CVE-2023-32435 Details
Description
A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.7 and iPadOS 15.7.7. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.
A memory corruption vulnerability has been identified in the WebKit component of multiple Apple products, including macOS Ventura, iOS 16.4, iPadOS 16.4, and iOS 15.7.7 and iPadOS 15.7.7. This vulnerability arises from improper state management when processing web content, which may lead to arbitrary code execution. Notably, there are reports suggesting that this issue may have been actively exploited in the wild on certain versions of iOS prior to 15.7.
Users can update to the latest versions of macOS Ventura, iOS 16.4, iPadOS 16.4, iOS 15.7.7, and iPadOS 15.7.7 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 27, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-32435 | CISA-ADP | US Government Resource |
| https://support.apple.com/en-us/HT213670 | CVE | Vendor Advisory |
| https://support.apple.com/en-us/HT213671 | CVE | Vendor Advisory |
| https://support.apple.com/en-us/HT213676 | CVE | Vendor Advisory |
| https://support.apple.com/en-us/HT213811 | CVE | Vendor Advisory |
| https://support.apple.com/en-us/HT213670 | [email protected] | Vendor Advisory |
| https://support.apple.com/en-us/HT213671 | [email protected] | Vendor Advisory |
| https://support.apple.com/en-us/HT213676 | [email protected] | Vendor Advisory |
| https://support.apple.com/en-us/HT213811 | [email protected] | Vendor Advisory |
This CVE is in CISA's Known Exploited Vulnerabilities Catalog
Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.
| Vulnerability Name | Date Added | Due Date | Required Action |
|---|---|---|---|
| Apple Multiple Products WebKit Memory Corruption Vulnerability | Jun 23, 2023 | Jul 14, 2023 | Apply updates per vendor instructions. |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
| CWE-787 | Out-of-bounds Write | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| apple safari | < 16.4 |
CPE
Remediation
| |
| apple ipados | < 15.7.7 >= 16.0, < 16.4 |
CPE
Remediation
| |
| apple iphone os | < 15.7.7 >= 16.0, < 16.4 |
CPE
Remediation
| |
| apple macos | >= 13.0, < 13.3 |
CPE
Remediation
| |
Change History
17 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Oct 23, 2025 | Modified Analysis | [email protected] |
| Oct 21, 2025 | CVE Modified | CISA-ADP |
| Oct 21, 2025 | CVE Modified | CISA-ADP |
| Oct 21, 2025 | CVE Modified | CISA-ADP |
| Dec 20, 2024 | Modified Analysis | [email protected] |
| Dec 16, 2024 | CVE Modified | CISA-ADP |
| Nov 21, 2024 | CVE Modified | CVE |
| Jun 27, 2024 | Modified Analysis | [email protected] |
| May 14, 2024 | CVE Modified | [email protected] |
| Jul 27, 2023 | CVE Modified | [email protected] |
| Jul 27, 2023 | CVE Modified | [email protected] |
| Jul 26, 2023 | CVE Modified | [email protected] |
| Jul 7, 2023 | CVE Modified | [email protected] |
| Jun 30, 2023 | Initial Analysis | [email protected] |
| Jun 29, 2023 | CVE Modified | [email protected] |