CVE-2023-42917
Apple Multiple Products WebKit Memory Corruption Vulnerability
Published Nov 30, 2023 · updated Jun 16, 2026 · apple safari
Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Timeline
Detection, updates, and resolution for this record.
Nov 30, 2023 · Catalog
Detected
Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Dec 4, 2023 · CISA KEV
Known exploited
Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Dec 25, 2023 · CISA KEV
Remediation due
Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Jun 16, 2026 · Catalog
Updated
Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required action
Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
CISA due date Dec 25, 2023
Affected
- cpe apple/ipadosversion unspecified
- cpe apple/iphone osversion unspecified
- cpe apple/macosversion unspecified
- cpe apple/safariversion unspecified
- cpe debian/debian linux11.0
- cpe fedoraproject/fedora38
- cpe webkitgtk/webkitgtk+version unspecified
- vendor Apple Multiple Productsversion unspecified
Sources
- CISA KEVCVE-2023-42917
Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
cisa.gov - CVE.orgCVE-2023-42917
Official CVE identifier
cve.org - FIRST EPSSCVE-2023-42917
30-day exploitation probability 9.3%
first.org - NIST NVDCVE-2023-42917
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been ex
nvd.nist.gov