CVE-2023-43000KEV · OVERDUECWE-416

Apple Multiple products Use-After-Free Vulnerability

High · published November 6, 2025

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 90.6th percentile for exploit probability.

212
days past CISA
deadline
CVSS v3.1
8.8
EPSS
4%
Percentile
90.6
In the wild
Confirmed
What it is

🚨 A crafty piece of web content could exploit this use-after-free vulnerability, potentially leading to memory corruption. 😱 Think of it like a hotel guest who mistakenly tries to access a room they’ve already checked out of — it can create confusion and chaos in the system, leading to disastrous consequences if not managed properly. An attacker could potentially craft malicious content that, when processed, causes instability in your system. This could lead to unauthorized access or crashing applications, which is absolutely devastating for users relying on these devices.

Put simply

Think of it like a hotel guest who mistakenly tries to access a room they’ve already checked out of — it can create confusion and chaos in the system, leading to disastrous consequences if not managed properly. This use-after-free vulnerability arises from improper memory management, allowing attackers to corrupt memory by processing specially crafted web content. The flaw affects multiple versions of macOS and iOS, making it a significant security concern.

What to do

An attacker could potentially craft malicious content that, when processed, causes instability in your system. This could lead to unauthorized access or crashing applications, which is absolutely devastating for users relying on these devices. Update your devices immediately to macOS Ventura 13.5, iOS 16.6, or the latest Safari 16.6. If you're on iOS 15 or iPadOS 15, ensure you upgrade to version 15.8.7 to patch this vulnerability. You've got this! Follow these steps and you'll be on your way to securing your devices in no time! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.04042 · 90.6th percentile
Weakness
CWE-416 · Use After Free
Published
2025-11-06T00:15Z
KEV added
2026-03-05 · due 2026-03-26
Affected products (6)
ProductVersionsFixed in
apple/safari< 16.616.6
apple/ipados< 15.8.715.8.7
apple/ipados≥ 16.0, < 16.616.6
apple/iphone_os< 15.8.715.8.7
apple/iphone_os≥ 16.0, < 16.616.6
apple/macos< 13.513.5
References (6)
EPSS history
Timeline
  • 05 MAR 00:00Z
    Added to CISA KEV — remediate by Mar 26
    kev
  • 05 NOV 18:33Z
    A use-after-free issue was addressed with improved memory management
    cvelistv5