HowToFixMe
● High · CVSS 7.8 ⚠ ACTIVELY EXPLOITED — CISA KEV

How to Fix CVE-2023-42824: Kernel Privilege Escalation in Apple iOS and iPadOS

⚡ At a glance
SeverityCVSS 7.8 (High), AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Actively exploited?Yes: zero-day. CISA KEV (added 2023-10-05, federal due date 2023-10-26)
AffectediOS and iPadOS before 16.7.1
Fixed iniOS 16.7.1 and iPadOS 16.7.1 (and iOS 17.0.3 on iOS 17 devices)
Type (CWE)Local privilege escalation (elevation of privilege); CWE not assigned (CWE-noinfo)

Exploitation status

CVE-2023-42824 is actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on as “Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability”, which makes patching mandatory for U.S. federal agencies under Binding Operational Directive 22-01. Federal agencies were required to remediate it by . If you run an affected system, treat this as an emergency change, not a scheduled one.

Zero-day exploitation: this was not a theoretical bug at disclosure. Apple's own advisory states it “is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6,” meaning working attack code was already running against real iPhones in the wild before the fix shipped. CISA's CVSS triage scores exploitation as “active” with a “total” technical impact. Treat weaponization as certain and patch on an emergency timeline.

Authoritative references:

What is CVE-2023-42824?

CVE-2023-42824 is a local kernel privilege-escalation vulnerability in the iOS and iPadOS kernel. In Apple's words from advisory HT213972: “A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6.” Apple addressed it “with improved checks.” Despite the title some aggregators apply, this is not a denial-of-service bug, it is an elevation-of-privilege flaw, and CISA catalogs it as a “Kernel Privilege Escalation Vulnerability.”

The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The AV:L (local) attack vector and PR:L (low privileges required) tell the real story: the attacker already needs to be running code on the device. typically through a sandboxed app or a chained Safari/WebKit bug, and this flaw is the step that breaks out of that sandbox and into the kernel. Once kernel-level, the attacker has full read/write over the device (the confidentiality, integrity, and availability impacts are all High), which is exactly why it was valuable enough to be burned as a zero-day.

In real-world exploitation seen in 2023, kernel bugs like this were chained behind a WebKit content bug (for example CVE-2023-41993) so that a single malicious web page could move from the browser sandbox all the way to kernel control. That chaining is the pattern behind several iOS spyware deliveries, which is why Apple shipped this fix as an out-of-band emergency update rather than waiting for the next feature release.

Am I affected?

Every iPhone and iPad running iOS or iPadOS earlier than 16.7.1 is affected. There is no log signature or on-screen symptom: successful exploitation of a kernel EoP is silent by design. The only reliable check is the installed OS version.

On the device itself, open Settings → General → About and read the Software Version field. If it shows anything below 16.7.1 (for the iOS 16 line) or below 17.0.3 (for the iOS 17 line), the device is vulnerable until you update. For fleets, your MDM already collects the reported OS version on every check-in, query that instead of touching each device.

How to fix CVE-2023-42824

  1. Identify the target build. The fix is iOS 16.7.1 and iPadOS 16.7.1 (released 2023-10-04). On devices that support iOS 17, iOS 17.0.3 also resolves it. Any later release than these is also safe.
  2. Back up first. Take an encrypted local backup (Finder/iTunes) or confirm a recent iCloud backup before a major OS update.
  3. Install the update on-device: Settings → General → Software Update → Download and Install. Keep the device on Wi-Fi and charging until it reboots into the new build.
  4. For managed fleets, push the update through MDM (Intune, Jamf, Kandji) using a software-update or declarative-device-management command targeting the fixed build, or set a minimum-OS compliance policy that blocks corporate access below 16.7.1.
  5. Reboot and confirm the Software Version now reads 16.7.1 (or 17.0.3 / later).

Confirm the build on a tethered device

If you manage devices from a workstation, you can read the exact OS and build numbers over USB with libimobiledevice. useful for proving a device crossed the fixed build during an audit:

# Read the current iOS/iPadOS version on a USB-tethered device
ideviceinfo -k ProductVersion   # must be 16.7.1 or higher (or 17.0.3+)
ideviceinfo -k BuildVersion

# Apple advisory with the exact fixed builds:
# https://support.apple.com/en-us/HT213972

Flag unpatched devices in your MDM

For an Intune-managed Apple estate, list every iOS/iPadOS device still below the fixed build so you can chase the stragglers:

# Microsoft Intune via Microsoft Graph PowerShell
Connect-MgGraph -Scopes DeviceManagementManagedDevices.Read.All
Get-MgDeviceManagementManagedDevice -Filter "operatingSystem eq 'iOS'" -All |
  Where-Object { [version]$_.OSVersion -lt [version]"16.7.1" } |
  Select-Object DeviceName, OSVersion, UserPrincipalName, LastSyncDateTime

Verify the fix landed

  1. On the device, confirm Settings → General → About → Software Version reads 16.7.1 (or 17.0.3 / later).
  2. In your MDM, confirm the reported OS version updated on the next device check-in and the compliance state flips to compliant.
  3. If you run an MDM-integrated vulnerability scanner (for example Jamf Protect or an Intune-fed scanner), re-evaluate the device; it should no longer flag CVE-2023-42824.

