CVE-2023-42916
Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability
Published Nov 30, 2023 · updated Jun 16, 2026 · apple safari
Apple iOS, iPadOS, macOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Timeline
Detection, updates, and resolution for this record.
Nov 30, 2023 · Catalog
Detected
Apple iOS, iPadOS, macOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Dec 4, 2023 · CISA KEV
Known exploited
Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Dec 25, 2023 · CISA KEV
Remediation due
Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Jun 16, 2026 · Catalog
Updated
Apple iOS, iPadOS, macOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required action
Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
CISA due date Dec 25, 2023
Affected
- cpe apple/ipadosversion unspecified
- cpe apple/iphone osversion unspecified
- cpe apple/macosversion unspecified
- cpe apple/safariversion unspecified
- cpe debian/debian linux11.0
- cpe fedoraproject/fedora38
- cpe webkitgtk/webkitgtk+version unspecified
- vendor Apple Multiple Productsversion unspecified
Sources
- CISA KEVCVE-2023-42916
Apple iOS, iPadOS, macOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
cisa.gov - CVE.orgCVE-2023-42916
Official CVE identifier
cve.org - FIRST EPSSCVE-2023-42916
30-day exploitation probability 17.8%
first.org - NIST NVDCVE-2023-42916
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploit
nvd.nist.gov