CVE-2023-42916
Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability
Description
CVE-2023-42916 is an out-of-bounds read vulnerability in Apple's WebKit browser engine, rated MEDIUM with a CVSS score of 6.5. The flaw was resolved through improved input validation and affects all Apple platforms running Safari, iOS, iPadOS, and macOS prior to the December 2023 patch releases. Processing maliciously crafted web content can cause the WebKit engine to read memory beyond allocated buffer boundaries, potentially disclosing sensitive information from the process's memory space. Apple confirmed active exploitation of this vulnerability against iOS versions prior to iOS 16.7.1, making it a confirmed zero-day used in targeted attacks.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | safari | < 17.1.2 |
| apple | ipados | < 15.8.1; >= 16.0, < 16.7.3; >= 17.0, < 17.1.2 |
| apple | iphone os | < 15.8.1; >= 16.0, < 16.7.3; >= 17.0, < 17.1.2 |
| apple | macos | >= 14.0, < 14.1.2 |
| fedoraproject | fedora | 38; 39 |
| debian | debian linux | 11.0; 12.0 |
| webkitgtk | webkitgtk\+ | < 2.42.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
References
- http://seclists.org/fulldisclosure/2023/Dec/12(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2023/Dec/13(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2023/Dec/3(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2023/Dec/4(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2023/Dec/5(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2023/Dec/8(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2024/Jan/35(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2023/12/05/1(Mailing List, Third Party Advisory)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/AD2KIHHCUBQC2YYH3FJWAHI5BG3QETOH/(Mailing List)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/P5LQS6VEI7VIZNC7QGQ62EOV45R5RJIR/(Mailing List)
- https://security.gentoo.org/glsa/202401-04(Third Party Advisory)
- https://support.apple.com/en-us/HT214031(Vendor Advisory)
- https://support.apple.com/en-us/HT214032(Vendor Advisory)
- https://support.apple.com/en-us/HT214033(Vendor Advisory)
- https://support.apple.com/kb/HT214033(Vendor Advisory)
- https://support.apple.com/kb/HT214034(Vendor Advisory)
- https://support.apple.com/kb/HT214062(Vendor Advisory)
- https://www.debian.org/security/2023/dsa-5575(Mailing List)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-42916(US Government Resource)
Weakness Type
CWE-125: Out-of-Bounds Read
This vulnerability is classified under CWE-125: Out-of-Bounds Read, a memory safety weakness where software reads data past the end of an allocated buffer. In CVE-2023-42916, insufficient input validation in the WebKit rendering engine allows processing of crafted web content to trigger reads from memory locations outside of intended buffer boundaries. While out-of-bounds reads do not directly enable code execution (unlike out-of-bounds writes), they can expose sensitive data from process memory — including authentication tokens, encryption keys, or other session data — and can serve as a critical stepping stone in multi-stage exploitation chains alongside code execution vulnerabilities.
Impact Analysis
The vulnerability is rated MEDIUM severity with a CVSS score of 6.5, reflecting its high confidentiality impact while having no direct effect on integrity or availability. The attack vector is network-based with low complexity — an attacker simply needs a victim to visit or render malicious web content, requiring no prior authentication or elevated privileges. The scope remains unchanged (U), confining the impact to the WebKit process context. In practice, information disclosure vulnerabilities in browser engines can be more dangerous than their standalone CVSS score suggests: leaked memory contents can reveal ASLR layouts, enabling bypass of modern exploit mitigations and making them a valuable primitive in compound attack scenarios. Apple's confirmation of active exploitation reinforces that this vulnerability was paired with other exploits to achieve more significant outcomes on targeted devices.
Exploit Maturity
Apple confirmed that CVE-2023-42916 may have been exploited against iOS versions prior to 16.7.1. The vulnerability was disclosed simultaneously with CVE-2023-42917 (a WebKit memory corruption leading to code execution), strongly suggesting the two were used together as a chained exploit — the out-of-bounds read providing memory layout information to facilitate the code execution primitive. The EPSS score of 0.00047 (14th percentile) reflects low post-patch exploitation probability, consistent with the highly targeted nature of these WebKit zero-days. CISA's KEV listing with a December 25, 2023 deadline confirms its exploited status and mandates remediation for federal agencies.
Remediation
- Update all Apple devices: Install iOS 17.1.2 / iPadOS 17.1.2, macOS Sonoma 14.1.2, or Safari 17.1.2, which contain the input validation fix for CVE-2023-42916.
- Address legacy hardware: Devices incapable of running iOS 17 should be assessed for continued deployment in security-sensitive roles.
- Apply vendor guidance: Refer to Apple's official security advisories for platform-specific instructions.
- Patch WebKitGTK on Linux: Debian users should apply DSA-5575; Fedora users should apply the available package updates.
- Enforce minimum OS versions via MDM: Mobile Device Management policies should block operation of devices running unpatched OS versions.
- Treat as chained exploit risk: Given the simultaneous disclosure with CVE-2023-42917, ensure both vulnerabilities are addressed together — patching only one may not fully neutralize the attack chain.
Technical Details
CVE-2023-42916 is an out-of-bounds read in the WebKit browser engine, caused by insufficient input validation during the processing of web content. WebKit's rendering pipeline parses and executes complex web standards (HTML, CSS, JavaScript, SVG) and is a frequent target for memory safety attacks. When processing specially crafted web content, an input validation gap allows the engine to read beyond the boundaries of an allocated memory buffer (CWE-125), leaking data from adjacent memory regions. Apple's fix applied stricter bounds-checking and input sanitization to the affected code path. The CVSSv3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N reflects a network-delivered, low-complexity attack that impacts only confidentiality. CVE-2023-42916 was disclosed at the same time as CVE-2023-42917, and security researchers noted the two vulnerabilities were likely chained in the observed attacks — the information leak bypassing ASLR and the memory corruption enabling code execution. Affected platforms include Apple Safari, iOS, iPadOS, macOS, and WebKitGTK on Debian and Fedora Linux.
Frequently Asked Questions
Who is affected by CVE-2023-42916?
All users running Apple Safari, iOS, iPadOS, or macOS prior to the December 2023 patch releases (iOS/iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2) are affected. Users of WebKitGTK-based browsers on Debian and Fedora Linux without the relevant distribution patches are also vulnerable.
Was CVE-2023-42916 exploited in the wild?
Yes. Apple confirmed active exploitation against iOS versions prior to 16.7.1. The CISA KEV catalog includes this vulnerability with a remediation deadline of December 25, 2023. It was disclosed alongside CVE-2023-42917 and likely used in a chained exploit.
What data could an attacker access through this vulnerability?
An out-of-bounds read in WebKit can expose memory contents from the browser process, which may include sensitive information such as session tokens, authentication credentials, encryption key material, or data from other browser tabs processed within the same memory space.
Is this vulnerability less serious because it only discloses information?
While CVE-2023-42916 does not directly enable code execution, its real-world impact is significantly elevated by its use in attack chains. Information leaked from memory can bypass address space layout randomization (ASLR), a key exploit mitigation, enabling attackers to reliably weaponize companion code execution vulnerabilities like CVE-2023-42917. Organizations should treat this as a high-priority patch.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.