CVE-2023-41990

What it actually does

CVE-2023-41990 is a memory-safety/code-execution flaw in Apple font processing related to cache handling. When a vulnerable Apple operating system processes a specially crafted font file, the attacker-controlled font can trigger arbitrary code execution in the context of the process handling the font. Because fonts may be parsed by system services, applications, preview components, browsers, messaging clients, document viewers, or content indexing paths, exploitation can occur through a malicious document, web content, message attachment, or other file that causes the operating system to parse the font. The CVSS vector indicates local attack vector with required user interaction, no privileges required, and high confidentiality, integrity, and availability impact.

Why it matters to the business

Successful exploitation can allow an attacker to compromise an Apple device after a user opens, previews, receives, or otherwise causes processing of malicious content. Consequences may include malware installation, data theft, surveillance, credential/session theft, device tampering, or disruption of endpoint availability. This vulnerability is in CISA KEV with a remediation due date of 2024-01-29 and Apple reported active exploitation against iOS versions before 15.7.1, so organizations with unmanaged or legacy Apple devices face elevated risk despite the relatively modest EPSS score. Exposure spans iPhone, iPad, macOS, Apple TV, and Apple Watch platforms, increasing operational impact in mixed Apple fleets.

How an attack unfolds

An attacker prepares a malicious font file designed to trigger the cache-handling flaw during font parsing. The payload is then delivered through a channel likely to cause font processing, such as a crafted document, webpage, email attachment, message, archive, or file shared through collaboration tooling. A targeted user interacts with the content, or a vulnerable preview/indexing component processes it. On a vulnerable Apple OS version, the malformed font triggers memory corruption and executes attacker-controlled code within the affected parsing process. The attacker may then attempt sandbox escape, persistence, credential access, data collection, lateral movement through synchronized accounts or management tooling, or installation of spyware or other malware. Apple stated the issue may have been actively exploited against iOS versions before 15.7.1, making mobile-focused targeted exploitation a key concern.

How to fix it

Upgrade affected Apple platforms to versions containing Apple’s fix or later. Apple lists fixes in tvOS 16.3, iOS 16.3 and iPadOS 16.3, macOS Ventura 13.2, watchOS 9.3, macOS Monterey 12.6.8, macOS Big Sur 11.7.9, and iOS/iPadOS 15.7.8 for older supported branches. As compensating controls until patching is complete, restrict opening of untrusted documents and archives, reduce exposure to untrusted web content, disable automatic previewing where feasible, enforce mobile device management update policies, limit unmanaged Apple devices from accessing sensitive resources, and use endpoint protection capable of detecting suspicious post-exploitation behavior. Devices that cannot be upgraded to a fixed branch should be treated as high risk and replaced, isolated, or denied access to sensitive services.

How to confirm the fix worked

Confirm operating system versions are at or above the fixed releases: iOS/iPadOS 16.3 or 15.7.8 where applicable, macOS Ventura 13.2, macOS Monterey 12.6.8, macOS Big Sur 11.7.9, tvOS 16.3, and watchOS 9.3. Validate through MDM inventory, Apple Software Update status, system settings, command-line version checks on macOS, and vulnerability management tooling. On macOS, verify with commands such as `sw_vers` and `softwareupdate --history` or equivalent fleet telemetry. On iOS/iPadOS/watchOS/tvOS, validate through MDM-reported OS build/version and compliance policy results. Confirm that legacy devices unable to receive fixed versions are excluded from sensitive access or have documented exception controls. Re-scan the fleet after patch deployment and monitor for devices that were offline during the update window.

Typical attack path

1. Identify targets running vulnerable Apple operating system versions, particularly iOS versions before 15.7.1 or other unpatched Apple platforms.
2. Create or obtain a weaponized font file that exploits the vulnerable font-processing cache handling.
3. Embed or deliver the malicious font through a document, webpage, email, message, archive, or other content likely to be opened or previewed.
4. Induce the user or system component to process the malicious font file.
5. Achieve arbitrary code execution in the context of the font-processing application or service.
6. Chain with additional vulnerabilities or techniques to escape sandbox restrictions, elevate privileges, or persist.
7. Collect sensitive data, deploy surveillance tooling or malware, or use compromised accounts and devices for follow-on activity.

How to detect it

There is no single universal exploit string for this vulnerability, so detection should focus on vulnerable-version exposure plus evidence of malicious font/document processing and post-exploitation behavior. Review MDM inventory for affected Apple OS versions, especially iOS before 15.7.1. On macOS, inspect Unified Logs, crash reports, quarantine events, EDR telemetry, browser/download history, email attachment logs, and file creation events for suspicious font files or documents immediately preceding crashes or unexpected child processes. Look for crashes in applications or services that parse fonts, previews, web content, documents, or messages, followed by unusual execution, persistence, or outbound connections. Relevant macOS artifacts include `/Library/Logs/DiagnosticReports/`, `~/Library/Logs/DiagnosticReports/`, Unified Log entries from font, CoreText, WebKit, Preview, QuickLook, browser, mail, and messaging components, and quarantine metadata for recently downloaded files. On iOS/iPadOS, use MDM/mobile threat defense telemetry, device analytics, sysdiagnose where available, suspicious profile/app installation events, anomalous network activity, and signs of spyware-like behavior. Correlate suspicious documents or webpages with process crashes, new persistence artifacts, unexpected configuration profiles, unknown apps, abnormal DNS/HTTP destinations, credential prompts, or unusual battery/network usage. Because Apple reported active exploitation and the issue is in CISA KEV, treat credible signs of exploitation as a potential full device compromise.

• /Library/Logs/DiagnosticReports/
• ~/Library/Logs/DiagnosticReports/
• /Library/Fonts/
• ~/Library/Fonts/
• /System/Library/Fonts/
• com.apple.FontRegistry
• fontd
• CoreText
• QuickLook
• QuickLookUIService
• qlmanage
• Preview.app
• WebKit
• MobileSafari
• com.apple.WebKit.WebContent
• com.apple.WebKit.Networking
• com.apple.WebKit.GPU
• EXC_BAD_ACCESS
• KERN_INVALID_ADDRESS
• SIGSEGV
• SIGBUS
• Crashed Thread
• Font
• CTFont
• CGFont
• ATS
• FontParser
• com.apple.quarantine

What your security team should do

• Prioritize remediation for all internet-facing, executive, privileged-user, BYOD, and high-risk Apple devices because this vulnerability is in CISA KEV and has reported in-the-wild exploitation.
• Use MDM or endpoint management to enforce minimum OS versions: iOS/iPadOS 16.3 or 15.7.8, macOS Ventura 13.2, macOS Monterey 12.6.8, macOS Big Sur 11.7.9, tvOS 16.3, and watchOS 9.3 or later.
• Identify and quarantine devices running iOS versions before 15.7.1, as Apple specifically reported active exploitation against those versions.
• Block or restrict access to sensitive applications from devices that cannot report patch status or cannot be upgraded to a fixed version.
• Hunt for suspicious font/document processing followed by abnormal process spawning, crash logs, persistence creation, outbound network connections, or mobile device compromise indicators.
• Increase scrutiny of unsolicited documents, attachments, shared files, and web content reported by users around the time of any suspicious device behavior.
• Review EDR, MDM, proxy, email security, and mobile threat defense telemetry for exploitation attempts and post-exploitation activity.
• For potentially compromised devices, preserve logs where possible, collect forensic images or sysdiagnose artifacts, rotate credentials and session tokens, and consider device wipe/re-enrollment.