PT-2025-45147 · Apple+4 · Ios+7

Published

2023-10-12

·

Updated

2026-03-10

·

CVE-2023-43000

CVSS v3.1
8.8
VectorAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Apple macOS versions prior to 13.5 Apple iOS versions prior to 16.6 Apple iPadOS versions prior to 16.6 Apple Safari versions prior to 16.6 WebKitGTK webkit2gtk in Debian Linux wpewebkit in Debian Linux webkit2gtk3 in SberLinux
Description A use-after-free issue exists due to improper memory management. Processing maliciously crafted web content may lead to memory corruption. Reports indicate this issue affects approximately 2 billion Apple devices and is currently being exploited. The vulnerability impacts multiple Apple products and WebKit-based browsers. The issue can be triggered by processing malicious web content, potentially leading to unauthorized access to data. The vulnerability is related to the handling of memory after it has been freed, which can allow an attacker to overwrite memory and execute arbitrary code.
Recommendations Update macOS to version 13.5 or later. Update iOS to version 16.6 or later. Update iPadOS to version 16.6 or later. Update Safari to version 16.6 or later. Upgrade webkit2gtk packages to version 2.42.1-1~deb11u2 for Debian's oldstable distribution (bullseye). Upgrade wpewebkit packages in Debian Linux. Upgrade webkit2gtk3 packages in SberLinux.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALSA-2025:22789
ALSA-2025:22790
CVE-2023-43000
DSA-5527-1
DSA-5527-2
RHSA-2024:2126
RHSA-2024:2982
RHSA-2024:8492
RHSA-2024:8496
RHSA-2024:9646
RHSA-2024:9653
RHSA-2024:9679
RHSA-2024:9680
RHSA-2025:10364

Affected Products

Almalinux
Centos
Debian
Red Hat
Safari
Ios
Ipados
Macos Ventura