CVEvulnerability

CVE-2023-32435

8.8 HIGH Known exploited Published 2023-06-23 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Apple Multiple Products WebKit Memory Corruption Vulnerability — Apple Multiple Products

Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Added to KEV: 2023-06-23
Remediation due: 2023-07-14
Ransomware use: Unknown
Required action: Apply updates per vendor instructions.
Notes: https://support.apple.com/en-us/HT213670, https://support.apple.com/en-us/HT213671, https://support.apple.com/en-us/HT213676, https://support.apple.com/en-us/HT213811; https://nvd.nist.gov/vuln/detail/CVE-2023-32435

Status: Analyzed
Published: 2023-06-23
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses: CWE-787

Description

A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.7 and iPadOS 15.7.7. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.

Affected configurations

• apple safari (< 16.4) • apple ipados (< 15.7.7) • apple ipados (>= 16.0 < 16.4) • apple iphone os (< 15.7.7) • apple iphone os (>= 16.0 < 16.4) • apple macos (>= 13.0 < 13.3)

Weakness · CWE (1)

CWE-787 Out-of-bounds Write weakness

References