CVE-2023-32360

What it actually does

The vulnerability stems from insufficient state management in the macOS printing subsystem, allowing an unauthenticated local process to bypass authentication checks and retrieve recently spooled print jobs.

Why it matters to the business

Organizations running unpatched macOS systems face risk of local data leakage from printed documents containing sensitive information, increasing exposure without requiring administrative privileges or network access.

How an attack unfolds

An attacker with local interactive or script-based access on an affected Mac interacts with the printing service; flawed state handling permits direct retrieval of recent print documents without presenting valid credentials.

How to fix it

Upgrade affected systems to macOS Big Sur 11.7.7, macOS Monterey 12.6.6, or macOS Ventura 13.4 or later; verify the update is applied via System Settings > General > About.

How to confirm the fix worked

Confirm the running macOS build matches or exceeds the listed fixed versions; inspect print subsystem binaries or logs for the state-management improvements.

Typical attack path

1. Obtain local access to an affected macOS host
2. Invoke printing subsystem APIs or access spooler files
3. Exploit weak state validation to bypass authentication
4. Read contents of recently printed documents

How to detect it

Examine system and printing service logs for unauthenticated access attempts to print spool directories; correlate with file-access events on recent print jobs.

What your security team should do

• Prioritize patching all macOS endpoints to the fixed releases
• Audit local print queues and restrict access where possible
• Review and enforce least-privilege policies for local users