{"id":"CVE-2023-41990","kind":"vulnerability","aliases":["CVE-2023-41990"],"related":[],"title":"The issue was addressed with improved handling of caches","description":"The issue was addressed with improved handling of caches. This issue is fixed in tvOS 16.3, iOS 16.3 and iPadOS 16.3, macOS Monterey 12.6.8, macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8, macOS Ventura 13.2, watchOS 9.3. Processing a font file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1.","summary":"Apple iOS, iPadOS, macOS, tvOS and watchOS contain an unspecified flaw in how they process font files. An attacker who gets a crafted font file processed can run code on the device.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2024-01-08T00:00:00+00:00","products":[{"name":"Apple Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"apple ipados","fixed":["15.7.8"],"affected":"< 15.7.8","ecosystem":"vendor"},{"name":"apple ipados","fixed":["16.3"],"affected":">= 16.0, < 16.3","ecosystem":"vendor"},{"name":"apple iphone os","fixed":["15.7.8"],"affected":"< 15.7.8","ecosystem":"vendor"},{"name":"apple iphone os","fixed":["16.3"],"affected":">= 16.0, < 16.3","ecosystem":"vendor"},{"name":"apple macos","fixed":["11.7.9"],"affected":"< 11.7.9","ecosystem":"vendor"},{"name":"apple macos","fixed":["12.6.8"],"affected":">= 12.0.0, < 12.6.8","ecosystem":"vendor"},{"name":"apple macos","fixed":["13.2"],"affected":">= 13.0, < 13.2","ecosystem":"vendor"},{"name":"apple tvos","fixed":["16.3"],"affected":"< 16.3","ecosystem":"vendor"},{"name":"apple watchos","fixed":["9.3"],"affected":"< 9.3","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apple","exploited","infrastructure","ios","ipados","macos","tvos","watchos"],"not_affected_if":["unknown"],"how_to_check":"Check the installed OS version on each Apple device (Settings > General > About, or sw_vers on macOS) and compare it against Apple's security notes for this CVE.","fix":"Update iOS, iPadOS, macOS, tvOS and watchOS to a release that Apple lists as fixing CVE-2023-41990; the sources do not name the exact versions.\nCISA says to apply the vendor mitigations or discontinue use of unpatched products.","status":"open","published_at":"2023-09-12T00:15:09+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:02:36+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:02:36Z","model":"claude-haiku-5-5","output":{"fix":"Update iOS, iPadOS, macOS, tvOS and watchOS to a release that Apple lists as fixing CVE-2023-41990; the sources do not name the exact versions.\nCISA says to apply the vendor mitigations or discontinue use of unpatched products.","reach":"unknown","impact":"high","summary":"Apple iOS, iPadOS, macOS, tvOS and watchOS contain an unspecified flaw in how they process font files. An attacker who gets a crafted font file processed can run code on the device.","category":"infrastructure","who_cares":["apple","ios","macos","ipados","tvos","watchos"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs code on an Apple device via a crafted font file","analyst_note":"Find Apple's security notes for CVE-2023-41990 to get the fixed OS versions and whether user interaction (opening a file or message) is needed; the KEV entry alone does not say.","how_to_check":"Check the installed OS version on each Apple device (Settings > General > About, or sw_vers on macOS) and compare it against Apple's security notes for this CVE.\nunknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00051,"input_tokens":2812,"output_tokens":458,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2023':11A,14A '-41990':12A,15A '11.7.9':106C '12.6.8':102C '13.2':114C '15.7.1':148C '15.7.8':108C,111C '16.3':94C,96C,99C '9.3':116C 'activ':139C 'address':4A,82C 'appl':39B,47B,127C 'apple':16A,19A,21A,23A,26A,29A,31A,33A,35A,37A 'arbitrari':124C 'attack':65B 'awar':129C 'big':104C 'cach':9A,87C 'code':75B,125C 'contain':54B 'craft':69B 'cve':10A,13A 'devic':78B 'execut':126C 'exploit':40B,140C 'file':63B,71B,120C 'fix':91C 'flaw':57B 'font':62B,70B,119C 'get':67B 'handl':7A,85C 'improv':6A,84C 'infrastructur':41B 'io':42B,48B,95C,107C,144C,147C 'ipado':43B,49B,98C,110C 'ipados':20A,22A 'iphone':24A,27A 'issu':2A,80C,89C,135C 'lead':122C 'maco':44B,50B,100C,103C,112C 'macos':30A,32A,34A 'may':121C,136C 'monterey':101C 'multiple':17A 'os':25A,28A 'process':61B,72B,117C 'products':18A 'releas':145C 'report':132C 'run':74B 'sur':105C 'tvos':36A,45B,51B,93C 'unspecifi':56B 'ventura':113C 'version':142C 'watcho':46B,53B,115C 'watchos':38A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-09-12T00:15:09+00:00","kev":{"dateAdded":"2024-01-08","dueDate":"2024-01-29","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-41990","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-41990","severity":null,"published_at":"2024-01-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:05+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-41990","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41990","severity":null,"published_at":"2023-09-12T00:15:09+00:00","modified_at":"2026-06-17T06:23:12+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}