PatchSiren cyber security CVE debrief
CVE-2017-2353 Apple CVE debrief
CVE-2017-2353 is a high-severity macOS Bluetooth use-after-free that Apple addressed in macOS 10.12.3. According to the NVD record, affected systems include macOS versions up to 10.12.2, and exploitation could lead to arbitrary code execution in a privileged context or denial of service. The published CVSS v3.0 vector indicates a local attack that requires user interaction, but can still have high impact on confidentiality, integrity, and availability.
- Vendor
- Apple
- Product
- CVE-2017-2353
- CVSS
- HIGH 7.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2017-02-20
- Original CVE updated
- 2026-05-13
- Advisory published
- 2017-02-20
- Advisory updated
- 2026-05-13
Who should care
macOS users and administrators running 10.12.2 or earlier, especially environments that allow users to install or run untrusted apps. Security teams managing Apple desktop fleets should prioritize this if legacy systems remain in service.
Technical summary
NVD classifies the weakness as CWE-416 (use-after-free) in the Bluetooth component. The attack path is local and requires user interaction (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The vulnerable range in the record is macOS up to and including 10.12.2, with Apple’s security update documentation pointing to remediation in 10.12.3.
Defensive priority
High for any exposed or still-supported macOS 10.12.2 and earlier systems; otherwise primarily a legacy-system risk. Because the issue can result in code execution with privileged impact, patching should be treated as urgent where applicable.
Recommended defensive actions
- Update affected Macs to macOS 10.12.3 or later using Apple's security guidance (HT207483).
- Inventory fleet versions and confirm no endpoints remain on macOS 10.12.2 or earlier.
- Restrict execution of untrusted or unnecessary applications, especially on systems that cannot be upgraded immediately.
- Prefer standard-user operation over administrator use to reduce the impact of local attacks.
- Review for unexpected Bluetooth-related crashes or instability on legacy systems while remediation is underway.
Evidence notes
The CVE record published on 2017-02-20 states macOS before 10.12.3 is affected and identifies the Bluetooth component. NVD maps the issue to CWE-416 and gives the CVSS v3.0 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, supporting a local, user-interaction-required threat model. Apple’s support link HT207483 is the official remediation reference in the source corpus. The later modified date (2026-05-13) is a record update timestamp and should not be treated as the issue date.
Official resources
Publicly disclosed on 2017-02-20. The NVD record was modified later, on 2026-05-13, but that does not change the original CVE publication date.