CVE-2023-42892 is a high severity (CVSS 7.8) use-after-free in the FileURL component of macOS. A local attacker may be able to elevate their privileges. Apple fixed it in macOS Sonoma 14.2, Ventura 13.6.3 and Monterey 12.7.2. Update Macs on any of those lines to at least these versions.
What's affected
The record lists macOS, with fixes in macOS Ventura 13.6.3, macOS Sonoma 14.2 and macOS Monterey 12.7.2. Apple published a bulletin for each of the three, and each lists a FileURL entry with the impact "A local attacker may be able to elevate their privileges" and the description "A use-after-free issue was addressed with improved memory management". The entries were added on March 22, 2024.
The weakness is CWE-416, a use-after-free. Apple's updates shipped earlier, in December 2023, so a Mac that took those releases is already covered.
One thing in the vector is worth noting: the record shows a low privilege account is needed, not none. The attacker is already on the machine.
How to check if you're exposed
On a Mac, the Terminal can print the installed macOS version and list pending updates:
sw_vers
softwareupdate --list
About This Mac in the Apple menu shows the same version number.
What to do now
- Update Sonoma Macs to 14.2 or later, Ventura Macs to 13.6.3 or later and Monterey Macs to 12.7.2 or later.
- Remove local admin rights from users who do not need them, which limits what an escalation can reach.
- Review shared Macs, such as lab or kiosk machines, which are the likeliest places for hostile local code.
- Report on the installed macOS build across your fleet and list anything below the fixed numbers.
- Re-check after the next monthly update, since lagging devices often miss two in a row.
Why it matters
Use-after-free bugs happen when code keeps using memory after it has been released. If the attacker can control what lands in that memory, they can steer the program. The weakness class here is CWE-416, and the effect is local privilege escalation to full control of the Mac.
The record's vector needs a low privilege account and no user interaction, with high impact on confidentiality, integrity and availability. In practice this is a second stage bug: first something runs as a normal user, then it uses a flaw like this to become root. Patching shortens the chain. The KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do all three macOS lines need an update?
Each line has its own fixed version: Sonoma 14.2, Ventura 13.6.3 and Monterey 12.7.2. A Mac only needs the one that matches its release line.
Sources
- Apple: About the security content of macOS Sonoma 14.2
- Apple: About the security content of macOS Monterey 12.7.2
- Apple: About the security content of macOS Ventura 13.6.3
Last reviewed: 19 October 2026.
