erroneo.us
Search all guides⌘K

Security Digest · Dec 13, 2022 · Vulnerability · Mobile

Apple Triangulation Font Bug and Kernel PAC Bypass in KEV

Two iOS bugs Apple flagged as exploited long after fixing them: Triangulation's FontParser RCE and a kernel PAC bypass. Fixed by iOS 16.3. Find old devices.

Published By erroneo.us Security Desk · Updated 3 min read17 sources

Our verdict

Check exposure

Both bugs were fixed in late 2022 and early 2023 and only matter for Apple devices that never updated past those builds, but they were real spyware tools, so find any device still that old.

Who must act: Owners of iPhones or iPads below iOS 16.3 (on 16) or 15.7.8 (on 15), Macs below Ventura 13.2, Monterey 12.6.8 or Big Sur 11.7.9, and Apple Watches or TVs below watchOS 9.3 or tvOS 16.3.

Who can relax: Anyone whose devices have taken an update since mid-2023; current builds such as iOS 26.7.1, 18.7.10 and 16.7.16 include both fixes, and iOS 15.8.8 includes the font fix.

Affected
iOS and iPadOS 16 before 16.3 (CVE-2023-41990) and before 16.2 (CVE-2022-48618)
iOS and iPadOS 15 before 15.7.8 (CVE-2023-41990; Apple lists no iOS 15 fix for CVE-2022-48618)
macOS Ventura before 13.2 (CVE-2023-41990) and before 13.1 (CVE-2022-48618)
macOS Monterey before 12.6.8 and Big Sur before 11.7.9 (CVE-2023-41990)
watchOS before 9.3 and tvOS before 16.3
Fixed in
iOS and iPadOS 16.3 (both bugs)
iOS and iPadOS 15.7.8 (CVE-2023-41990)
macOS Ventura 13.2 (both bugs)
macOS Monterey 12.6.8 and Big Sur 11.7.9 (CVE-2023-41990)
watchOS 9.3 and tvOS 16.3 (both bugs)
CVSS
7.8 (v3.1, NVD)
EPSS
1.4% (percentile 72)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
High

What to do

  1. Pull an OS version report from MDM and flag iPhones and iPads below iOS 16.6 (on 16) or 15.7.8 (on 15), the floors that close the whole Triangulation chain.
  2. Check Macs with sw_vers -productVersion and flag Ventura below 13.2, Monterey below 12.6.8 and Big Sur below 11.7.9.
  3. Update flagged devices to the newest build they support, such as iOS 16.7.16 for the iPhone 8 and X or iOS 15.8.8 for the iPhone 6s and 7.
  4. Retire or block from corporate access any device that cannot update; Apple lists no iOS 15 fix for CVE-2022-48618.
  5. If an old iPhone belongs to someone likely to be targeted, check a backup with Kaspersky's Triangulation indicators.

How to check if you are affected or compromised

  • Make an encrypted backup, run mvt-ios on it, and look in timeline.csv for data usage entries for the BackupAgent process, which Kaspersky calls the most reliable Triangulation sign.
  • Search DNS and proxy logs for Kaspersky's Triangulation C2 domains, such as addatamarket[.]net, backuprabbit[.]com, businessvideonews[.]com and web-trackers[.]com.
  • No indicators have been published for CVE-2022-48618 as of Oct 23, 2026.

What happened#

Two Apple bugs entered CISA's KEV catalog in January 2024, both fixed long before Apple called them exploited. CVE-2023-41990 is in FontParser: "Processing a font file may lead to arbitrary code execution." The fix shipped in iOS 16.3, macOS Ventura 13.2 and watchOS 9.3 on January 23, 2023, then in iOS 15.7.8, Monterey 12.6.8 and Big Sur 11.7.9 on July 24, 2023. Apple added the entry on September 8, 2023. It credits Kaspersky researchers and says the bug "may have been actively exploited against versions of iOS released before iOS 15.7.1." NVD scores it 7.8.

Kaspersky's June 2023 report described a zero-click iMessage attack on its own staff's iPhones, with traces back to 2019. The newest version it saw infected was iOS 15.7. At the 37C3 congress on December 27, 2023, Kaspersky said the chain started with CVE-2023-41990, a bug in "the undocumented, Apple-only ADJUST TrueType font instruction." The other zero-days were CVE-2023-32434 (kernel), CVE-2023-38606 (a hardware PPL bypass) and CVE-2023-32435 (Safari). CISA added CVE-2023-41990 to KEV on January 8, 2024.

