CVE-2023-42942 is a high severity (CVSS 7.8) symlink handling flaw in libxpc, the Apple inter process communication library. A malicious app may be able to gain root privileges. Apple fixed it in iOS 17.1, iOS 16.7.2, macOS Sonoma 14.1, macOS Ventura 13.6.1, tvOS 17.1 and watchOS 10.1.
What's affected
The record lists the iPadOS and iPhone OS families, and the fixed releases are watchOS 10.1, macOS Sonoma 14.1, tvOS 17.1, iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS 17.1, and macOS Ventura 13.6.1.
Apple's bulletins list a libxpc entry with the impact "A malicious app may be able to gain root privileges" and the description "This issue was addressed with improved handling of symlinks". The entries for iOS and macOS Sonoma were added on February 16, 2024.
The weakness is CWE-59, link following, where a program follows a symbolic link to a place it did not mean to touch. The vector is local and needs some user interaction.
How to check if you're exposed
On an iPhone or iPad, open Settings, then General, then About, and read the iOS or iPadOS version. Settings, General, Software Update shows whether a newer release is waiting.
On a Mac, the Terminal can print the installed macOS version and list pending updates:
sw_vers
softwareupdate --list
About This Mac in the Apple menu shows the same version number.
On Apple TV, Settings, then System, then Software Updates, shows the installed tvOS version.
On Apple Watch, open the Watch app on the paired iPhone, then General, then About, to read the watchOS version.
What to do now
- Update iPhone and iPad to iOS or iPadOS 17.1, or 16.7.2 on the older line.
- Update Macs to Sonoma 14.1 or Ventura 13.6.1 or later.
- Update Apple TV to 17.1 and Apple Watch to watchOS 10.1 or later.
- Keep app installation to reviewed sources on managed devices.
- Track the remaining devices on a short list with a named owner.
Why it matters
A symlink is a file that points to another path. If a privileged service follows a link that an unprivileged app planted, the service can read, write or delete somewhere the app could not. That is the CWE-59 class, and it is a long standing source of local privilege escalation on every operating system.
Apple's fix is improved handling of symlinks. The impact is root, which on iOS means the device protections around apps are at risk, and on macOS means full control of the machine. The KEV flag is false and no exploitation is stated in the bulletins we read.
Quick check
Which release fixes it on the iOS 16 line?
iOS 16.7.2 and iPadOS 16.7.2, per the record and Apple's bulletin for that release.
Sources
- Apple: About the security content of iOS 16.7.2 and iPadOS 16.7.2
- Apple: About the security content of iOS 17.1 and iPadOS 17.1
- Apple: About the security content of macOS Sonoma 14.1
Last reviewed: 19 October 2026.
