{"id":"CVE-2023-32435","kind":"vulnerability","aliases":["CVE-2023-32435"],"related":[],"title":"A memory corruption issue was addressed with improved state management","description":"Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.\n\nCISA required action: Apply updates per vendor instructions.","summary":"A memory corruption flaw in Apple's WebKit engine lets a malicious web page run code when it is processed by Safari or any app that uses WebKit to render HTML. CISA lists it as actively exploited in the wild.","severity":"critical","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2023-06-23T00:00:00+00:00","products":[{"name":"Apple Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"apple safari","fixed":["16.4"],"affected":"< 16.4","ecosystem":"vendor"},{"name":"apple ipados","fixed":["15.7.7"],"affected":"< 15.7.7","ecosystem":"vendor"},{"name":"apple ipados","fixed":["16.4"],"affected":">= 16.0, < 16.4","ecosystem":"vendor"},{"name":"apple iphone os","fixed":["15.7.7"],"affected":"< 15.7.7","ecosystem":"vendor"},{"name":"apple iphone os","fixed":["16.4"],"affected":">= 16.0, < 16.4","ecosystem":"vendor"},{"name":"apple macos","fixed":["13.3"],"affected":">= 13.0, < 13.3","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","ios","ipados","macos","safari","vendor","webkit"],"not_affected_if":["fully-patched-devices"],"how_to_check":null,"fix":"Update iOS, iPadOS and macOS to a current Apple release that includes the WebKit fix; the sources do not name the fixed build numbers.","status":"open","published_at":"2023-06-23T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:06:32+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T21:06:32Z","model":"claude-haiku-5-5","output":{"fix":"Update iOS, iPadOS and macOS to a current Apple release that includes the WebKit fix; the sources do not name the fixed build numbers.","reach":"internet","impact":"high","summary":"A memory corruption flaw in Apple's WebKit engine lets a malicious web page run code when it is processed by Safari or any app that uses WebKit to render HTML. CISA lists it as actively exploited in the wild.","category":"vendor","who_cares":["ios","ipados","macos","safari","webkit"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs code on the device via a crafted web page","analyst_note":"Find the Apple security advisory for CVE-2023-32435 to get the exact fixed iOS, iPadOS and macOS versions and check which non-Apple WebKit embedders need updates.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["fully-patched-devices"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000469,"input_tokens":2858,"output_tokens":366,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2023':12A,15A '-32435':13A,16A 'action':134C 'activ':76B 'address':6A 'app':65B 'appl':46B,81C,118C,123C 'apple':17A,20A,22A,24A,26A,29A,32A 'appli':135C 'cisa':72B,132C 'code':56B,96C 'contain':88C 'content':103C 'corrupt':3A,43B,91C 'could':106C 'craft':101C 'cve':11A,14A 'engin':49B 'execut':97C 'exploit':34B,77B 'flaw':44B 'html':71B,108C,130C 'impact':107C 'improv':8A 'includ':113C 'instruct':139C 'io':35B,82C 'ipado':36B,83C 'ipados':23A,25A 'iphone':27A,30A 'issu':4A 'lead':94C 'let':50B 'limit':116C 'list':73B 'maco':37B,84C 'macos':33A 'malici':52B,100C 'manag':10A 'memori':2A,42B,90C 'multiple':18A 'non':122C 'non-appl':121C 'os':28A,31A 'page':54B 'parser':109C 'per':137C 'process':60B,99C,131C 'product':124C 'products':19A 'reli':126C 'render':70B 'requir':133C 'run':55B 'safari':21A,38B,62B,86C,119C 'state':9A 'updat':136C 'use':67B,111C 'vendor':39B,138C 'vulner':92C,105C 'web':53B,102C 'webkit':40B,48B,68B,87C,112C,128C 'wild':80B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-06-23T00:00:00+00:00","kev":{"dateAdded":"2023-06-23","dueDate":"2023-07-14","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-32435","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32435","severity":null,"published_at":"2023-06-23T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T15:39:41+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-32435","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32435","severity":null,"published_at":"2023-06-23T18:15:13+00:00","modified_at":"2026-06-17T05:58:50+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}