CVE-2022-48618 is a kernel bug fixed in iOS 16.2 and Ventura 13.1 on December 13, 2022. Apple added it to those notes on January 9, 2024: "An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication." The exploitation note carries the same "before iOS 15.7.1" boundary. It helps an attacker who already has memory access; it is not a way in. NVD scores it 7.0, and CISA listed it on January 31, 2024. Apple has not said who reported it. The Hacker News noted that how it was used is unknown. No public report ties it to Triangulation as of Oct 23, 2026.

Who is affected#

CVE-2023-41990 affects iOS and iPadOS 16 before 16.3 and 15 before 15.7.8, Ventura before 13.2, Monterey before 12.6.8, Big Sur before 11.7.9, watchOS before 9.3 and tvOS before 16.3. CVE-2022-48618 affects iOS before 16.2, Ventura before 13.1, watchOS before 9.2 and tvOS before 16.2. Apple lists no fix for it on iOS 15, Monterey or Big Sur.

Do you really need to act?#

Most fleets do not. A device must have skipped every update since early 2023. Apple's current builds include iOS 26.7.1, 18.7.10, 16.7.16 and 15.8.8. The risk is a forgotten iPhone 8 or 7, a kiosk iPad or an old Mac. The full Triangulation chain closes only on iOS 16.6 or 15.7.8, and its bugs outlived the campaign. Google's Coruna report says two modules in that kit exploit Triangulation's CVE-2023-32434 and CVE-2023-38606.

What to do now#

  1. Pull an MDM version report. Flag iOS 16 below 16.6 and iOS 15 below 15.7.8. Over USB, run ideviceinfo -k ProductVersion.
  2. On Macs, run sw_vers -productVersion. Flag Ventura below 13.2, Monterey below 12.6.8 and Big Sur below 11.7.9.
  3. Update to the newest supported build, such as iOS 16.7.16 (iPhone 8 and X) or 15.8.8 (iPhone 6s and 7).
  4. Retire or block devices that cannot update.

How to tell if you were hit#

Back up the device with encryption, then run mvt-ios decrypt-backup -p PASSWORD -d ./dec ./backup and mvt-ios check-backup --output ./out ./dec. In timeline.csv, look for data usage entries for the BackupAgent process, which Kaspersky calls the most reliable indicator. Search DNS logs for its C2 domains: grep -E "addatamarket\.net|backuprabbit\.com|businessvideonews\.com|web-trackers\.com" dns.log. No indicators exist for CVE-2022-48618.

Timeline#

  • — iOS 16.2 and Ventura 13.1 fix CVE-2022-48618 unannounced.
  • — iOS 16.3 and Ventura 13.2 fix CVE-2023-41990 unannounced.
  • — Kaspersky discloses Operation Triangulation.
  • — iOS 15.7.8, Monterey 12.6.8 and Big Sur 11.7.9 ship the font fix.
  • — Apple adds the CVE-2023-41990 entry.
  • — Kaspersky details the chain at 37C3.
  • — CISA adds CVE-2023-41990 to KEV.
  • — Apple discloses CVE-2022-48618.
  • — CISA adds CVE-2022-48618 to KEV.

Vulnerability records

  • CVE-2023-41990 · KEV 2024-01-08 · The issue was addressed with improved handling of caches.
  • CVE-2022-48618 · KEV 2024-01-31 · The issue was addressed with improved checks.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Apple — About the security content of iOS 16.3 and iPadOS 16.3 support.apple.com
  2. Apple — About the security content of iOS 15.7.8 and iPadOS 15.7.8 support.apple.com
  3. Apple — About the security content of macOS Ventura 13.2 support.apple.com
  4. Apple — About the security content of iOS 16.2 and iPadOS 16.2 support.apple.com
  5. Apple — About the security content of macOS Ventura 13.1 support.apple.com
  6. Apple — Apple security releases support.apple.com
  7. CVE record — CVE-2023-41990 cve.org
  8. CVE record — CVE-2022-48618 cve.org
  9. NVD — CVE-2023-41990 nvd.nist.gov
  10. NVD — CVE-2022-48618 nvd.nist.gov
  11. CISA — Known Exploited Vulnerabilities: CVE-2023-41990 cisa.gov
  12. CISA — Known Exploited Vulnerabilities: CVE-2022-48618 cisa.gov
  13. Kaspersky Securelist — Operation Triangulation: iOS devices targeted with previously unknown malware securelist.com
  14. Kaspersky Securelist — Operation Triangulation: The last (hardware) mystery securelist.com
  15. CVE record — CVE-2023-38606 cve.org
  16. Google Threat Intelligence Group — Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit cloud.google.com

Coverage and analysis

  1. The Hacker News — CISA Warns of Active Exploitation of Apple iOS and macOS Vulnerability thehackernews.com