Apple Multiple Products Code Execution
Apple Multiple Products
Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability that allows for code execution when processing a font file. Added to the CISA KEV catalog on 2024-01-08. CVE-2023-41990 was assigned before 2024; the KEV listing came in 2024.
Why this severity: CVSS 7.8 (v3.1, CISA-ADP), actively exploited (CISA KEV)
- Started
- Jan 8, 2024
- Closed
- Jan 8, 2024
Affected
- See vendor advisory (versions are not listed in the KEV record)
Fixed in
- See vendor advisory linked in sources
Timeline1
CISA added CVE-2023-41990 to the KEV catalog (federal deadline 2024-01-29)
Source
Advisories9
- Apple advisory: CVE-2023-41990Apple
- Apple advisory: CVE-2023-41990Apple
- Apple advisory: CVE-2023-41990Apple
- Apple advisory: CVE-2023-41990Apple
- Apple advisory: CVE-2023-41990Apple
- Apple advisory: CVE-2023-41990Apple
- Apple advisory: CVE-2023-41990Apple
- NVD: CVE-2023-41990NVD · Sep 11, 2023
- CISA Known Exploited Vulnerabilities CatalogCISA · Jan 8, 2024
Notes & caveats
Derived from the CISA KEV JSON feed (catalogVersion 2026.10.21); CVSS from the CVE record (cveawg.mitre.org). startedAt is the CVE publication date when it fell in 2024 before the KEV listing, else the KEV dateAdded; exploitation may have begun earlier. closedAt is the KEV listing date (a fix or mitigation was available then unless noted).
Get an email when a new major security incident drops. No spam, unsubscribe any time.
