CVE-2023-42933 is a high severity (CVSS 7.8) flaw in the Dev Tools component of macOS. An app may be able to gain elevated privileges because of missing checks. Apple fixed it in macOS Sonoma 14. Macs on earlier releases should be updated.
What's affected
The record lists macOS as affected, with the fix in macOS Sonoma 14. Apple's Sonoma 14 bulletin has a Dev Tools entry with the impact "An app may be able to gain elevated privileges" and the description "This issue was addressed with improved checks". The same entry also lists a sibling CVE from the same researcher. Apple updated it on December 22, 2023.
The record gives no CWE for this CVE. The vector is local, needs no account and needs some user interaction.
The bulletin lists recent Mac Studio, iMac, Mac Pro, Mac mini, MacBook Air and MacBook Pro models. Macs used by developers are the natural priority, though any Mac on an older release is in scope.
How to check if you're exposed
On a Mac, the Terminal can print the installed macOS version and list pending updates:
sw_vers
softwareupdate --list
About This Mac in the Apple menu shows the same version number.
What to do now
- Update Macs to macOS Sonoma 14 or later.
- Prioritize developer laptops, which have the Dev Tools components installed and often hold source code and credentials.
- Check that Xcode and Command Line Tools are current alongside the OS.
- Keep build secrets out of long lived files in home directories.
- Verify the build number on a sample of machines after the rollout.
Why it matters
The vendor explanation is short: checks were improved. The record has no weakness class, so the safest reading is simply a local privilege escalation in tooling that ships with the operating system. The vector is local and requires user interaction, so the attacker needs code running on the machine already.
Developer Macs deserve the attention because they hold credentials, signing keys and access to production systems. A flaw that raises an app's privileges there is worth more to an attacker than the same flaw on a kiosk. The KEV flag is false. Patch with the regular cycle and do not let developer machines hang back.
Quick check
Does the record name a weakness class?
No. The CWE list for this CVE is empty, so there is no class to link. Apple's text only says that checks were improved.
Sources
Last reviewed: 19 October 2026.
