CVE-2023-43000
high CISA KEVApple Multiple products Use-After-Free Vulnerability
Vendor / product: Apple — Multiple Products
A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption.
CVSS
8.8
8.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2025-11-05 19:15
Modified: 2026-10-28 19:10
NVD status: Analyzed
Last synced 9 hours ago
Verified against the source API 2026-10-28 19:26 UTC
Exploitation
Listed in CISA KEV
Added 2026-03-05 · due 2026-03-26
Known ransomware use: Unknown
Required action (CISA)
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected products
apple / safari <16.6
apple / ipados <15.8.7, ≥16.0 <16.6
apple / iphone_os <15.8.7, ≥16.0 <16.6
apple / macos <13.5
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: https://support.apple.com/en-us/120324
Vendor advisory: https://support.apple.com/en-us/120331
Vendor advisory: https://support.apple.com/en-us/120338
Vendor advisory: https://support.apple.com/en-us/126632
References
- https://support.apple.com/en-us/120324 product-security@apple.com
- https://support.apple.com/en-us/120331 product-security@apple.com
- https://support.apple.com/en-us/120338 product-security@apple.com
- https://support.apple.com/en-us/126632 product-security@apple.com
- https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit 134c704f-9b21-4f2e-91b3-4a467353bcc0
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-43000 134c704f-9b21-4f2e-91b3-4a467353bcc0
Data sources
CISA KEV — fetched 2026-10-27 06:50 UTC · record ↗
NVD CVE API 2.0 — fetched 2026-10-28 19:26 UTC · record ↗