CVE-2023-42928 is a high severity (CVSS 7.8) bounds checking flaw in the FairPlay component of iOS and iPadOS. An app may be able to gain elevated privileges. Apple fixed it in iOS 17.1 and iPadOS 17.1. Devices on iOS 17.0 or earlier should be updated.
What's affected
The record lists iPadOS and iPhone OS, with the fix in iOS 17.1 and iPadOS 17.1. Apple's bulletin for that release has a FairPlay entry with the impact "An app may be able to gain elevated privileges" and the description "The issue was addressed with improved bounds checks". It credits a research team and was added on February 16, 2024.
The record's weakness is CWE-276, which is about incorrect default permissions. That is a slightly odd match for a bounds check fix, and it is a good example of why the Apple text and the NVD classification do not always line up. Neither changes what you do.
The bulletin lists iPhone XS and later and recent iPad models. The iOS 16 line is not named for this entry in the sources we read.
How to check if you're exposed
On an iPhone or iPad, open Settings, then General, then About, and read the iOS or iPadOS version. Settings, General, Software Update shows whether a newer release is waiting.
What to do now
- Update iPhones and iPads to iOS or iPadOS 17.1 or later.
- Check Apple's security releases page for devices that stay on iOS 16 and see whether a fix applies to them.
- Review which apps users install from outside your managed catalog.
- Use mobile device management to require a minimum OS version.
- Re-run the compliance report after the update window and handle exceptions one by one.
Why it matters
FairPlay is Apple's digital rights management technology. It handles protected media, so it parses structured data from apps and services. A mistake in a bounds check there can let an app reach memory it should not touch, which is how the record describes the outcome: elevated privileges.
The vector is local, with no account needed and some user interaction. Think of an installed app, not a web page. The NVD class, CWE-276, points to permissions, while Apple's wording points to bounds checking. When two sources describe the same bug differently, trust the vendor text for the cause and use the class only for sorting. The KEV flag is false.
Quick check
Why do the NVD class and Apple's description differ?
The NVD assigns a weakness class after the fact. Apple describes the code change it made. Both can be useful, but the vendor text is closer to the cause.
Sources
- Apple: About the security content of iOS 17.1 and iPadOS 17.1
- Apple: iOS 17.1 bulletin (legacy link)
Last reviewed: 19 October 2026.
