CVE-2023-42938: High Privilege Flaw in iTunes for Windows

CVE-2023-42938 is a high severity (CVSS 7.8) logic flaw in iTunes for Windows. A local attacker may be able to elevate their privileges through the Mobile Device Service. Apple fixed it in iTunes 12.13.1 for Windows, released December 14, 2023. Update iTunes, or remove it if nobody needs it.

What's affected

The record lists Apple iTunes as the affected product, with the fix in iTunes 12.13.1 for Windows. Apple's bulletin, released December 14, 2023, covers Windows 10 and later and lists the issue under Mobile Device Service. The impact is "A local attacker may be able to elevate their privileges" and the description is "A logic issue was addressed with improved checks".

The weakness is CWE-693, a class for security checks that can be bypassed. The vector needs a local, low privilege account and no user interaction.

The Mobile Device Service runs on the Windows machine to talk to Apple devices. A service that runs with high rights and is reachable by ordinary local users is a classic place for this kind of bug.

How to check if you're exposed

On Windows, open Apps and Features (or Programs and Features), find iTunes in the list and read its version number.

From PowerShell, you can list installed copies and versions:

Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object DisplayName -like '*iTunes*' | Select-Object DisplayName, DisplayVersion

Any version below 12.13.1 needs attention. The Microsoft Store edition of iTunes updates through the Store.

What to do now

1. Update iTunes for Windows to 12.13.1 or later.
2. Uninstall iTunes from machines where it is not needed, since the Mobile Device Service goes with it.
3. Search your software inventory for iTunes and Apple Mobile Device Support across the Windows fleet.
4. Keep standard users off local admin rights.
5. Add iTunes to your third party patching list so updates are tracked.

Why it matters

The cause in Apple's words is a logic issue, meaning a check that did not do its job. The weakness class, CWE-693, covers protection mechanisms that can be bypassed. The result is local privilege escalation: an ordinary user on the Windows machine could reach higher rights.

Consumer apps often show up on corporate Windows machines without anyone noticing. They also tend to miss patch cycles because they are not in the standard enterprise update path. The KEV flag is false. The simplest fix is to update, or to uninstall what is not needed.

Quick check

Sources

• Apple: About the security content of iTunes 12.13.1 for Windows
• Apple: iTunes 12.13.1 bulletin (legacy link)

Last reviewed: 19 October 2026.