CVE-2023-41974
High 7.8 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- Apple iOS and iPadOS Use-After-Free Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17 and iPadOS 17, iOS 15.8.7 and iPadOS 15.8.7. An app may be able to execute arbitrary code with kernel privileges.
Metrics
- CVSS 3.1
-
7.8 (HIGH)
Score source: NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 2% (percentile: 80) as of 2 November 2026
- CWE
- CWE-416
Affected products
apple: ipados; apple: iphone os
References
- https://support.apple.com/en-us/120949 Release NotesVendor Advisory
- https://support.apple.com/en-us/126632 Release NotesVendor Advisory
- https://support.apple.com/en-us/HT213938 Release NotesVendor Advisory
- https://support.apple.com/kb/HT213938 Release NotesVendor Advisory
- https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-ex… ExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023… US Government Resource