CVE-2023-42962 is a high severity (CVSS 7.5) flaw in CallKit, the iOS framework for call handling. A remote attacker may be able to cause a denial of service. Apple fixed it with improved checks in iOS 17.2, iPadOS 17.2, iOS 16.7.3 and iPadOS 16.7.3. Update iPhones and iPads that are older than those releases.
What's affected
The record lists iPadOS and iPhone OS, with fixes in iOS 17.2 and iPadOS 17.2, and iOS 16.7.3 and iPadOS 16.7.3.
Apple's bulletins for both releases list a CallKit entry with the impact "A remote attacker may be able to cause a denial-of-service" and the description "This issue was addressed with improved checks". The iOS 16.7.3 bulletin covers older hardware: iPhone 8, iPhone 8 Plus, iPhone X, iPad 5th generation, iPad Pro 9.7 inch and iPad Pro 12.9 inch 1st generation. The entries were added on March 22, 2024.
The record lists no CWE. The vector is network based with no account and no user interaction, and the impact is limited to availability.
How to check if you're exposed
On an iPhone or iPad, open Settings, then General, then About, and read the iOS or iPadOS version. Settings, General, Software Update shows whether a newer release is waiting.
What to do now
- Update iPhones and iPads to iOS or iPadOS 17.2 or later.
- On older devices that top out at the 16 line, install iOS or iPadOS 16.7.3 or later.
- Include phones used for on call duty and field work in the first wave, since availability matters most there.
- Enforce an OS floor with mobile device management.
- Plan replacement for hardware that no longer receives updates.
Why it matters
The impact here is availability only. The vector shows no confidentiality or integrity loss: a remote party could cause a failure, but the record does not say they could read or change data. That puts this below the memory corruption entries in terms of damage, even though the score is high because no account or interaction is needed.
The record gives no weakness class, and Apple's wording is simply improved checks. For people who rely on a phone for calls, a remotely triggered denial of service is still a real operational problem. The KEV flag is false. Apply the update and move on.
Quick check
Can this expose my data?
The record shows no confidentiality or integrity impact. It describes a denial of service only.
Sources
- Apple: About the security content of iOS 16.7.3 and iPadOS 16.7.3
- Apple: About the security content of iOS 17.2 and iPadOS 17.2
- Apple: iOS 17.2 bulletin (legacy link)
Last reviewed: 19 October 2026.
