Is CVE-2023-28206 actively exploited?

Yes. CVE-2023-28206 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2023-28206 be exploited remotely?

The attack vector of CVE-2023-28206 has not been classified yet.

What is the CVSS score of CVE-2023-28206?

CVE-2023-28206 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2023-28206

HIGHCISA KEVIN THE WILD

CVE-2023-28206

Published: April 10, 2023

EPSS:14.58%probability of exploitation in 30 daysPercentile:94.3th

Official Description

Apple iOS, iPadOS, and macOS IOSurfaceAccelerator contain an out-of-bounds write vulnerability that allows an app to execute code with kernel privileges.

NVD Source

CISA KEV Advisory

Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write Vulnerability

Apple iOS, iPadOS, and macOS IOSurfaceAccelerator contain an out-of-bounds write vulnerability that allows an app to execute code with kernel privileges.

Added to KEV: 2023-04-10Federal patch deadline: 2023-05-01

Required Action (CISA)

Apply updates per vendor instructions.

Risk Analysis

This out-of-bounds write vulnerability in Apple iOS, iPadOS, and macOS IOSurfaceAccelerator allows a malicious application to execute code with kernel privileges. This is a critical flaw that can lead to full system compromise. Its high severity and confirmed exploitation in the wild, along with an EPSS score of 0.14582, demand immediate patching.

This vulnerability is actively exploited in the wild and is included in CISA's KEV catalog. It allows an app to execute code with kernel privileges.

Recommended Action

Update Apple iOS, iPadOS, and macOS to the latest secure versions. Regularly apply security updates to all Apple devices to protect against kernel-level exploits.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2023-28206 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2023-28206 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.