CVE-2023-42959 is a high severity (CVSS 7.0) race condition in the Graphics Drivers component of macOS. An app may be able to execute arbitrary code with kernel privileges. Apple fixed it with improved state handling in macOS Sonoma 14. Macs on earlier releases should be updated.
What's affected
The record lists macOS, fixed in macOS Sonoma 14. Apple's Sonoma 14 bulletin has a Graphics Drivers entry with the impact "An app may be able to execute arbitrary code with kernel privileges" and the description "A race condition was addressed with improved state handling". The entry was added on July 16, 2024, and the NVD record on July 29, 2024.
The weakness is CWE-362, a race condition. The vector shows high attack complexity, which fits: the timing must go the attacker's way.
The bulletin lists Mac Studio, iMac, Mac Pro, Mac mini, MacBook Air and MacBook Pro hardware from recent years.
How to check if you're exposed
On a Mac, the Terminal can print the installed macOS version and list pending updates:
sw_vers
softwareupdate --list
About This Mac in the Apple menu shows the same version number.
What to do now
- Update Macs to macOS Sonoma 14 or later.
- Prioritize Macs that run untrusted or third party apps with graphics workloads, such as design and media machines.
- Report on installed macOS builds from your management tool and list anything below 14.
- Restrict software installation to reviewed sources on managed Macs.
- Re-run the report after the patch window.
Why it matters
A race condition happens when two operations depend on timing and the code does not guard the shared state. CWE-362 is the class. The fix is described as improved state handling, which means the driver code now tracks its state more carefully.
The record rates attack complexity as high, which lowers the score to 7.0 compared with similar kernel bugs. That does not make it harmless: race bugs can be made reliable with enough attempts. The impact is kernel code execution from a local app. The KEV flag is false. Keep Macs current and the exposure goes away.
Quick check
Why is the score lower than the other kernel flaws?
The record marks attack complexity as high because the attack depends on timing. The impact, if it works, is still high.
Sources
Last reviewed: 19 October 2026.
