$ cve CVE-2023-32434 JSON

CVE-2023-32434 KEV

7.8

HIGH · CVSS 3.1 · EPSS 51.5% (pctl 99)

Patch first

On CISA KEV — known exploited in the wild, due 2023-07-14.

Description

An integer overflow was addressed with improved input validation. This issue is fixed in watchOS 9.5.2, macOS Big Sur 11.7.8, iOS 15.7.7 and iPadOS 15.7.7, macOS Monterey 12.6.7, watchOS 8.8.1, iOS 16.5.1 and iPadOS 16.5.1, macOS Ventura 13.4.1. An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.

Scoring

CVSS	7.8 (HIGH, v3.1)
Vector	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS	51.52% — more likely to be exploited than 99% of all CVEs
Weakness	CWE-190
On CISA KEV	yes — remediate by 2023-07-14
Public exploit	none known
Published	2023-06-23
Last modified	2026-06-17

CISA KEV

Name	Apple Multiple Products Integer Overflow Vulnerability
Added	2023-06-23
Due	2023-07-14
Vendor / product	Apple / Multiple Products
Ransomware use	none reported

Affected (4)

Vendor	Product
apple	ipados
apple	iphone os
apple	macos
apple	watchos

References

→ the Explorer · watch your stack · NVD