CVE-2023-43000
High 8.8 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- Apple Multiple products Use-After-Free Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption.
Metrics
- CVSS 3.1
-
8.8 (HIGH)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 4% (percentile: 91) as of 1 November 2026
- CWE
- CWE-416
Affected products
apple: safari; apple: ipados; apple: iphone os; apple: macos
References
- https://support.apple.com/en-us/120324 Release NotesVendor Advisory
- https://support.apple.com/en-us/120331 Release NotesVendor Advisory
- https://support.apple.com/en-us/120338 Release NotesVendor Advisory
- https://support.apple.com/en-us/126632 Release NotesVendor Advisory
- https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-ex… ExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023… US Government Resource