CVE-2023-42917
Published 2023-11-30 · Updated 2026-06-17 · Source product-security@apple.com
Summary
CVE-2023-42917 is a high-severity (CVSS 8.8) vulnerability in Apple Multiple Products. CISA added it to the Known Exploited Vulnerabilities catalog on December 4, 2023, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by December 25, 2023. CISA does not currently list it as used in ransomware campaigns. Apple has 95 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.
All 95 known-exploited Apple vulnerabilities →Description
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Apple — Multiple Products
Name: Apple Multiple Products WebKit Memory Corruption Vulnerability
Date added: 2023-12-04 · Due: 2023-12-25
Required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
References
- http://seclists.org/fulldisclosure/2023/Dec/12
- http://seclists.org/fulldisclosure/2023/Dec/13
- http://seclists.org/fulldisclosure/2023/Dec/3
- http://seclists.org/fulldisclosure/2023/Dec/4
- http://seclists.org/fulldisclosure/2023/Dec/5
- http://seclists.org/fulldisclosure/2023/Dec/8
- http://seclists.org/fulldisclosure/2024/Jan/35
- http://www.openwall.com/lists/oss-security/2023/12/05/1