CVE-2024-23222
Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
A type confusion issue was addressed with improved checks. This issue is fixed in Safari 17.3, iOS 15.8.7 and iPadOS 15.8.7, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.3, macOS Sonoma 14.3, macOS Ventura 13.6.4, tvOS 17.3, visionOS 1.0.2. Processing maliciously crafted web content may lead to arbitrary code execution. This fix associated with the Coruna exploit was shipped in iOS 17.3 on January 22, 2024. This update brings that fix to devices that cannot update to the latest iOS version.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H- support.apple.com/en-us/118479Release NotesVendor Advisory
- support.apple.com/en-us/120304Release NotesVendor Advisory
- support.apple.com/en-us/120305Release NotesVendor Advisory
- support.apple.com/en-us/120307Release NotesVendor Advisory
- support.apple.com/en-us/120309Release NotesVendor Advisory
- support.apple.com/en-us/120310Release NotesVendor Advisory
- support.apple.com/en-us/120311Release NotesVendor Advisory
- support.apple.com/en-us/120339Release NotesVendor Advisory
- support.apple.com/en-us/126632Release NotesVendor Advisory
- seclists.org/fulldisclosure/2024/Feb/6Third Party Advisory
- seclists.org/fulldisclosure/2024/Jan/34Third Party Advisory
- seclists.org/fulldisclosure/2024/Jan/40Third Party Advisory
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 987 days
- CVSS
- 8.8 HIGH
- EPSS (30-day exploit probability)
- 10.6% · top 4% of all CVEs
- Weakness
- CWE-843
- Attack vector
- Network, remotely reachable
- 1.Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.