mac in the Apple menu shows the same version number.
What to do now
- Update Macs to macOS Sonoma 14 or later.
- For Macs that cannot run Sonoma, check Apple's security releases page for the status of this CVE on their release line.
- Be careful with archive and installer files from unknown senders until the update is in.
- Check that automatic macOS updates are on for managed laptops.
- Close the ticket only after the version number is confirmed on the device.
Why it matters
BOM stands for bill of materials, a file format macOS uses to describe the files in installer packages. Parsers for such formats must check lengths and offsets carefully, and the fix here is improved bounds checks. A file that reads past a buffer can crash the process or return bytes it should not.
The vector in the record is local and needs a user to open or process a file. The effect is limited compared with the kernel bugs in the same release, but a memory disclosure can help weaken other protections. The KEV flag is false. Patch it with the regular update.
Quick check
Does this allow code execution?
Apple's text and the record describe a denial of service or memory disclosure, not code execution.
Sources
Last reviewed: 19 October 2026.
