CVE-2023-32385

Vulnerability

A denial-of-service vulnerability in the PDF parsing component of iOS, iPadOS, and macOS allows a crafted PDF to trigger unexpected app termination. The issue is present in iOS and iPadOS versions prior to 16.5, and macOS Ventura prior to 13.4 [1][2].

Exploitation

An attacker can trigger the vulnerability by sending or making available a specially crafted PDF file. The victim only needs to open the malicious PDF in any app that processes PDF content. No additional privileges or authentication are required beyond normal user interaction to open the file [1][2].

Impact

Successful exploitation causes the application that opened the PDF to terminate unexpectedly (denial of service). The impact is limited to app termination; the advisory does not indicate code execution or privilege escalation [1][2].

Mitigation

Apple addressed the issue with improved memory handling in iOS 16.5, iPadOS 16.5, and macOS Ventura 13.4, released on May 18, 2023 [1][2]. Users should update affected devices to these versions or later. No workarounds are documented.