CVE-2023-28206: Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write Vulnerability

CVE-2023-28206 is an out-of-bounds write vulnerability in the IOSurfaceAccelerator component of Apple iOS, iPadOS, and macOS. It allows a malicious app to execute code with kernel privileges. This matters because kernel-level access can give an attacker full control over the device, enabling persistence, data theft, or further compromise of the system.

Security and IT teams should treat this as a high-priority issue for Apple device fleets, as successful exploitation bypasses normal app sandboxing and user-level restrictions. Confirm all details, including exact affected builds, against the official Apple security advisory.

How it works

This vulnerability falls under CWE-787 (Out-of-bounds Write). In the IOSurfaceAccelerator component, which handles graphics and surface acceleration tasks, improper bounds checking allows a write operation to target memory outside the intended buffer.

An attacker abuses this by delivering or installing a specially crafted app that interacts with the vulnerable component. The out-of-bounds write can corrupt kernel memory structures, leading to arbitrary code execution with kernel privileges. Public detail on exact trigger conditions or memory layouts is limited; defenders should rely on the vendor advisory rather than assuming specific exploit paths. The result is that a user-space app can escalate to full kernel control without needing additional privileges beyond app installation or execution.

Am I affected? How to find it in your systems

The vulnerability affects Apple iOS, iPadOS, and macOS systems that include the IOSurfaceAccelerator component. These operating systems typically run on iPhones, iPads, Macs, and related Apple hardware managed in enterprise environments via MDM, Apple Business Manager, or manual inventory.

• Inventory all managed and unmanaged Apple devices: query MDM consoles, asset databases, or endpoint management tools for iOS, iPadOS, and macOS installations.
• Check OS versions and build numbers against the ranges listed in Apple’s security advisory for this CVE; do not rely on generic version assumptions.
• Look for devices that allow sideloading or enterprise app distribution, as the attack vector involves an app reaching the vulnerable component.
• Review telemetry for signs of exploitation: unexpected kernel panics, crashes involving graphics or surface acceleration subsystems, anomalous app behavior requesting elevated access, or sudden privilege escalations. Correlate with process logs, crash reports, and EDR alerts for IOSurface-related activity. Specific indicators of compromise are not detailed in public summaries, so baseline normal device behavior and investigate deviations.

If your environment includes mixed personal and corporate devices, prioritize those with access to sensitive data or networks.

How to remediate

Apply the updates provided by Apple as the primary remediation, following the vendor instructions referenced in CISA guidance. Patch management should target all affected iOS, iPadOS, and macOS devices promptly through MDM push, user notifications, or automated update policies.

• Verify successful installation by confirming the updated build numbers match the fixed versions in the advisory.
• For this class of out-of-bounds write flaws in kernel-adjacent components, enforce least-privilege app installation policies, restrict untrusted app sources, and enable system integrity protections where available.
• Harden by reviewing and limiting apps that interact with graphics acceleration features, and ensure devices enforce code-signing and sandboxing strictly.
• After patching, re-inventory devices and re-baseline telemetry to confirm the vulnerable component is no longer present in the vulnerable state.

Document the update process for compliance and audit purposes.

If you can't patch immediately

When immediate patching is blocked by testing, operational constraints, or device availability, apply compensating controls to reduce exposure until updates can be deployed.

• Segment affected devices from high-value networks and limit their access to sensitive resources using network access control or VPN policies.
• Use mobile device management to restrict app installation to approved sources only, block sideloading where possible, and disable unnecessary features that might interact with IOSurfaceAccelerator if configuration options exist (confirm availability against vendor documentation).
• Deploy or tune endpoint detection to monitor for anomalous app-to-kernel interactions, unexpected privilege use, or graphics subsystem anomalies; increase logging verbosity for kernel and crash events.
• Consider virtual patching approaches via network-level filtering if traffic patterns related to the component can be identified, though this is limited for local app-based attacks.
• Prioritize temporary isolation of high-risk devices (those with elevated data access) and accelerate patch testing for them.

These measures lower but do not eliminate risk; schedule patching as soon as feasible.

If your data may have been exposed

Vulnerabilities that enable kernel code execution can lead to device compromise and subsequent data exposure or lateral movement. Known ransomware use of this specific CVE is not documented. If compromise is suspected, isolate the device, preserve forensic evidence, and investigate for unauthorized access or data exfiltration. Organizations and individuals can run a free exposure scan of their email addresses against known breach datasets to check whether related credentials or personal information appear in public breach records.