CVE-2023-41974: Apple iOS and iPadOS use-after-free in kernel

CVE-2023-41974 · Severity: critical · CVSS 7.8 · Exploited in the wild · Published 2026-03-05

Apple iOS and iPadOS devices are affected by a security flaw that could allow a malicious application to take full control of the device. By exploiting this vulnerability, an app can gain the highest level of system privileges, potentially allowing it to access sensitive data or disrupt device operations. This issue has been reported as being actively exploited in the wild.

Technologies: Apple iPadOS, Apple macOS, Apple watchOS, Cisco IOS. Vendors: Apple, Cisco.

Quick answers

Is CVE-2023-41974 exploited in the wild?
Yes. CVE-2023-41974 is known to be exploited in the wild, first recorded on 5 March 2026. Treat it as urgent.
How severe is CVE-2023-41974?
Critical severity, with a CVSS score of 7.8, published 5 March 2026.
Which products and versions are affected?
Apple iPadOS < 17.0, < 15.8.7.
Is there a fix for CVE-2023-41974?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2023-41974 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2023-41974?
Check whether you run Apple iPadOS, Apple macOS, Apple watchOS or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free (CWE-416) vulnerability exists in the kernel of Apple iOS and iPadOS due to improper memory management. A local attacker can exploit this by running a specially crafted application on the target device. Successful exploitation allows the application to escape its sandbox and execute arbitrary code with kernel-level privileges, leading to full system compromise. This vulnerability has been observed in active exploitation. Apple addressed the issue by improving memory management in iOS/iPadOS 17 and iOS/iPadOS 15.8.7.

Affected products

  • Apple iOS < 17.0, < 15.8.7
  • Apple iPadOS < 17.0, < 15.8.7

Timeline

  • 2024-01-10: disclosed: Initial disclosure by Apple
  • 2026-03-05: kev added: Added to CISA Known Exploited Vulnerabilities catalog
  • 2026-03-05: advisory: NVD publication date

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.