CVE-2023-32409
Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an unspecified vulnerability that can allow a remote attacker to break out of the Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
The issue was addressed with improved bounds checks. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.8 and iPadOS 15.7.8, Safari 16.5, iOS 16.5 and iPadOS 16.5. A remote attacker may be able to break out of Web Content sandbox. Apple is aware of a report that this issue may have been actively exploited.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N- support.apple.com/en-us/HT213757Vendor Advisory
- support.apple.com/en-us/HT213758Vendor Advisory
- support.apple.com/en-us/HT213761Vendor Advisory
- support.apple.com/en-us/HT213762Vendor Advisory
- support.apple.com/en-us/HT213764Vendor Advisory
- support.apple.com/en-us/HT213842Vendor Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-32409US Government Resource
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1232 days
- CVSS
- 8.6 HIGH
- EPSS (30-day exploit probability)
- 16.5% · top 3% of all CVEs
- Weakness
- NVD-CWE-noinfo
- Attack vector
- Network, remotely reachable
- Preconditions
- No privileges and no user interaction
- 1.Apply updates per vendor instructions.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.