CVE-2023-42947 is a high severity (CVSS 8.6) path handling flaw in TCC, the Apple privacy permission service. An app may be able to break out of its sandbox. Apple fixed it with improved validation in iOS 17.2, iPadOS 17.2, macOS Sonoma 14.2, Ventura 13.6.3, Monterey 12.7.2, tvOS 17.2 and watchOS 10.2.
What's affected
The record lists iPadOS, iPhone OS and macOS, with the fixes in macOS Monterey 12.7.2, macOS Ventura 13.6.3, iOS 17.2 and iPadOS 17.2, tvOS 17.2, watchOS 10.2 and macOS Sonoma 14.2.
Apple's bulletins for iOS 17.2, macOS Sonoma 14.2 and macOS Monterey 12.7.2 each list a TCC entry with the impact "An app may be able to break out of its sandbox" and the description "A path handling issue was addressed with improved validation". The entries were added on March 22, 2024.
The weakness is CWE-22, path traversal. The vector has a changed scope, which means the impact reaches outside the component that holds the bug.
How to check if you're exposed
On an iPhone or iPad, open Settings, then General, then About, and read the iOS or iPadOS version. Settings, General, Software Update shows whether a newer release is waiting.
On a Mac, the Terminal can print the installed macOS version and list pending updates:
sw_vers
softwareupdate --list
About This Mac in the Apple menu shows the same version number.
On Apple TV, Settings, then System, then Software Updates, shows the installed tvOS version.
On Apple Watch, open the Watch app on the paired iPhone, then General, then About, to read the watchOS version.
What to do now
- Update iPhone and iPad to iOS or iPadOS 17.2 or later.
- Update Macs to Sonoma 14.2, Ventura 13.6.3 or Monterey 12.7.2 or later.
- Update Apple TV to tvOS 17.2 and Apple Watch to watchOS 10.2.
- Review app permissions in your managed devices and remove apps that are not approved.
- Add the new OS floor to your compliance policy.
Why it matters
TCC, short for Transparency, Consent and Control, is the system that decides whether an app may touch the camera, files or contacts. Sandboxing is what confines an app to its own container. A path handling bug lets an input name a location outside the allowed area, and CWE-22 is the standard class for it.
The record's scope is changed, which fits a sandbox escape: the app starts inside one security boundary and the flaw lets it cross to another. The vector is local and needs user interaction. The score of 8.6 is the highest in this group of Apple entries. The KEV flag is false.
Quick check
What is a sandbox escape?
It is when an app confined to its own limited area finds a way to act outside it. The flaw here is a path handling mistake, and the fix is improved validation.
Sources
- Apple: About the security content of iOS 17.2 and iPadOS 17.2
- Apple: About the security content of macOS Sonoma 14.2
- Apple: About the security content of macOS Monterey 12.7.2
Last reviewed: 19 October 2026.
