CVE-2023-41993: Apple WebKit improper check allows arbitrary code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe flaw allows remote code execution with no privileges required, is listed in CISA KEV with known active exploitation, and has a high EPSS score.

What it is

CVE-2023-41993 is a WebKit flaw where processing web content can lead to arbitrary code execution, addressed with improved checks. Apple states it is aware of a report that the issue may have been actively exploited against iOS versions before 16.7, making it a real-world risk for unpatched Apple devices and other WebKit-based software.

Impact

An attacker can execute arbitrary code in the context of the affected process, potentially gaining code execution on the target device. The CVSS vector indicates high confidentiality, integrity, and availability impact.

Attack surface

The vulnerability is reachable over the network via web content (AV:N) with no privileges required (PR:N), but it requires user interaction (UI:R), such as visiting a malicious or compromised web page. No authentication is needed to trigger the flaw.

Exploitation

CVE-2023-41993 is listed in CISA KEV with a due date of 2023-10-16, and EPSS shows a 30-day probability of 0.29179 (98th percentile), indicating active exploitation is known or strongly expected. No ransomware campaign use is documented.

What to do

• Apply vendor patches immediately, prioritizing Apple updates for iOS, iPadOS, and macOS (including macOS Sonoma 14) and WebKitGTK fixes for Linux distributions.
• Update other affected products listed by vendors such as Fedora, Debian, Oracle, and NetApp per their advisories.
• If patching is not immediately possible, follow CISA KEV required actions: apply vendor mitigations or discontinue use of the affected product.
• Restrict browsing to trusted sites and avoid clicking untrusted links until devices are patched.
• Monitor vendor advisories for updated fixes and re-check affected product versions.

Detection

• Hunt for exploitation attempts by monitoring web proxy or DNS logs for known malicious domains associated with WebKit exploits, though no specific indicators are provided in this record.
• On Apple endpoints, look for unexpected process creation or code execution originating from Safari, WebKit, or other web content processes.
• Review crash reports or anomalous behavior in WebKit-based applications that may indicate exploitation attempts.
• Track patch status of Apple devices and WebKitGTK installations to identify unpatched assets.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.