CVE-2023-43000
8.8 high
KEV · due 2026-03-26
SSVC exploitation: active
Analyzed
A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption.
Fix
CISA KEV required action · due 2026-03-26
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Added to the catalog 2026-03-05. CISA KEV
Patch, vendor advisory and mitigation references on NVD 4
- https://support.apple.com/en-us/120324 Release Notes, Vendor Advisory
- https://support.apple.com/en-us/120331 Release Notes, Vendor Advisory
- https://support.apple.com/en-us/120338 Release Notes, Vendor Advisory
- https://support.apple.com/en-us/126632 Release Notes, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.8 · in KEV · appleNVD modified 2026-10-28 19:10
Affected (CPE criteria) 4
cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
References 6
- https://support.apple.com/en-us/120324 Release Notes, Vendor Advisory
- https://support.apple.com/en-us/120331 Release Notes, Vendor Advisory
- https://support.apple.com/en-us/120338 Release Notes, Vendor Advisory
- https://support.apple.com/en-us/126632 Release Notes, Vendor Advisory
- https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit Exploit, Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-43000 US Government Resource