CVE-2023-42931 is a high severity (CVSS 7.8) flaw in the DiskArbitration component of macOS. A process may gain admin privileges without proper authentication. Apple fixed it with improved checks in macOS Sonoma 14.2, Ventura 13.6.3 and Monterey 12.7.2. Update Macs on those lines to at least these versions.
What's affected
The record lists macOS, fixed in macOS Ventura 13.6.3, macOS Sonoma 14.2 and macOS Monterey 12.7.2. Apple's bulletins for all three list a DiskArbitration entry with the impact "A process may gain admin privileges without proper authentication" and the description "The issue was addressed with improved checks". The entries were added on March 22, 2024.
The weakness is CWE-280, which covers privileges that are not properly checked. The vector requires a local, low privilege account and no user interaction.
DiskArbitration is the macOS service that manages disk mounting. The bulletins do not explain the code path further, and we do not speculate beyond them.
How to check if you're exposed
On a Mac, the Terminal can print the installed macOS version and list pending updates:
sw_vers
softwareupdate --list
About This Mac in the Apple menu shows the same version number.
What to do now
- Update Macs to Sonoma 14.2, Ventura 13.6.3 or Monterey 12.7.2, or any later release on the same line.
- Limit who has local accounts on shared Macs and review standard user rights.
- Look for unmanaged Macs that do not report to your update tool.
- Add the three version floors to your device compliance rule.
- Confirm after rollout that no Mac reports an older build.
Why it matters
This is another local escalation, and the vendor's one line explanation is that checks were missing. The weakness class is CWE-280: a privileged action was reachable without the right authorization step. The effect is admin rights for a process that should not have them.
Admin rights on macOS allow changes to system settings, installation of software and access to other users' data. The vector needs a low privilege account and no interaction, so a hostile process that is already running can use the flaw on its own. The KEV flag is false, and no exploitation is stated in the bulletins we read.
Quick check
Is a restart needed after installing the update?
Apple macOS system updates normally restart the Mac. Confirm the version number afterwards instead of assuming it took.
Sources
- Apple: About the security content of macOS Sonoma 14.2
- Apple: About the security content of macOS Monterey 12.7.2
- Apple: About the security content of macOS Ventura 13.6.3
Last reviewed: 19 October 2026.
