8.8

CVE-2023-41993: Apple Multiple Products WebKit Code Execution Vulnerability

CVSS: 8.8v3.1HighKEVAnalyzed
AliasesUBUNTU-CVE-2023-41993DEBIAN-CVE-2023-41993CGA-386c-jfqf-wgqv
Published 21-09-2023Last modified 04-11-2025
Open JSON

Vulnerability summary

CVE-2023-41993 is a high (CVSS 8.8) vulnerability in Apple Multiple Products. It is known to be exploited: CISA lists it, first on 25-09-2023. EPSS estimates a 24.35% chance of exploitation in the next 30 days, higher than 97.8% of scored vulnerabilities.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.1 (CVE.org)
EPSS score
24.35%
0%100%
High · -4.83 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 10 · Related 11
DSA-5527-1MGASA-2024-0148RHSA-2023:4201RHSA-2023:4202RHSA-2025:10364SUSE-SU-2023:4209-1

Timeline

  1. 21-09-2023
    PublishedVulnerability first disclosed.
  2. 25-09-2023
    Added to CISA KEVApple Multiple Products WebKit Code Execution Vulnerability
  3. 16-10-2023
    CISA remediation dueApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
  4. 04-11-2025
    Last modifiedVulnerability information updated.

Description

The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

CVSS metrics

6 scores · 6 sources · 1 version

EPSS trend

Probability

24.35%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

-4.83 pp

From 29.18% on 18-09-2026

18-09-202618-10-2026
EPSS score
24.35%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
25-09-2023
Federal due date
16-10-2023

CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. nvd.nist.gov/vuln/detail/CVE-2023-41993

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard45 products
  • openjdk-11-openj9All versions (No fix recorded)
  • openjdk-11-openj9-dbgAll versions (No fix recorded)
  • openjdk-11-openj9-default-jdkAll versions (No fix recorded)
  • openjdk-11-openj9-default-jvmAll versions (No fix recorded)
  • openjdk-11-openj9-default-policyAll versions (No fix recorded)
Wolfi8 products
  • openjdk-7All versions (No fix recorded)
  • openjdk-8< 8.482-r8
  • openjdk-8-dbg< 8.482-r8
  • openjdk-8-default-jdk< 8.482-r8
  • openjdk-8-default-jvm< 8.482-r8
Netapp5 products
Ubuntu5 products
  • qtwebkit-opensource-srcAll versions (No fix recorded)
  • qtwebkit-sourceAll versions (No fix recorded)
  • webkit2gtkAll versions (No fix recorded) | < 2.42.1-0ubuntu0.22.04.1
  • webkitgtkAll versions (No fix recorded)
  • wpewebkitAll versions (No fix recorded)
Apple3 products
Debian3 products
  • webkit2gtk< 2.42.1-1~deb12u1 | < 2.42.1-1
  • wpewebkitAll versions (No fix recorded) | < 2.42.1-1
  • debian_linuxEOL11.0 | 12.0
Oracle3 products
Fedoraproject1 product
Webkitgtk1 product

9 vendors · 74 products

References

13 links
Show all 13 references