CVE-2023-42916

MEDIUM severity · CVSS 6.5 · Out-of-bounds read · actively exploited (CISA KEV)

6.5CVSS MEDIUM ● exploited

🔴 Actively exploited in the wild (CISA Known Exploited Vulnerabilities). Added to KEV 2023-12-04. US federal agencies must patch by 2023-12-25.

Summary

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionRequired

Confidentiality impactHigh

Integrity impactNone

Availability impactNone

Exploit probability (EPSS)0%

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products we track (1)

Apple Safari

Recommendation

This vulnerability is being actively exploited in the wild — patch affected products urgently. Open any affected product above for its exact safe version.

Additional information

NVD record
http://seclists.org/fulldisclosure/2023/Dec/12Advisory
http://seclists.org/fulldisclosure/2023/Dec/13Advisory
http://seclists.org/fulldisclosure/2023/Dec/3Advisory
http://seclists.org/fulldisclosure/2023/Dec/4Advisory
http://seclists.org/fulldisclosure/2023/Dec/5Advisory
http://seclists.org/fulldisclosure/2023/Dec/8Advisory
http://seclists.org/fulldisclosure/2024/Jan/35Advisory
http://www.openwall.com/lists/oss-security/2023/12/05/1Advisory