CVE-2023-32373: high-severity vulnerability in Apple watchOS
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply updates per vendor instructions.
A memory management flaw in Apple's software allows attackers to execute arbitrary code by crafting malicious web content. This vulnerability has been actively exploited in the wild, making it a serious security risk.
Use-after-free vulnerability (CWE-416) in memory management affecting Safari and Apple OS kernels. An attacker can craft malicious web content that triggers access to freed memory, leading to arbitrary code execution. The vulnerability affects iOS, iPadOS, macOS, tvOS, and watchOS with CVSS 8.8 severity and evidence of active exploitation.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.