---
id: "CVE-2023-32434"
kind: "vulnerability"
aliases: ["CVE-2023-32434"]
title: "An integer overflow was addressed with improved input validation"
severity: "high"
cvss: 7.8
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Apple Multiple Products", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "apple ipados", "fixed": ["15.7.7"], "affected": "< 15.7.7", "ecosystem": "vendor"}, {"name": "apple ipados", "fixed": ["16.5.1"], "affected": ">= 16.0, < 16.5.1", "ecosystem": "vendor"}, {"name": "apple iphone os", "fixed": ["15.7.7"], "affected": "< 15.7.7", "ecosystem": "vendor"}, {"name": "apple iphone os", "fixed": ["16.5.1"], "affected": ">= 16.0, < 16.5.1", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["11.7.8"], "affected": ">= 11.0, < 11.7.8", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["12.6.7"], "affected": ">= 12.0.0, < 12.6.7", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["13.4.1"], "affected": ">= 13.0, < 13.4.1", "ecosystem": "vendor"}, {"name": "apple watchos", "fixed": ["8.8.1"], "affected": "< 8.8.1", "ecosystem": "vendor"}, {"name": "apple watchos", "fixed": ["9.5.2"], "affected": ">= 9.0, < 9.5.2", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["apple-devices", "exploited", "infrastructure", "ios", "ipados", "macos", "watchos"]
not_affected_if: ["fully-patched-devices"]
published_at: "2023-06-23T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32434", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32434", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# An integer overflow was addressed with improved input validation

An integer overflow in Apple's iOS, iPadOS, macOS and watchOS kernel lets an app run code with kernel privileges. CISA lists it as actively exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apple Multiple Products affected ? fixed ?
- vendor:apple ipados affected < 15.7.7 fixed 15.7.7
- vendor:apple ipados affected >= 16.0, < 16.5.1 fixed 16.5.1
- vendor:apple iphone os affected < 15.7.7 fixed 15.7.7
- vendor:apple iphone os affected >= 16.0, < 16.5.1 fixed 16.5.1
- vendor:apple macos affected >= 11.0, < 11.7.8 fixed 11.7.8
- vendor:apple macos affected >= 12.0.0, < 12.6.7 fixed 12.6.7
- vendor:apple macos affected >= 13.0, < 13.4.1 fixed 13.4.1
- vendor:apple watchos affected < 8.8.1 fixed 8.8.1
- vendor:apple watchos affected >= 9.0, < 9.5.2 fixed 9.5.2

## Fix

Apply the Apple updates per vendor instructions; the sources do not name the fixed versions.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32434
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2023-32434

## From the sources

An integer overflow was addressed with improved input validation. This issue is fixed in watchOS 9.5.2, macOS Big Sur 11.7.8, iOS 15.7.7 and iPadOS 15.7.7, macOS Monterey 12.6.7, watchOS 8.8.1, iOS 16.5.1 and iPadOS 16.5.1, macOS Ventura 13.4.1. An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_