CVE-2023-42917KEV · OVERDUE

Apple Multiple Products WebKit Memory Corruption Vulnerability

High · published November 30, 2023

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 95.4th percentile for exploit probability.

1034
days past CISA
deadline
CVSS v3.1
8.8
EPSS
9%
Percentile
95.4
In the wild
Confirmed
What it is

🚨 A crafty memory corruption vulnerability is lurking in web content, potentially allowing attackers to run arbitrary code on your devices! ⚡ Think of it like a hotel manager who accidentally hands out master keys to random guests — they can access any room without permission! If exploited, this flaw could let attackers gain unrestricted access to your system, messing with your data and privacy in absolutely devastating ways. Imagine malicious code running amok, all because of a sneaky flaw in how your devices handle web content!

Put simply

Think of it like a hotel manager who accidentally hands out master keys to random guests — they can access any room without permission! This vulnerability occurs due to improper locking mechanisms in memory management, allowing arbitrary code execution when processing web content on affected devices.

What to do

If exploited, this flaw could let attackers gain unrestricted access to your system, messing with your data and privacy in absolutely devastating ways. Imagine malicious code running amok, all because of a sneaky flaw in how your devices handle web content! Update your devices immediately to iOS 17.1.2 or iPadOS 17.1.2, and for Mac users, upgrade to macOS Sonoma 14.1.2 or Safari 17.1.2. Keeping your software up to date is your best defense against this kind of exploit! You've got this! Stay vigilant, keep your devices patched, and you'll be a security hero in no time! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.09295 · 95.4th percentile
Published
2023-11-30T22:18Z
KEV added
2023-12-04 · due 2023-12-25
EPSS history
Timeline
  • 04 DEC 00:00Z
    Added to CISA KEV — remediate by Dec 25
    kev
  • 30 NOV 22:18Z
    A memory corruption vulnerability was addressed with improved locking
    cvelistv5