CVE-2023-43000
Apple Multiple products Use-After-Free Vulnerability
Description
CVE-2023-43000 is a HIGH severity use-after-free vulnerability (CWE-416) in Apple's WebKit browser engine that affects multiple Apple products. Processing maliciously crafted web content may lead to memory corruption, potentially enabling arbitrary code execution. The vulnerability was addressed with improved memory management in macOS Ventura 13.5, iOS 16.6, iPadOS 16.6, Safari 16.6, iOS 15.8.7, and iPadOS 15.8.7. With a CVSS 3.1 score of 8.8 and a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, the flaw is exploitable over the network with minimal complexity, requiring only that a user interact with malicious web content. CISA added CVE-2023-43000 to the Known Exploited Vulnerabilities catalog on March 5, 2026, with a remediation deadline of March 26, 2026. The EPSS score of 0.001 (0.1st percentile) is low, but the KEV listing confirms that targeted exploitation has been observed in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | safari | < 16.6 |
| apple | ipados | < 15.8.7; >= 16.0, < 16.6 |
| apple | iphone os | < 15.8.7; >= 16.0, < 16.6 |
| apple | macos | < 13.5 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://support.apple.com/en-us/120324(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/120331(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/120338(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/126632(Release Notes, Vendor Advisory)
- https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-43000(US Government Resource)
Weakness Type
CWE-416: Use After Free
Use After Free (CWE-416) is a memory corruption vulnerability class where a program continues to use a pointer after the memory it references has been freed. When memory is freed and then reallocated for a different purpose, the original pointer becomes a dangling reference. If the program subsequently reads from or writes to this pointer, it may access data belonging to a different object, corrupt memory structures, or execute arbitrary code depending on how the freed memory has been reused.
In CVE-2023-43000, the use-after-free condition exists within Apple's WebKit rendering engine, which processes HTML, CSS, JavaScript, and other web content in Safari and all iOS/iPadOS browsers. The vulnerability is triggered when WebKit processes specially crafted web content that causes an object in the rendering pipeline to be freed while still being referenced by another component. When the dangling pointer is subsequently accessed, the attacker can manipulate the freed memory region to achieve controlled memory corruption. Successful exploitation can lead to arbitrary code execution within the context of the browser process, potentially allowing the attacker to escape the browser sandbox depending on the specific exploitation chain employed.
Impact Analysis
CVE-2023-43000 carries a CVSS 3.1 base score of 8.8 (HIGH), reflecting significant impact across all three security dimensions when user interaction is achieved.
Confidentiality (High): Successful exploitation allows an attacker to execute arbitrary code within the browser process, which may provide access to cookies, session tokens, browsing history, cached credentials, and data from other open tabs or web applications. On iOS and iPadOS, where all browsers use the WebKit engine, the impact extends to any browser the user employs.
Integrity (High): Arbitrary code execution through the use-after-free allows an attacker to modify data within the browser process, inject content into web pages, manipulate web application state, and potentially install persistent malicious content. Depending on the exploitation chain, the attacker may be able to modify files accessible to the browser process.
Availability (High): Exploitation of the use-after-free at minimum causes the browser process to crash, disrupting the user's browsing session. More sophisticated exploitation that achieves code execution may consume system resources or interfere with other processes on the device.
Scope (Unchanged): The direct impact is contained within the browser process boundary. However, the memory corruption primitive provided by the use-after-free could potentially be chained with additional vulnerabilities to achieve sandbox escape and broader system compromise. The EPSS score of 0.001 suggests limited widespread exploitation, but the KEV listing indicates targeted use against specific individuals or organizations.
Exploit Maturity
Active Exploitation: CVE-2023-43000 is confirmed as actively exploited. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on March 5, 2026, with a federal remediation deadline of March 26, 2026. WebKit vulnerabilities are frequently used in targeted exploitation campaigns, particularly against high-value targets such as journalists, activists, and government officials.
Ransomware Association: CVE-2023-43000 is not typically associated with ransomware campaigns. WebKit use-after-free vulnerabilities are more commonly used in targeted surveillance operations and spyware deployment rather than mass-distribution ransomware attacks.
Public Exploits: Apple's security advisories confirm that this issue may have been actively exploited. Detailed technical exploitation information is typically limited in the public domain for WebKit vulnerabilities, though security researchers have published analyses of the underlying memory corruption mechanism.
EPSS Context: The EPSS score of 0.001 (0.1st percentile) indicates that broad automated exploitation is unlikely. However, this low score should not be interpreted as low risk, as WebKit vulnerabilities are frequently employed in highly targeted attacks where the EPSS model may underestimate exploitation probability.
