CVE-2023-42916: Apple WebKit out-of-bounds read allows sensitive information disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with confirmed in-the-wild exploitation against iOS before 16.7.1, though the CVSS score is only 6.5 and impact is limited to information disclosure.

What it is

CVE-2023-42916 is an out-of-bounds read in Apple's WebKit engine caused by insufficient input validation. Processing web content can disclose sensitive information, and Apple states it is aware of a report that the issue may have been exploited against iOS versions before 16.7.1. It is fixed in iOS 17.1.2, iPadOS 17.1.2, macOS Sonoma 14.1.2 and Safari 17.1.2, with downstream fixes for Fedora, Debian and WebKitGTK.

Impact

An attacker can read memory beyond intended bounds and disclose sensitive information from the browser or system process. The CVSS vector shows high confidentiality impact with no integrity or availability impact.

Attack surface

Reached over the network by having a victim process malicious web content in a vulnerable WebKit-based browser or app. No privileges are required, but user interaction is required per the CVSS vector (UI:R).

Exploitation

Apple states the issue may have been exploited against iOS before 16.7.1, and CISA added it to KEV on 2023-12-04 with a 2023-12-25 remediation due date. EPSS 30-day probability is 0.17823 (97th percentile), and no ransomware campaign use is documented.

What to do

• Update to iOS 17.1.2, iPadOS 17.1.2, macOS Sonoma 14.1.2 or Safari 17.1.2 as applicable; older iOS devices should move to the latest available patched release.
• Apply vendor updates for Fedora, Debian and WebKitGTK packages that carry the WebKit fix.
• Prioritize patching internet-facing and user-facing Apple devices that browse untrusted web content.
• If immediate patching is not possible, restrict browsing of untrusted sites and enforce managed browser/OS update policies.
• Track the CISA KEV due date of 2023-12-25 for remediation reporting.

Detection

• Monitor for exploitation attempts against WebKit-based clients using updated endpoint or network signatures tied to CVE-2023-42916.
• Review web proxy and DNS logs for suspicious or newly registered domains delivering content to Apple devices.
• Check Apple device patch levels against iOS 17.1.2, iPadOS 17.1.2, macOS Sonoma 14.1.2 and Safari 17.1.2.
• Hunt for unusual process crashes or memory-related anomalies in Safari, WebKit or WebKitGTK processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.