CVE-2023-42907: 
macOS vulnerability analysis and mitigation

CVE-2023-42907 is a memory corruption vulnerability discovered in macOS Sonoma that was fixed in version 14.2, released on December 11, 2023. The vulnerability affects the AppleGraphicsControl component and was discovered by Ivan Fratric of Google Project Zero (Apple Security).

The vulnerability is a memory corruption issue that was addressed with improved input validation in macOS Sonoma. The vulnerability has a CVSS v3.1 base score of 7.8 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. It is classified as CWE-787 (Out-of-bounds Write) (NVD).

Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution. Successful exploitation could allow an attacker to execute arbitrary code in the context of the logged-on user (CIS Advisory).

The vulnerability requires local access and user interaction to exploit. The attacker needs to convince a user to process a maliciously crafted file to trigger the vulnerability (Apple Security).

Apple has addressed this vulnerability in macOS Sonoma 14.2. Users should update to this version or later to mitigate the risk. The fix involves improved input validation in the AppleGraphicsControl component (Apple Security).