CVE-2023-32373
Apple Multiple Products WebKit Use-After-Free Vulnerability
Description
CVE-2023-32373 is a high-severity use-after-free vulnerability in Apple WebKit that affects Safari, iOS, iPadOS, macOS Ventura, tvOS, watchOS, and WebKitGTK+. The flaw stems from improper memory management when processing web content, which can allow an attacker to execute arbitrary code on the victim's device. Apple has confirmed that CVE-2023-32373 may have been actively exploited prior to the release of security updates in May 2023. CISA has listed this WebKit use-after-free vulnerability in its Known Exploited Vulnerabilities catalog, requiring federal agencies to remediate by June 12, 2023.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | safari | < 16.5 |
| apple | ipados | < 15.7.6; >= 16.0, < 16.5 |
| apple | iphone os | >= 15.0, < 15.7.6; >= 16.0, < 16.5 |
| apple | macos | < 13.4 |
| apple | tvos | < 16.5 |
| apple | watchos | < 9.5 |
| redhat | enterprise linux | 6.0; 7.0; 8.0; 9.0 |
| webkitgtk | webkitgtk\+ | < 2.42.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://security.gentoo.org/glsa/202401-04(Third Party Advisory)
- https://support.apple.com/en-us/HT213757(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT213758(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT213761(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT213762(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT213764(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT213765(Release Notes, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-32373(US Government Resource)
Weakness Type
CWE-416: Use After Free
In the context of CVE-2023-32373, Apple WebKit improperly manages memory during the processing of web content, resulting in a use-after-free condition where the engine accesses a memory region after it has been freed. An attacker can craft web content that triggers this dangling pointer access, potentially redirecting program execution to attacker-controlled code and achieving arbitrary code execution within the WebKit process.
Learn more: CWE-416 — Use After Free
Impact Analysis
CVE-2023-32373 carries a CVSS v3.1 score of 8.8 (High), reflecting the severe risk of arbitrary code execution through malicious web content. The vulnerability is remotely exploitable without physical access through the network, with low attack complexity and no authentication required. User interaction is required — the victim must visit a malicious website or process crafted web content. Upon successful exploitation, confidentiality, integrity, and availability impacts are all rated High, meaning an attacker achieves full code execution within the WebKit process, enabling them to read sensitive data, modify system state, and crash or take control of the application. Although the EPSS score of 0.018% suggests that widespread automated exploitation is limited, the vulnerability's confirmed use in targeted attacks and its power as a code execution primitive make it exceptionally dangerous. When combined with an information disclosure vulnerability like CVE-2023-28204 and a sandbox escape like CVE-2023-32409, CVE-2023-32373 can enable complete device compromise.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-32373 by adding it to the Known Exploited Vulnerabilities catalog, with a remediation deadline of June 12, 2023. Apple's advisory acknowledges that this use-after-free vulnerability may have been actively exploited before patches were available. Despite the low EPSS score of 0.018%, the confirmed in-the-wild exploitation indicates that sophisticated threat actors have weaponized this vulnerability in targeted campaigns. CVE-2023-32373 was patched alongside CVE-2023-28204 (an out-of-bounds read for information disclosure) and CVE-2023-32409 (a sandbox escape), strongly suggesting these three vulnerabilities were chained together in real-world attacks to achieve full device compromise — from initial information leak through code execution to sandbox escape.
Remediation
- Update all affected Apple and WebKitGTK+ platforms immediately as required by CISA's KEV directive. Apply the following updates: iOS 16.5/iPadOS 16.5 or later, iOS 15.7.6/iPadOS 15.7.6 or later for older devices, macOS Ventura 13.4 or later, Safari 16.5 or later, tvOS 16.5 or later, watchOS 9.5 or later, and WebKitGTK+ to the latest patched version. Linux distributions shipping WebKitGTK+ should also apply vendor patches (e.g., Gentoo GLSA 202401-04).
- Prioritize patch deployment via MDM to ensure all managed Apple devices receive the security updates rapidly. Enable automatic updates on all organizational devices and verify compliance through your device management console.
- Restrict exposure on unpatched devices by implementing web content filtering to block access to untrusted or unknown websites. Consider using browser isolation solutions that render web content in a separate environment, preventing use-after-free exploits from affecting the host device.
- Monitor for exploitation indicators by reviewing WebKit crash reports and device logs for signs of memory corruption, unexpected code execution, or process injection. Look for unusual network connections following browser activity that may indicate post-exploitation communication.
- Adopt memory-safe coding practices as a long-term mitigation strategy for applications processing untrusted web content. Ensure all memory allocations are properly tracked and freed objects are nullified to prevent dangling pointer access, consistent with CWE-416 remediation guidance.
Technical Details
CVE-2023-32373 exploits a use-after-free weakness (CWE-416) in Apple WebKit's memory management during web content processing. The vulnerability occurs when WebKit frees a memory object but retains a pointer to it, and subsequently accesses that freed memory region during further processing of crafted web content. An attacker can manipulate the heap to place controlled data at the freed memory location, causing the dangling pointer dereference to redirect execution flow to attacker-supplied code. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms that while user interaction is required (visiting a malicious page), the attack itself is low-complexity and yields full impact across confidentiality, integrity, and availability — consistent with arbitrary code execution. The fix involved improved memory management to ensure proper object lifecycle handling and prevent dangling pointer scenarios. This vulnerability affects the same WebKit engine shared across all Apple platforms, which is why the patch was released simultaneously for Safari, iOS, iPadOS, macOS, tvOS, and watchOS, as well as the open-source WebKitGTK+ used on Linux.
Frequently Asked Questions
Is CVE-2023-32373 being actively exploited?
Yes, CVE-2023-32373 has been actively exploited in targeted attacks. Apple confirmed that this issue may have been exploited prior to patch availability, and CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 12, 2023. It is believed to have been used as part of a multi-vulnerability exploit chain.
What products are affected by CVE-2023-32373?
CVE-2023-32373 affects Apple Safari (before 16.5), iOS (before 16.5 and 15.7.6), iPadOS (before 16.5 and 15.7.6), macOS Ventura (before 13.4), tvOS (before 16.5), watchOS (before 9.5), WebKitGTK+, and Red Hat Enterprise Linux (through its WebKitGTK+ packages).
How do I fix CVE-2023-32373?
Update all affected devices to the latest available versions: iOS/iPadOS 16.5+ or 15.7.6+, macOS Ventura 13.4+, Safari 16.5+, tvOS 16.5+, watchOS 9.5+, and WebKitGTK+ to the latest release. Linux users should apply distribution-specific patches. Deploy updates via MDM for managed devices.
How severe is CVE-2023-32373?
CVE-2023-32373 is rated High with a CVSS v3.1 score of 8.8 out of 10. It enables arbitrary code execution through malicious web content, requiring only that a user visit a crafted webpage. Combined with information disclosure and sandbox escape vulnerabilities patched in the same update cycle, it can enable complete device takeover.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.