CVE-2023-32435highunder attackCWE-787

CVE-2023-32435: high-severity vulnerability in Apple macOS

Published · Updated

Follow this CVE+ Monitor macOS+ Monitor iOS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

56Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 8.8epss 23%
from disclosure to weapon
Published on NVDJun 23
CISA KEVJun 23
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
2 products (9 components)
Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 6
workaround: This vulnerability can be mitigated by setting the environment variable JSC_useWebAssembly=0, which will disable support for WebAssembly. It's not necessary to set this environment variable if you're already using JavaScriptCoreUseJIT=0 to…
Fixed
4 products (116 components)
Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Enterprise Linux AppStream (v. 9) · Red Hat Enterprise Linux Server (v. 7 ELS) · Red Hat Enterprise Linux Server Optional (v. 7 ELS)
fix ↗
Action required by CISAfederal deadline: 2023-07-14

Apply updates per vendor instructions.

In short

A memory corruption vulnerability in Safari and iOS allows attackers to execute arbitrary code by processing specially crafted web content. This flaw was actively exploited in the wild before patches were released.

Technical detail

Out-of-bounds write vulnerability (CWE-787) in WebKit's content processing engine affecting Safari, iOS, and iPadOS. Exploitation requires processing untrusted web content; no user interaction beyond normal browsing is needed. Remote code execution is achievable with high privileges in the affected browser/OS context.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.7 and iPadOS 15.7.7. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Apple · iOS and iPadOSApple · macOSApple · Safari
Related CVEs — Apple macOS

In the same product, most dangerous first.

CVE-2021-30860HIGHCVE-2021-30860EPSS 76.0%KEVCVE-2021-30657MEDIUMCVE-2021-30657EPSS 68.5%KEVCVE-2025-43300CRITICALCVE-2025-43300EPSS 65.2%KEVCVE-2023-32434HIGHCVE-2023-32434EPSS 58.2%KEVCVE-2023-41064HIGHCVE-2023-41064EPSS 53.4%KEVCVE-2021-30807HIGHCVE-2021-30807EPSS 28.8%KEV