---
title: "Apple Triangulation Font Bug and Kernel PAC Bypass in KEV"
url: https://erroneo.us/security/briefs/apple-ios-triangulation-font-cve-2023-41990-pac-cve-2022-48618/
description: "Two iOS bugs Apple flagged as exploited long after fixing them: Triangulation's FontParser RCE and a kernel PAC bypass. Fixed by iOS 16.3. Find old devices."
type: security-brief
section: "Security Digest"
date_published: 2022-12-13
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2023-41990", "CVE-2022-48618"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Apple Triangulation Font Bug and Kernel PAC Bypass in KEV

**Verdict: Check exposure.** Both bugs were fixed in late 2022 and early 2023 and only matter for Apple devices that never updated past those builds, but they were real spyware tools, so find any device still that old.

- **Who must act:** Owners of iPhones or iPads below iOS 16.3 (on 16) or 15.7.8 (on 15), Macs below Ventura 13.2, Monterey 12.6.8 or Big Sur 11.7.9, and Apple Watches or TVs below watchOS 9.3 or tvOS 16.3.
- **Who can relax:** Anyone whose devices have taken an update since mid-2023; current builds such as iOS 26.7.1, 18.7.10 and 16.7.16 include both fixes, and iOS 15.8.8 includes the font fix.
- **Affected:** iOS and iPadOS 16 before 16.3 (CVE-2023-41990) and before 16.2 (CVE-2022-48618); iOS and iPadOS 15 before 15.7.8 (CVE-2023-41990; Apple lists no iOS 15 fix for CVE-2022-48618); macOS Ventura before 13.2 (CVE-2023-41990) and before 13.1 (CVE-2022-48618); macOS Monterey before 12.6.8 and Big Sur before 11.7.9 (CVE-2023-41990); watchOS before 9.3 and tvOS before 16.3
- **Fixed:** iOS and iPadOS 16.3 (both bugs); iOS and iPadOS 15.7.8 (CVE-2023-41990); macOS Ventura 13.2 (both bugs); macOS Monterey 12.6.8 and Big Sur 11.7.9 (CVE-2023-41990); watchOS 9.3 and tvOS 16.3 (both bugs)
- **CVEs:** CVE-2023-41990, CVE-2022-48618
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Pull an OS version report from MDM and flag iPhones and iPads below iOS 16.6 (on 16) or 15.7.8 (on 15), the floors that close the whole Triangulation chain.
2. Check Macs with sw_vers -productVersion and flag Ventura below 13.2, Monterey below 12.6.8 and Big Sur below 11.7.9.
3. Update flagged devices to the newest build they support, such as iOS 16.7.16 for the iPhone 8 and X or iOS 15.8.8 for the iPhone 6s and 7.
4. Retire or block from corporate access any device that cannot update; Apple lists no iOS 15 fix for CVE-2022-48618.
5. If an old iPhone belongs to someone likely to be targeted, check a backup with Kaspersky's Triangulation indicators.

### How to check if you are affected

- Make an encrypted backup, run mvt-ios on it, and look in timeline.csv for data usage entries for the BackupAgent process, which Kaspersky calls the most reliable Triangulation sign.
- Search DNS and proxy logs for Kaspersky's Triangulation C2 domains, such as addatamarket[.]net, backuprabbit[.]com, businessvideonews[.]com and web-trackers[.]com.
- No indicators have been published for CVE-2022-48618 as of Oct 23, 2026.

## What happened

Two Apple bugs entered CISA's KEV catalog in January 2024, both fixed long before Apple called them exploited. [CVE-2023-41990](https://www.cve.org/CVERecord?id=CVE-2023-41990) is in FontParser: "Processing a font file may lead to arbitrary code execution." The fix shipped in [iOS 16.3](https://support.apple.com/en-us/106330), [macOS Ventura 13.2](https://support.apple.com/en-us/106328) and watchOS 9.3 on January 23, 2023, then in [iOS 15.7.8](https://support.apple.com/en-us/120332), Monterey 12.6.8 and Big Sur 11.7.9 on July 24, 2023. Apple added the entry on September 8, 2023. It credits Kaspersky researchers and says the bug "may have been actively exploited against versions of iOS released before iOS 15.7.1." [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-41990) scores it 7.8.

Kaspersky's [June 2023 report](https://securelist.com/operation-triangulation/109842/) described a zero-click iMessage attack on its own staff's iPhones, with traces back to 2019. The newest version it saw infected was iOS 15.7. At the 37C3 congress on December 27, 2023, Kaspersky [said](https://securelist.com/operation-triangulation-the-last-hardware-mystery/109453/) the chain started with CVE-2023-41990, a bug in "the undocumented, Apple-only ADJUST TrueType font instruction." The other zero-days were CVE-2023-32434 (kernel), [CVE-2023-38606](https://www.cve.org/CVERecord?id=CVE-2023-38606) (a hardware PPL bypass) and CVE-2023-32435 (Safari). CISA added CVE-2023-41990 to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41990) on January 8, 2024.

[CVE-2022-48618](https://www.cve.org/CVERecord?id=CVE-2022-48618) is a kernel bug fixed in [iOS 16.2](https://support.apple.com/en-us/102807) and [Ventura 13.1](https://support.apple.com/en-us/102808) on December 13, 2022. Apple added it to those notes on January 9, 2024: "An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication." The exploitation note carries the same "before iOS 15.7.1" boundary. It helps an attacker who already has memory access; it is not a way in. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-48618) scores it 7.0, and CISA [listed it](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-48618) on January 31, 2024. Apple has not said who reported it. [The Hacker News](https://thehackernews.com/2024/02/cisa-warns-of-active-exploitation-of.html) noted that how it was used is unknown. No public report ties it to Triangulation as of Oct 23, 2026.

