CVE-2023-42902: 
macOS vulnerability analysis and mitigation

CVE-2023-42902 is a memory corruption vulnerability discovered in Apple's macOS Sonoma operating system. The vulnerability was disclosed and patched on December 11, 2023, as part of the macOS Sonoma 14.2 security update. The issue affects the AppleGraphicsControl component in macOS Sonoma versions from 14.0 up to (excluding) 14.2 (Apple Advisory, NVD).

The vulnerability is classified as an out-of-bounds write (CWE-787) issue in the AppleGraphicsControl component. It received a CVSS v3.1 base score of 7.8 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability stems from multiple memory corruption issues that were addressed with improved input validation (NVD, ZDI Advisory).

When exploited, this vulnerability can lead to unexpected application termination or arbitrary code execution when processing a maliciously crafted file. The vulnerability provides an attacker with the potential for high impacts on confidentiality, integrity, and availability of the affected system (Apple Advisory, ZDI Advisory).

The vulnerability requires user interaction to exploit, specifically requiring the target to receive and process a malicious file. The exploit can be triggered through the VTDecoderXPCService process when processing HEIC files (ZDI Advisory).

Apple has addressed this vulnerability in macOS Sonoma 14.2. Users are advised to update to this version to receive the security fix. The fix implements improved input validation to address the multiple memory corruption issues (Apple Advisory).