CVE-2023-41993

Advisory lineage Upstream: 0 Downstream: 11
Analyzed
Published: 21 Sept 2023, 18:23
Last modified:04 Nov 2025, 19:21

Vulnerability Summary

Overall Risk (default)
medium
40/100
CVSS Score
8.8 HIGH
v3.1 (cve.org)
EPSS Score
24.89% HIGH
25% probability +3.19%
KEV
Listed
CISA
1 listing
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

21 Sept 2023, 18:23
Published
Vulnerability first disclosed
25 Sept 2023, 00:00
Added to CISA KEV
Apple Multiple Products WebKit Code Execution Vulnerability
16 Oct 2023, 00:00
CISA Remediation Due
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
04 Nov 2025, 19:21
Last Modified
Vulnerability information updated

Description

The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

CVSS Metrics

  • v3.1•HIGH•Score: 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 24.89%• Percentile: 96%

Techniques & Countermeasures

  • CWE-754•Improper Check for Unusual or Exceptional Conditions

    The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

Affected Systems

  • apple•ipados

    < 17.0.1

  • apple•iphone_os

    < 17.0.1

  • Unknown•macOS

    < 14.0 | ≥ unspecified, < 14

  • debian•debian_linux

    11.0 | 12.0

  • fedoraproject•fedora

    37 | 38 | 39

  • netapp•active_iq_unified_manager

    na

  • netapp•cloud_insights_acquisition_unit

    na

  • netapp•cloud_insights_storage_workload_security_agent

    na

  • netapp•oncommand_insight

    na

  • netapp•oncommand_workflow_automation

    na

  • oracle•graalvm

    20.3.13 | 21.3.9

  • oracle•jdk

    1.8.0:update401

  • oracle•jre

    1.8.0:update401

  • Unknown•WebKitGTK

    < 2.42.2

References (7)