## Who is affected

CVE-2023-41990 affects iOS and iPadOS 16 before 16.3 and 15 before 15.7.8, Ventura before 13.2, Monterey before 12.6.8, Big Sur before 11.7.9, watchOS before 9.3 and tvOS before 16.3. CVE-2022-48618 affects iOS before 16.2, Ventura before 13.1, watchOS before 9.2 and tvOS before 16.2. Apple lists no fix for it on iOS 15, Monterey or Big Sur.

## Do you really need to act?

Most fleets do not. A device must have skipped every update since early 2023. [Apple's current builds](https://support.apple.com/en-us/100100) include iOS 26.7.1, 18.7.10, 16.7.16 and 15.8.8. The risk is a forgotten iPhone 8 or 7, a kiosk iPad or an old Mac. The full Triangulation chain closes only on iOS 16.6 or 15.7.8, and its bugs outlived the campaign. Google's [Coruna report](https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit) says two modules in that kit exploit Triangulation's CVE-2023-32434 and CVE-2023-38606.

## What to do now

1. Pull an MDM version report. Flag iOS 16 below 16.6 and iOS 15 below 15.7.8. Over USB, run `ideviceinfo -k ProductVersion`.
2. On Macs, run `sw_vers -productVersion`. Flag Ventura below 13.2, Monterey below 12.6.8 and Big Sur below 11.7.9.
3. Update to the newest supported build, such as iOS 16.7.16 (iPhone 8 and X) or 15.8.8 (iPhone 6s and 7).
4. Retire or block devices that cannot update.

## How to tell if you were hit

Back up the device with encryption, then run `mvt-ios decrypt-backup -p PASSWORD -d ./dec ./backup` and `mvt-ios check-backup --output ./out ./dec`. In `timeline.csv`, look for data usage entries for the `BackupAgent` process, which Kaspersky calls the most reliable indicator. Search DNS logs for its C2 domains: `grep -E "addatamarket\.net|backuprabbit\.com|businessvideonews\.com|web-trackers\.com" dns.log`. No indicators exist for CVE-2022-48618.

## Timeline

- Dec 13, 2022 — iOS 16.2 and Ventura 13.1 fix CVE-2022-48618 unannounced.
- Jan 23, 2023 — iOS 16.3 and Ventura 13.2 fix CVE-2023-41990 unannounced.
- Jun 1, 2023 — Kaspersky discloses Operation Triangulation.
- Jul 24, 2023 — iOS 15.7.8, Monterey 12.6.8 and Big Sur 11.7.9 ship the font fix.
- Sep 8, 2023 — Apple adds the CVE-2023-41990 entry.
- Dec 27, 2023 — Kaspersky details the chain at 37C3.
- Jan 8, 2024 — CISA adds CVE-2023-41990 to KEV.
- Jan 9, 2024 — Apple discloses CVE-2022-48618.
- Jan 31, 2024 — CISA adds CVE-2022-48618 to KEV.

## Sources

1. [Apple — About the security content of iOS 16.3 and iPadOS 16.3](https://support.apple.com/en-us/106330)
2. [Apple — About the security content of iOS 15.7.8 and iPadOS 15.7.8](https://support.apple.com/en-us/120332)
3. [Apple — About the security content of macOS Ventura 13.2](https://support.apple.com/en-us/106328)
4. [Apple — About the security content of iOS 16.2 and iPadOS 16.2](https://support.apple.com/en-us/102807)
5. [Apple — About the security content of macOS Ventura 13.1](https://support.apple.com/en-us/102808)
6. [Apple — Apple security releases](https://support.apple.com/en-us/100100)
7. [CVE record — CVE-2023-41990](https://www.cve.org/CVERecord?id=CVE-2023-41990)
8. [CVE record — CVE-2022-48618](https://www.cve.org/CVERecord?id=CVE-2022-48618)
9. [NVD — CVE-2023-41990](https://nvd.nist.gov/vuln/detail/CVE-2023-41990)
10. [NVD — CVE-2022-48618](https://nvd.nist.gov/vuln/detail/CVE-2022-48618)
11. [CISA — Known Exploited Vulnerabilities: CVE-2023-41990](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41990)
12. [CISA — Known Exploited Vulnerabilities: CVE-2022-48618](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-48618)
13. [Kaspersky Securelist — Operation Triangulation: iOS devices targeted with previously unknown malware](https://securelist.com/operation-triangulation/109842/)
14. [Kaspersky Securelist — Operation Triangulation: The last (hardware) mystery](https://securelist.com/operation-triangulation-the-last-hardware-mystery/109453/)
15. [CVE record — CVE-2023-38606](https://www.cve.org/CVERecord?id=CVE-2023-38606)
16. [Google Threat Intelligence Group — Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit](https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit)
17. [The Hacker News — CISA Warns of Active Exploitation of Apple iOS and macOS Vulnerability](https://thehackernews.com/2024/02/cisa-warns-of-active-exploitation-of.html)

---
Source page: https://erroneo.us/security/briefs/apple-ios-triangulation-font-cve-2023-41990-pac-cve-2022-48618/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt