CVE-2023-28204KEV · OVERDUE

Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability

Medium · published June 23, 2023

Patch now

The score understates this — it's already being exploited

CVSS calls it medium at 6.5. It is confirmed in active exploitation. It sits in the 96.6th percentile for exploit probability.

1230
days past CISA
deadline
CVSS v3.1
6.5
EPSS
14%
Percentile
96.6
In the wild
Confirmed
What it is

⚠️ An out-of-bounds read is sneaking around in Apple's ecosystem! This flaw can expose sensitive information when processing web content, so keep your eyes peeled! 🔍 Think of it like a waiter who accidentally serves the wrong dish—one that's not even on the menu! If the kitchen is careless, a diner might end up with someone else's meal, complete with their secret recipes! An attacker could potentially access sensitive information from your device, leading to data leaks. This could mean revealing personal data or credentials that could be exploited further—definitely not the dinner surprise anyone wants!

Put simply

Think of it like a waiter who accidentally serves the wrong dish—one that's not even on the menu! If the kitchen is careless, a diner might end up with someone else's meal, complete with their secret recipes! This vulnerability involves improper input validation, allowing unauthorized access to memory outside the intended boundaries, which can reveal confidential information during web content processing.

What to do

An attacker could potentially access sensitive information from your device, leading to data leaks. This could mean revealing personal data or credentials that could be exploited further—definitely not the dinner surprise anyone wants! Make sure to update your devices to the latest versions: watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6, or iPadOS 15.7.6. Regularly check for updates to Safari as well—keeping everything locked down is key! You’ve got this! Stay proactive with your updates, and you’ll keep that potential villain at bay! 🦸‍♂️

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.14292 · 96.6th percentile
Published
2023-06-23T00:00Z
KEV added
2023-05-22 · due 2023-06-12
EPSS history
Timeline
  • 23 JUN 00:00Z
    An out-of-bounds read was addressed with improved input validation
    cvelistv5
  • 22 MAY 00:00Z
    Added to CISA KEV — remediate by Jun 12
    kev