ZeroDay Findings
Sign inSign up

Findings

CVE-2023-41993

Apple Multiple Products WebKit Code Execution Vulnerability

Published Sep 21, 2023 · updated Jun 16, 2026 · apple ipados

Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 21, 2023 · Catalog

    Detected

    Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

  2. Sep 25, 2023 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  3. Oct 16, 2023 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  4. Jun 16, 2026 · Catalog

    Updated

    Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date Oct 16, 2023

Affected

  • cpe apple/ipadosversion unspecified
  • cpe apple/iphone osversion unspecified
  • cpe apple/macosversion unspecified
  • cpe debian/debian linux11.0
  • cpe debian/debian linux12.0
  • cpe fedoraproject/fedora37
  • cpe fedoraproject/fedora38
  • cpe fedoraproject/fedora39
  • cpe netapp/active iq unified managerversion unspecified
  • cpe oracle/graalvm20.3.13
  • cpe webkitgtk/webkitgtk+version unspecified
  • vendor Apple Multiple Productsversion unspecified

Sources

  • CISA KEVCVE-2023-41993

    Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

    cisa.gov
  • CVE.orgCVE-2023-41993

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2023-41993

    30-day exploitation probability 24.3%

    first.org
  • NIST NVDCVE-2023-41993

    The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

    nvd.nist.gov

References

CVE-2023-41993 · ZeroDay Findings