KEV Deadline: The CISA remediation deadline is March 26, 2026. Users of affected Apple devices should update to the patched software versions immediately.
Remediation
-
Update to patched Apple software versions. Install macOS Ventura 13.5 or later, iOS 16.6 or later, iPadOS 16.6 or later, and Safari 16.6 or later on all affected devices. For older devices, install iOS 15.8.7 or iPadOS 15.8.7. Apply updates through the Settings app or Software Update mechanism on each device.
-
Enable automatic updates. Configure all Apple devices to automatically download and install security updates to ensure timely patching of future WebKit vulnerabilities. On iOS and iPadOS, enable Rapid Security Responses for critical patches that Apple delivers outside of regular update cycles.
-
Deploy mobile device management (MDM) for organizational devices. Use MDM solutions to enforce OS version minimums and push security updates to managed devices. Configure compliance policies that restrict access to corporate resources from devices running vulnerable software versions.
-
Implement web content filtering. Deploy network-level web content filtering to block access to known malicious domains and suspicious content. While this cannot prevent all exploitation attempts, it reduces the likelihood of users encountering weaponized web content.
-
Educate users about suspicious links. Since exploitation requires user interaction (visiting a malicious web page), train users to exercise caution with links from unknown sources, particularly in email, messaging apps, and social media. This is especially important for users who may be targeted by sophisticated threat actors.
-
Monitor for indicators of compromise. For organizations concerned about targeted exploitation, monitor devices for signs of compromise including unexpected crashes of Safari or WebKit-based processes, unusual network connections, and unexpected profile or certificate installations.
Technical Details
CVE-2023-43000 is a use-after-free vulnerability in Apple's WebKit rendering engine that powers Safari and all web browsers on iOS and iPadOS. The vulnerability occurs during the processing of specially crafted web content that triggers a sequence of operations causing an object in the WebKit rendering pipeline to be freed while a reference to it persists in another component.
The use-after-free condition arises when the WebKit layout or DOM manipulation engine deallocates a memory object as part of normal garbage collection or tree restructuring, but another component retains a pointer to the freed memory. When this dangling pointer is subsequently dereferenced during further processing of the web content, the program accesses memory that may have been reallocated for a different purpose. An attacker who controls the web content can influence what data occupies the freed memory region, enabling them to corrupt adjacent memory structures in a controlled manner.
The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects that the attack is delivered over the network (via a web page), has low complexity once the exploit is constructed, requires no authentication, but does require the user to navigate to or be redirected to the malicious content. The high impact across all three CIA dimensions reflects the arbitrary code execution capability that successful exploitation provides.
Apple addressed the vulnerability with improved memory management, likely by ensuring that references to objects are properly invalidated when the objects are freed, or by modifying the object lifecycle to prevent the specific sequence of operations that triggers the use-after-free condition. The fix was backported to iOS 15.8.7 and iPadOS 15.8.7, indicating that the vulnerable code path exists across multiple WebKit versions.
Frequently Asked Questions
What is CVE-2023-43000?
CVE-2023-43000 is a use-after-free memory corruption vulnerability in Apple's WebKit engine. When a user visits a maliciously crafted web page, the vulnerability can be triggered to corrupt memory and potentially execute arbitrary code in the browser process. It affects Safari, and all browsers on iOS and iPadOS since they all use the WebKit engine.
Which Apple products are affected?
The vulnerability affects macOS Ventura before version 13.5, iOS before version 16.6, iPadOS before version 16.6, Safari before version 16.6, and iOS/iPadOS 15.x before version 15.8.7. Since all browsers on iOS and iPadOS use WebKit as their rendering engine, all browsers on these platforms are affected, not just Safari.
How do I fix CVE-2023-43000?
Update your Apple devices to the latest available software versions. Install macOS Ventura 13.5 or later, iOS 16.6 or later, iPadOS 16.6 or later, or Safari 16.6 or later. For older devices still on iOS/iPadOS 15, update to version 15.8.7. Enable automatic updates to receive future security patches promptly.
Is CVE-2023-43000 being exploited in the wild?
Yes, CISA has added CVE-2023-43000 to its Known Exploited Vulnerabilities catalog, confirming active exploitation. WebKit vulnerabilities like this one are commonly used in targeted attacks against specific individuals rather than in broad automated campaigns. The low EPSS score of 0.001 reflects the targeted nature of exploitation rather than a low overall risk level.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.