Skip to main content
Mallory
HighCISA KEVExploited in the wildPublic exploit

Kernel privilege escalation via integer overflow in Apple iOS/watchOS/macOS

IdentifiersCVE-2023-32434CWE-190· Integer Overflow or Wraparound

CVE-2023-32434 is an Apple kernel vulnerability caused by an integer overflow. Apple states that improved input validation fixed the issue. Successful exploitation may allow an application to execute arbitrary code with kernel privileges. Supporting reporting further describes the flaw as a privilege-escalation issue involving integer overflow in memory mapping, and it was used as the kernel privilege-escalation component ('Photon') in exploit chains targeting iOS. Apple reported awareness that this issue may have been actively exploited in the wild against iOS versions released before iOS 15.7.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can result in arbitrary code execution in the kernel, giving the attacker kernel-level privileges on the affected device. In practical terms, this enables full local privilege escalation from an app or post-browser-compromise context, facilitating complete device compromise, implant deployment, kernel memory access/manipulation, security control bypass, and follow-on persistence or stealth operations depending on the broader exploit chain.

Mitigation

If you can’t patch tonight, do this now.

Primary mitigation is prompt patching to a fixed OS release. Where immediate patching is not possible, reduce exposure by limiting execution of untrusted applications and untrusted web content that could be used to obtain initial code execution before invoking this local kernel exploit. For high-risk iOS users, use Apple hardening features such as Lockdown Mode where operationally feasible, though this CVE itself is a local kernel issue and typically requires an initial foothold.

Remediation

Patch, then assume compromise.

Apply Apple security updates that address CVE-2023-32434. Apple states the issue is fixed in watchOS 9.5.2, watchOS 8.8.1, iOS 15.7.7, iPadOS 15.7.7, iOS 16.5.1, iPadOS 16.5.1, macOS Big Sur 11.7.8, macOS Monterey 12.6.7, and macOS Ventura 13.4.1. Systems should be updated to these versions or later.
PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).

VALID 1 / 2 TOTALView more in app
TrigonMaturityPoCVerified exploit

This repository, 'Trigon', is a deterministic kernel exploit targeting CVE-2023-32434, an integer overflow in the XNU VM layer on Apple A9-A11 devices running iOS 13 to 15.7.6. The exploit is implemented as an iOS app (Objective-C/C/assembly) and is structured as a full Xcode project. The main exploit logic resides in the 'Trigon/Exploit' directory, with key files including 'exploit.c', 'aop.c', and 'surface.c'. The exploit works by creating a malicious IOSurface object to trigger the vulnerability, then leverages custom ARM shellcode to gain arbitrary physical memory access. It escalates this to full kernel virtual memory read/write, providing powerful primitives for further exploitation or jailbreaking. The exploit is highly reliable (deterministic) and does not cause kernel panics. The app provides a simple UI that runs the exploit and displays success/failure. No network endpoints are present; all exploitation is local. The code is mature and operational, providing working kernel R/W primitives, but is not a weaponized framework. The repository is well-structured, with clear separation between exploit logic, device info, memory manipulation, and UI components.

alfiecg24Disclosed Mar 1, 2025cobjective-clocal
EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType
AppleIpadosoperating_system
AppleIphone Osoperating_system
AppleMacosoperating_system
AppleWatchosoperating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence17

Every observed campaign linking this CVE to a named adversary.

Associated malware35

Malware families riding this exploit, with evidence and IOCs.

Detection signatures2

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity8

Community discussion across Reddit, Mastodon, and other social sources.