If you can't patch immediately

Apple ships no workaround for this issue, updating is the only remediation, because the flaw is in the kernel itself and cannot be configured away. Until a device is updated, reduce the chance of the exploit chain reaching the kernel: avoid installing apps from outside the App Store, do not open untrusted links, and for high-risk users (journalists, executives, activists) enable Lockdown Mode (Settings → Privacy & Security → Lockdown Mode), which hardens the very WebKit and messaging surfaces that kernel bugs like this are typically chained behind. None of these are substitutes for the update; they only shrink the window.

If a device may have been targeted

Because this was exploited in the wild before the patch, assume any high-value device that ran a vulnerable build could have been a target. There is no on-device indicator a non-expert can read. For at-risk individuals, update immediately, then consider Apple's Threat Notifications and, if a state-grade compromise is plausible, a forensic check via the Mobile Verification Toolkit (MVT) against an encrypted backup. Rotating Apple ID and high-value account credentials from a separate trusted device is a reasonable precaution.

References

This guide was assembled from the official vendor advisory, NVD record, and CISA KEV listing on 2026-05-25. Always confirm against the vendor advisory before applying changes in production.

Why kernel privilege escalation matters on iOS

On iOS the security model rests on the kernel keeping every app boxed inside its own sandbox. An app can only see its own data and can only call the system through tightly checked interfaces. A kernel privilege-escalation bug like CVE-2023-42824 dissolves that boundary: code that should only have the rights of one ordinary app suddenly runs with the rights of the kernel. From there an attacker can read any app's data, disable security mitigations, install a persistent implant, and survive across reboots. That is the whole prize, and it is why kernel EoP bugs command the highest prices on the exploit market and show up repeatedly in commercial spyware chains.

This particular bug carried PR:L: low privileges required, because the attacker needs a foothold first, usually a separate WebKit or messaging bug that lands initial code execution inside a sandbox. The two-stage shape is why patching matters even though the attack vector is “local”: the local code arrives remotely through a web page or a message, and CVE-2023-42824 is the piece that turns that toehold into total control. Closing it breaks the chain at the most damaging link.

Practical patch discipline for an Apple fleet

Three things keep an Apple estate clean against bugs like this. First, set a minimum-OS compliance baseline in your MDM and tie corporate resource access to it, so a device that drifts below the fixed build loses access automatically rather than silently staying exposed. Second, enable automatic updates on managed devices where policy allows. Apple's out-of-band fixes like 16.7.1 are precisely the ones you do not want to wait a quarter to deploy. Third, keep an eye on devices stuck on the iOS 16 line that are eligible for iOS 17; moving them to a supported major version (17.0.3 or later here) keeps them on the receiving end of future emergency fixes instead of stranded on a branch that may stop getting them.

The single source of truth for the fixed build is Apple's advisory HT213972, linked in the references below. Aggregator sites and scanner databases sometimes lag the advisory or mislabel the bug class, as happened here with the “denial of service” mislabel: so confirm against Apple directly before you sign off a remediation ticket.

Related weaknesses in the same component worth addressing at the same time:

People also ask

Is CVE-2023-42824 a denial-of-service bug?

No. It is a local kernel privilege-escalation (elevation-of-privilege) flaw. Apple's advisory says a local attacker may be able to elevate their privileges, and CISA lists it as a Kernel Privilege Escalation Vulnerability. The “denial of service” label some sources use is incorrect.

Which iOS and iPadOS version fixes CVE-2023-42824?

iOS 16.7.1 and iPadOS 16.7.1, released 2023-10-04 (advisory HT213972). Devices on the iOS 17 line should move to iOS 17.0.3 or later, which also addresses it.

Was CVE-2023-42824 exploited as a zero-day?

Yes. Apple is aware of a report that the issue may have been actively exploited against versions of iOS before iOS 16.6, and CISA added it to the Known Exploited Vulnerabilities catalog on 2023-10-05. Patch on an emergency timeline.

How do I confirm an iPhone or iPad is patched?

Open Settings → General → About and check Software Version, it must read 16.7.1 or later (or 17.0.3+ on iOS 17). For fleets, query the reported OS version in your MDM and flag any device below the fixed build.