CVE-2023-42958 is a high severity (CVSS 7.8) permissions flaw in the MobileStorageMounter component of macOS. An app may be able to gain elevated privileges. Apple fixed it with additional restrictions in macOS Ventura 13.4. Macs on Ventura 13.3 or earlier should be updated.
What's affected
The record lists macOS, fixed in macOS Ventura 13.4. Apple's Ventura 13.4 bulletin has a MobileStorageMounter entry with the impact "An app may be able to gain elevated privileges" and the description "A permissions issue was addressed with additional restrictions". Apple added the entry on July 16, 2024, more than a year after the release. The NVD record followed on July 29, 2024.
The record gives no CWE for this CVE. The vector is local with no account needed and some user interaction.
Because the fix has been out since 2023, any Mac that updated routinely is already covered. The risk sits with machines that stayed on an old Ventura build or never moved to a current release.
How to check if you're exposed
On a Mac, the Terminal can print the installed macOS version and list pending updates:
sw_vers
softwareupdate --list
About This Mac in the Apple menu shows the same version number.
What to do now
- Update Ventura Macs to 13.4 or later. A current macOS release carries the fix too.
- Find Macs that stopped updating, such as spare laptops and lab machines.
- Remove local admin rights from users who do not need them.
- Add a macOS version floor to your device compliance policy.
- Confirm the version after the update, not just the install message.
Why it matters
Apple's bulletin names MobileStorageMounter but does not describe it further. The fix is described only as additional restrictions on permissions, so the plain reading is that something an app could reach was not locked down tightly enough.
The effect is local privilege escalation, with high impact in the vector. The record lists no weakness class, and Apple's note was added late, so details are thin. That is a normal pattern for entries documented after the fact. The KEV flag is false. The right response is to confirm the fix is installed and move on.
Quick check
Why was this CVE published so late?
Apple added the entry to its Ventura 13.4 bulletin on July 16, 2024, long after the release. The fix itself shipped with 13.4.
Sources
Last reviewed: 19 October 2026.
