CVE-2023-41993KEV · OVERDUE

Apple Multiple Products WebKit Code Execution Vulnerability

High · published September 21, 2023

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 97.9th percentile for exploit probability.

1105
days past CISA
deadline
CVSS v3.1
8.8
EPSS
24%
Percentile
97.9
In the wild
Confirmed
What it is

🚨 A crafty flaw in web content processing could allow attackers to run arbitrary code on your devices. That’s right, folks: it’s time to get your security shields up! ⚡ Think of this vulnerability as a restaurant with a sneaky waiter who checks off your order without reading it — you might end up with a dish you never wanted, or worse, something toxic! 🍽️ If exploited, an attacker could take full control of your device, siphoning off sensitive information, installing unwanted software, or even wiping your data entirely. It's not just a bad meal; it's a recipe for disaster! 🔥

Put simply

Think of this vulnerability as a restaurant with a sneaky waiter who checks off your order without reading it — you might end up with a dish you never wanted, or worse, something toxic! 🍽️ CVE-2023-41993 involves insufficient checks when processing web content, allowing arbitrary code execution on affected versions of macOS and iOS, particularly before iOS 16.7.

What to do

If exploited, an attacker could take full control of your device, siphoning off sensitive information, installing unwanted software, or even wiping your data entirely. It's not just a bad meal; it's a recipe for disaster! 🔥 Update your macOS to version 14 with the latest security patches immediately. If you're still running an older iOS version, consider upgrading it to 16.7 or later, and be vigilant against suspicious links or downloads. 🛡️ You’ve got this! Follow these steps to fortify your defenses and keep those pesky intruders out! 💪✨

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.24349 · 97.9th percentile
Published
2023-09-21T18:23Z
KEV added
2023-09-25 · due 2023-10-16
EPSS history
Timeline
  • 25 SEP 00:00Z
    Added to CISA KEV — remediate by Oct 16
    kev
  • 21 SEP 18:23Z
    The issue was addressed with improved checks
    cvelistv5