ZeroDay Findings
Sign inSign up

Findings

CVE-2016-4657

Apple iOS Webkit Memory Corruption Vulnerability

Published Aug 25, 2016 · updated Jun 16, 2026 · apple iphone os

Apple iOS WebKit contains a memory corruption vulnerability that allows attackers to execute remote code or cause a denial-of-service (DoS) via a crafted web site. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 25, 2016 · Catalog

    Detected

    Apple iOS WebKit contains a memory corruption vulnerability that allows attackers to execute remote code or cause a denial-of-service (DoS) via a crafted web site. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

  2. May 24, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Jun 14, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Apple iOS WebKit contains a memory corruption vulnerability that allows attackers to execute remote code or cause a denial-of-service (DoS) via a crafted web site. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Required action

Apply updates per vendor instructions.

CISA due date Jun 14, 2022

Affected

  • cpe apple/iphone osversion unspecified
  • vendor Apple iOSversion unspecified

Sources

  • CISA KEVCVE-2016-4657

    Apple iOS WebKit contains a memory corruption vulnerability that allows attackers to execute remote code or cause a denial-of-service (DoS) via a crafted web site. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

    cisa.gov
  • CVE.orgCVE-2016-4657

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2016-4657

    30-day exploitation probability 66.8%

    first.org
  • Exploit Database44213

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit Database44836

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesexploit_apple_ios/browser/webkit_trident

    Public module reference (manual). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2016-4657

    WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.

    nvd.nist.gov

References