CVE-2023-32435
Apple Multiple Products WebKit Memory Corruption Vulnerability
Description
CVE-2023-32435 is a memory corruption vulnerability in Apple's WebKit browser engine that affects Safari, iOS, iPadOS, and macOS Ventura. The flaw, classified as an out-of-bounds write, allows an attacker to execute arbitrary code on a victim's device when the user processes specially crafted web content. Apple has acknowledged reports that CVE-2023-32435 may have been actively exploited against versions of iOS released before iOS 15.7, making this a confirmed zero-day vulnerability. CISA has added CVE-2023-32435 to its Known Exploited Vulnerabilities catalog, underscoring the urgency for organizations running Apple products to apply patches immediately.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | safari | < 16.4 |
| apple | ipados | < 15.7.7; >= 16.0, < 16.4 |
| apple | iphone os | < 15.7.7; >= 16.0, < 16.4 |
| apple | macos | >= 13.0, < 13.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://support.apple.com/en-us/HT213670(Vendor Advisory)
- https://support.apple.com/en-us/HT213671(Vendor Advisory)
- https://support.apple.com/en-us/HT213676(Vendor Advisory)
- https://support.apple.com/en-us/HT213811(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-32435(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
CWE-787 describes a vulnerability where software writes data past the boundaries of an allocated memory buffer. In the context of CVE-2023-32435, the WebKit rendering engine fails to properly manage memory state during web content processing, enabling an attacker to corrupt memory and achieve arbitrary code execution on affected Apple devices.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2023-32435 carries a CVSS score of 8.8 (High) severity under CVSS v3.1, reflecting substantial risk to affected systems. The vulnerability is remotely exploitable over the network, requiring no authentication or special privileges from the attacker. While user interaction is required (the victim must visit a malicious webpage or process crafted web content), the attack complexity is low, meaning no special conditions or preparation beyond delivering the payload are needed. Successful exploitation results in high impact across all three security dimensions: Confidentiality (High) means sensitive data on the device can be accessed or exfiltrated, Integrity (High) means system files and data can be modified, and Availability (High) means the device can be crashed or rendered inoperable. Given that Apple confirmed active exploitation against older iOS versions, organizations with unpatched Apple devices face a concrete and demonstrated threat.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-32435 in the wild by adding it to the Known Exploited Vulnerabilities (KEV) catalog, with a remediation deadline of July 14, 2023. Apple's own advisory acknowledges reports of exploitation targeting iOS versions prior to 15.7, indicating this was used as a zero-day in targeted attacks. Although no public proof-of-concept exploit code appears in the available references, the confirmed in-the-wild exploitation makes this a high-priority issue. The EPSS score of 0.42% places this vulnerability in the 61st percentile, suggesting that while broad opportunistic exploitation may be limited, targeted attacks leveraging this flaw have already been documented.
Remediation
- Apply vendor patches immediately as directed by CISA: update to macOS Ventura 13.3, Safari 16.4, iOS 16.4 / iPadOS 16.4, or iOS 15.7.7 / iPadOS 15.7.7, as referenced in Apple's security advisories (HT213670, HT213671, HT213676, HT213811).
- Prioritize devices running iOS versions prior to 15.7, as Apple has specifically confirmed exploitation against those versions. Ensure all managed Apple devices in the organization are enrolled in MDM and receiving updates.
- Restrict access to untrusted web content as an interim mitigation by enforcing web filtering or proxy-based URL controls that block known malicious domains and suspicious content delivery networks.
- Review device logs and endpoint detection telemetry for indicators of WebKit exploitation, such as unexpected Safari crashes, unusual process spawning from the WebKit sandbox, or anomalous network connections following web browsing activity.
- Implement defense-in-depth for memory corruption attacks by enabling all available platform security features, including Lockdown Mode on iOS for high-risk users, and ensuring that Automatic Updates are enabled across the device fleet.
Technical Details
CVE-2023-32435 originates from a memory corruption issue within Apple's WebKit engine, specifically an out-of-bounds write (CWE-787) triggered during the processing of web content. The vulnerability was caused by improper state management that allowed write operations to occur beyond the intended memory boundaries. Attack Vector (Network) indicates the vulnerability is exploitable remotely through a malicious webpage, and Attack Complexity (Low) confirms that exploitation does not require specialized conditions beyond delivering the crafted content to the victim. Privileges Required (None) and User Interaction (Required) together define the attack model: an unauthenticated attacker crafts web content that a user must visit, after which the memory corruption leads to arbitrary code execution within the context of the WebKit process. The Scope (Unchanged) metric indicates exploitation is confined to the vulnerable component's security authority, though achieving code execution in WebKit can still provide substantial control over the device depending on sandbox escape capabilities.
Frequently Asked Questions
Is CVE-2023-32435 being actively exploited?
Yes, CVE-2023-32435 has been confirmed as actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of July 14, 2023. Apple has acknowledged that this issue may have been exploited against iOS versions released before iOS 15.7.
What products are affected by CVE-2023-32435?
CVE-2023-32435 affects multiple Apple products including Safari, iOS, iPadOS, and macOS Ventura. Specifically, versions prior to macOS Ventura 13.3, Safari 16.4, iOS 16.4 / iPadOS 16.4, and iOS 15.7.7 / iPadOS 15.7.7 are vulnerable.
How do I fix CVE-2023-32435?
Update all affected Apple products to the patched versions: macOS Ventura 13.3, Safari 16.4, iOS 16.4 / iPadOS 16.4, or iOS 15.7.7 / iPadOS 15.7.7. Devices running iOS versions prior to 15.7 should be updated with the highest priority given confirmed exploitation against those versions.
How severe is CVE-2023-32435?
CVE-2023-32435 is rated as High severity with a CVSS score of 8.8 out of 10. The vulnerability allows remote arbitrary code execution through crafted web content, and its confirmed zero-day exploitation history elevates the practical risk beyond the numerical score alone.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.