{"id":"CVE-2023-42916","kind":"vulnerability","aliases":["CVE-2023-42916"],"related":[],"title":"An out-of-bounds read was addressed with improved input validation","description":"Apple iOS, iPadOS, macOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.\n\nCISA required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","summary":"A WebKit out-of-bounds read in Apple iOS, iPadOS, macOS and Safari lets a crafted web page leak sensitive memory. CISA lists it as actively exploited in the wild.","severity":"high","cvss":6.5,"epss":null,"exploited":true,"exploited_at":"2023-12-04T00:00:00+00:00","products":[{"name":"Apple Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"apple safari","fixed":["17.1.2"],"affected":"< 17.1.2","ecosystem":"vendor"},{"name":"apple ipados","fixed":["15.8.1"],"affected":"< 15.8.1","ecosystem":"vendor"},{"name":"apple ipados","fixed":["16.7.3"],"affected":">= 16.0, < 16.7.3","ecosystem":"vendor"},{"name":"apple ipados","fixed":["17.1.2"],"affected":">= 17.0, < 17.1.2","ecosystem":"vendor"},{"name":"apple iphone os","fixed":["15.8.1"],"affected":"< 15.8.1","ecosystem":"vendor"},{"name":"apple iphone os","fixed":["16.7.3"],"affected":">= 16.0, < 16.7.3","ecosystem":"vendor"},{"name":"apple iphone os","fixed":["17.1.2"],"affected":">= 17.0, < 17.1.2","ecosystem":"vendor"},{"name":"apple macos","fixed":["14.1.2"],"affected":">= 14.0, < 14.1.2","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 38","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 39","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 11.0","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 12.0","ecosystem":"vendor"},{"name":"webkitgtk webkitgtk\\+","fixed":["2.42.3"],"affected":"< 2.42.3","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apple","exploited","ios","ipados","macos","safari","vendor","webkit"],"not_affected_if":["non-webkit-browser-only"],"how_to_check":null,"fix":"Update Apple devices to the patched iOS, iPadOS and macOS releases from Apple's security notes for this CVE; the sources do not name the exact versions.\nApply remediations per vendor instructions or discontinue use of the product if none are available, as CISA requires.","status":"open","published_at":"2023-11-30T23:15:07+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:02:45+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T21:02:45Z","model":"claude-haiku-5-5","output":{"fix":"Update Apple devices to the patched iOS, iPadOS and macOS releases from Apple's security notes for this CVE; the sources do not name the exact versions.\nApply remediations per vendor instructions or discontinue use of the product if none are available, as CISA requires.","reach":"internet","impact":"medium","summary":"A WebKit out-of-bounds read in Apple iOS, iPadOS, macOS and Safari lets a crafted web page leak sensitive memory. CISA lists it as actively exploited in the wild.","category":"vendor","who_cares":["apple","ios","ipados","macos","safari","webkit"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads sensitive process memory via crafted web content.","analyst_note":"Find the exact patched iOS, iPadOS, macOS and Safari versions in Apple's security releases page for CVE-2023-42916 and confirm the fixed build numbers.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["non-webkit-browser-only"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000492,"input_tokens":2897,"output_tokens":405,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2023':14A,17A '-42916':15A,18A 'action':146C 'activ':85B 'address':8A 'appl':51B,67B,90C,130C,135C 'apple':19A,22A,24A,26A,28A,30A,33A,36A,39A 'appli':147C 'bound':5A,64B,102C 'cisa':81B,144C 'contain':97C 'content':115C 'could':118C 'craft':75B,113C 'cve':13A,16A 'debian':45A,47A 'disclos':107C 'discontinu':155C 'exploit':52B,86B 'fedora':42A,44A 'fedoraproject':41A,43A 'html':120C,142C 'impact':119C 'improv':10A 'includ':125C 'inform':109C 'input':11A 'instruct':153C 'io':53B,68B,91C 'ipado':54B,69B,92C 'ipados':25A,27A,29A 'iphone':31A,34A,37A 'leak':78B 'let':73B 'limit':128C 'linux':46A,48A 'list':82B 'maco':55B,70B,93C 'macos':40A 'malici':112C 'may':106C 'memori':80B 'mitig':150C,163C 'multiple':20A 'non':134C 'non-appl':133C 'os':32A,35A,38A 'out-of-bound':2A,61B,99C 'page':77B 'parser':121C 'per':151C 'process':111C,143C 'product':136C,159C 'products':21A 'read':6A,65B,103C 'reli':138C 'remedi':148C,161C 'requir':145C 'safari':23A,56B,72B,95C,131C 'sensit':79B,108C 'unavail':165C 'use':123C,156C 'valid':12A 'vendor':57B,152C 'vulner':104C,117C 'web':76B,114C 'webkit':58B,60B,96C,124C,140C 'webkitgtk':49A,50A 'wild':89B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-11-30T23:15:07+00:00","kev":{"dateAdded":"2023-12-04","dueDate":"2023-12-25","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-42916","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-42916","severity":null,"published_at":"2023-12-04T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:23+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-42916","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42916","severity":null,"published_at":"2023-11-30T23:15:07+00:00","modified_at":"2026-06-17T06:24:49+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}