CVE-2023-43000
Summary
| CVE | CVE-2023-43000 |
|---|---|
| State | PUBLISHED |
| Assigner | apple |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2025-11-05 19:15:47 UTC |
| Updated | 2026-09-21 18:17:03 UTC |
| Description | A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption. |
Risk And Classification
Primary CVSS: v3.1 8.8 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS: 0.040420000 probability, percentile 0.905680000 (date 2026-10-21)
CISA KEV: Listed on 2026-03-05; due 2026-03-26; ransomware use Unknown
Problem Types: CWE-416 | Processing maliciously crafted web content may lead to memory corruption | CWE-416 CWE-416 Use After Free
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 8.8 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 3.1 | ADP | DECLARED | 8.8 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 8.8 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
RequiredScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA Known Exploited Vulnerability
| Vendor | Apple |
|---|---|
| Product | Multiple Products |
| Name | Apple Multiple products Use-After-Free Vulnerability |
| Required Action | Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. |
| Notes | https://support.apple.com/en-us/120324 ; https://support.apple.com/en-us/120331 ; https://support.apple.com/en-us/120338 ; https://nvd.nist.gov/vuln/detail/CVE-2023-43000 |
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Apple | MacOS | affected unspecified 13.5 custom | Not specified |
| CNA | Apple | IOS And IPadOS | affected unspecified 16.6 custom | Not specified |
| CNA | Apple | Safari | affected unspecified 16.6 custom | Not specified |
| CNA | Apple | IOS And IPadOS | affected unspecified 15.8.7 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| support.apple.com/en-us/120338 | [email protected] | support.apple.com | Release Notes, Vendor Advisory |
| support.apple.com/en-us/120331 | [email protected] | support.apple.com | Release Notes, Vendor Advisory |
| support.apple.com/en-us/126632 | [email protected] | support.apple.com | Release Notes, Vendor Advisory |
| support.apple.com/en-us/120324 | [email protected] | support.apple.com | Release Notes, Vendor Advisory |
| www.cisa.gov/known-exploited-vulnerabilities-catalog | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | www.cisa.gov | US Government Resource |
| cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | cloud.google.com | Exploit, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
| CISA Known Exploited Vulnerabilities catalog | CISA | www.cisa.gov | kev |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.