CVE-2023-42916KEV · OVERDUE

Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability

Medium · published November 30, 2023

Patch now

The score understates this — it's already being exploited

CVSS calls it medium at 6.5. It is confirmed in active exploitation. It sits in the 97.2th percentile for exploit probability.

1035
days past CISA
deadline
CVSS v3.1
6.5
EPSS
18%
Percentile
97.2
In the wild
Confirmed
What it is

⚠️ An out-of-bounds read, and it’s throwing caution to the wind with sensitive data! Apple has patched this in the latest versions, but earlier iOS versions could be at risk. 🔥 Think of it like a restaurant where a waiter accidentally spills the secret recipe while handing over your dish. The secret sauce might just be on the table for anyone to see, making this slip-up a little too revealing! If an attacker exploits this vulnerability, they could potentially access sensitive information from affected devices—imagine someone reading your personal messages while you’re distracted. This could lead to unauthorized data exposure, putting your privacy on the line. Not ideal, right?

Put simply

Think of it like a restaurant where a waiter accidentally spills the secret recipe while handing over your dish. The secret sauce might just be on the table for anyone to see, making this slip-up a little too revealing! This out-of-bounds read vulnerability allows malicious web content to access parts of memory that should be off-limits, risking exposure of sensitive information. Apple has improved input validation to mitigate this issue in recent updates.

What to do

If an attacker exploits this vulnerability, they could potentially access sensitive information from affected devices—imagine someone reading your personal messages while you’re distracted. This could lead to unauthorized data exposure, putting your privacy on the line. Not ideal, right? To protect your devices, update to iOS 17.1.2, iPadOS 17.1.2, macOS Sonoma 14.1.2, and Safari 17.1.2 immediately. Make sure to enable automatic updates to stay secure! You've got this! Stay vigilant and keep those devices updated to secure your data! 🛡️

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.17823 · 97.2th percentile
Published
2023-11-30T22:18Z
KEV added
2023-12-04 · due 2023-12-25
EPSS history
Timeline
  • 04 DEC 00:00Z
    Added to CISA KEV — remediate by Dec 25
    kev
  • 30 NOV 22:18Z
    An out-of-bounds read was addressed with improved input validation
    cvelistv5