CVE-2023-42904: 
macOS vulnerability analysis and mitigation

CVE-2023-42904 is a memory corruption vulnerability discovered in Apple's macOS Sonoma operating system. The vulnerability was identified by Ivan Fratric of Google Project Zero and fixed in macOS Sonoma 14.2, released on December 11, 2023. The issue affects versions of macOS Sonoma from 14.0 up to (excluding) 14.2 (Apple Advisory).

The vulnerability is classified as a memory corruption issue in the AppleGraphicsControl component of macOS. It has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue was addressed by Apple through improved input validation (NVD).

When exploited, this vulnerability could allow processing of a maliciously crafted file to lead to unexpected application termination or arbitrary code execution. The impact is considered high as it could potentially allow an attacker to execute arbitrary code in the context of the logged-on user (Apple Advisory, CIS Advisory).

The vulnerability requires local access and user interaction to exploit. An attacker would need to convince a user to process a maliciously crafted file to trigger the vulnerability. There are no reports of this vulnerability being exploited in the wild (NVD).

Apple has addressed this vulnerability in macOS Sonoma 14.2. Users are advised to update their systems to this version or later. The fix implements improved input validation to address the memory corruption issues (Apple Advisory).