Apple: how long users stay exposed after a fix exists

iOS, iPadOS and macOS. CVEs whose earliest fix shipped on or after 2023-01-01. Median and worst case are shown; means are not.

Export every CVE × branch row behind this page: CSV · JSON · Permalink: /apple

Branch: A major OS version line that receives its own updates, e.g. iOS 16 or macOS 14 Sonoma. iOS and iPadOS are counted separately.

First fix: The release date of the earliest Apple update (including Rapid Security Responses and Background Security Improvements) whose advisory lists the CVE.

Exploited: Listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, or Apple's advisory says the issue “may have been exploited”.

1. Backport gap for exploited flaws

How long did users of an older branch wait after the same flaw was already fixed on another branch of the same OS?

Backport gap: For one CVE and one branch: the branch's first fix date minus the earliest fix date across all branches of the same platform.

No fix listed: The branch is still maintained (it shipped a security update after the earliest fix, or its last security update is under 180 days old), but no Apple advisory lists this CVE for it as of the data date. The branch may be unaffected; Apple does not publish “not affected” statements.

Branch ended: The branch shipped no security update after the earliest fix and none in the 180 days before the data date, so it is treated as ended and not counted as missing a backport. Updates without published CVE entries do not keep a branch alive.

2. Exploited before patch

Of the flaws known to be exploited, how many were attacked before any patch existed?

Exploited: Listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, or Apple's advisory says the issue “may have been exploited”.

36 of 44 exploited Apple flaws were attacked before a patch existed, per Apple's own advisory (“may have been exploited”). How long before is not public.

KEV date added (proxy): CISA KEV “date added” is when CISA catalogued evidence of exploitation. It is a lagging proxy: exploitation started on or before that date, usually well before.

Secondary, KEV proxy: 44 are in CISA KEV, listed a median of 3 days after the first patch (longest: 955 days, CVE-2023-43000); 2 were listed before any patch existed.

Third-party component: CISA KEV files the CVE under a vendor other than Apple (e.g. Google for Chromium code shipped in WebKit/ANGLE). The flaw is in a component Apple ships but does not own.

3 of the exploited CVEs are in third-party components.

3. Disclosure lag

How long after Apple's fix did the CVE appear in NVD, where most scanners and risk tools read it?

Disclosure lag: NVD publication date minus the earliest fix date. Negative when the CVE record was published before the fix.

Median 1 day, worst 835 days (CVE-2023-43000), over 2565 of 2565 CVEs. NVD date unknown for 0. 124 were published in NVD before the fix. 614 CVEs were added to Apple's advisory after the release that fixed them; their fix date stays the release date.