CVE-2023-42974 is a high severity (CVSS 7.0) race condition in IOUSBDeviceFamily, the USB device driver family on Apple systems. An app may be able to execute arbitrary code with kernel privileges. Apple fixed it with improved state handling in iOS 17.2, iOS 16.7.3, macOS Sonoma 14.2, Ventura 13.6.3 and Monterey 12.7.2.
What's affected
The record lists iPadOS and iPhone OS and gives the fixed releases as macOS Monterey 12.7.2, macOS Ventura 13.6.3, iOS 17.2 and iPadOS 17.2, iOS 16.7.3 and iPadOS 16.7.3, and macOS Sonoma 14.2.
Apple's bulletins for iOS 16.7.3, iOS 17.2 and macOS Sonoma 14.2 list an IOUSBDeviceFamily entry with the impact "An app may be able to execute arbitrary code with kernel privileges" and the description "A race condition was addressed with improved state handling". The entries were added or updated on March 22, 2024.
The weakness is CWE-362, a race condition, and the vector rates attack complexity as high.
How to check if you're exposed
On an iPhone or iPad, open Settings, then General, then About, and read the iOS or iPadOS version. Settings, General, Software Update shows whether a newer release is waiting.
On a Mac, the Terminal can print the installed macOS version and list pending updates:
sw_vers
softwareupdate --list
About This Mac in the Apple menu shows the same version number.
What to do now
- Update iPhone and iPad to iOS or iPadOS 17.2 or later, or 16.7.3 on the older line.
- Update Macs to Sonoma 14.2, Ventura 13.6.3 or Monterey 12.7.2 or later.
- Apply the update to older iPhones such as the iPhone 8 and X, which got a 16.7.3 build.
- Use device management to enforce an OS floor.
- Review exceptions monthly and set an end date for each.
Why it matters
Driver code that handles USB devices has to coordinate between the hardware and software, and races can occur when two paths touch the same state. The weakness is CWE-362. Apple's fix is improved state handling, which means the driver now guards the state properly.
As with the other race conditions in this group, the record rates attack complexity as high, which keeps the score at 7.0. The effect is code running with kernel privileges, started by a local app and needing user interaction. The KEV flag is false. Updating to the fixed releases is enough.
Quick check
Does this need a physical USB device?
The sources we read do not say. They describe an app that may execute code with kernel privileges and a local attack path.
Sources
- Apple: About the security content of iOS 16.7.3 and iPadOS 16.7.3
- Apple: About the security content of iOS 17.2 and iPadOS 17.2
- Apple: About the security content of macOS Sonoma 14.2
Last reviewed: 19 October 2026.
