CVE-2023-32373KEV · OVERDUE

Apple Multiple Products WebKit Use-After-Free Vulnerability

High · published June 23, 2023

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 96.2th percentile for exploit probability.

1230
days past CISA
deadline
CVSS v3.1
8.8
EPSS
12%
Percentile
96.2
In the wild
Confirmed
What it is

🚨 A crafty use-after-free issue in Apple’s software could allow an attacker to execute arbitrary code just by processing malicious web content! ⚡ Think of it like a restaurant that forgets to clear a table before seating new customers. If a dish left behind isn’t cleared properly, the new guests might end up getting a surprise they didn’t ask for! An attacker could potentially gain control of your device, leading to devastating consequences such as data theft, unauthorized changes, and total disruption of your device's normal functions. This vulnerability has reportedly already been exploited in the wild, making it crucial to act quickly!

Put simply

Think of it like a restaurant that forgets to clear a table before seating new customers. If a dish left behind isn’t cleared properly, the new guests might end up getting a surprise they didn’t ask for! This use-after-free vulnerability allows attackers to exploit memory management flaws, leading to the execution of arbitrary code when processing crafted web content. Essentially, it’s like a door that should be locked but is still left open for unwanted visitors!

What to do

An attacker could potentially gain control of your device, leading to devastating consequences such as data theft, unauthorized changes, and total disruption of your device's normal functions. This vulnerability has reportedly already been exploited in the wild, making it crucial to act quickly! Update your devices to the latest versions: watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6, iPadOS 15.7.6, and Safari 16.5. If you haven't already, enable automatic updates to ensure you're always protected against these sneaky vulnerabilities! You're on the right track! Follow these steps and you’ll keep your devices secure and sound. 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.12172 · 96.2th percentile
Published
2023-06-23T00:00Z
KEV added
2023-05-22 · due 2023-06-12
EPSS history
Timeline
  • 23 JUN 00:00Z
    A use-after-free issue was addressed with improved memory management
    cvelistv5
  • 22 MAY 00:00Z
    Added to CISA KEV — remediate by Jun 12
    kev