CVE-2016-4657KEV · OVERDUE

Apple iOS Webkit Memory Corruption Vulnerability

High · published August 25, 2016

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 99.3th percentile for exploit probability.

1591
days past CISA
deadline
CVSS v3.1
8.8
EPSS
67%
Percentile
99.3
In the wild
Confirmed
What it is

🚨 A cleverly crafted website could cause a catastrophic meltdown! This vulnerability in Apple's WebKit allows attackers to execute arbitrary code on iOS devices before 9.3.5. 🔥 Think of it like a beautifully wrapped gift that, once opened, unleashes chaos inside your home — everything from remote code execution to memory corruption is possible, turning your device into a playground for hackers. An attacker could take full control of your device or cause it to crash unexpectedly, leading to a total denial of service. This could result in loss of sensitive data and disrupt your everyday activities in the most frustrating ways. It’s absolutely devastating!

Put simply

Think of it like a beautifully wrapped gift that, once opened, unleashes chaos inside your home — everything from remote code execution to memory corruption is possible, turning your device into a playground for hackers. This vulnerability in WebKit allows remote attackers to execute arbitrary code or trigger memory corruption on affected iOS devices simply by tricking users into visiting a malicious website.

What to do

An attacker could take full control of your device or cause it to crash unexpectedly, leading to a total denial of service. This could result in loss of sensitive data and disrupt your everyday activities in the most frustrating ways. It’s absolutely devastating! Update your iOS to version 9.3.5 or later immediately to mitigate this risk. Encourage users to avoid suspicious links and consider using additional security tools for added protection. You've got this! Take action now to protect your devices and stay safe. 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.66788 · 99.3th percentile
Published
2016-08-25T21:00Z
KEV added
2022-05-24 · due 2022-06-14
EPSS history
Timeline
  • 24 MAY 00:00Z
    Added to CISA KEV — remediate by Jun 14
    kev
  • 25 AUG 21:00Z
    WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site
    cvelistv5