Apple IOSurfaceAccelerator Out-of-Bounds Write Kernel Code Execution

Successful exploitation can result in arbitrary code execution in kernel context, giving the attacker kernel-level privileges on the affected device. This can enable full device compromise, including bypass of application sandboxing, modification of kernel state, installation of persistent malware or spyware, access to sensitive data, and broader control over the operating system.

If immediate patching is not possible, reduce exposure by limiting installation and execution of untrusted or unnecessary applications, restricting local code execution paths through enterprise device management controls, and monitoring devices for signs of compromise. Because exploitation appears to require an app on the device, enforcing strict application allowlisting, minimizing sideloading or unmanaged app installation, and isolating high-risk devices can reduce risk until updates are applied. Review endpoint and system logs for suspicious activity where available.

Apply Apple's security updates that fix CVE-2023-28206. The content identifies the patched versions as macOS Big Sur 11.7.6, macOS Monterey 12.6.5, macOS Ventura 13.3.1, iOS 15.7.5, iPadOS 15.7.5, iOS 16.4.1, and iPadOS 16.4.1. Organizations should prioritize patching because Apple reported possible active exploitation and CISA added the CVE to the KEV catalog.