CVE-2023-41993highunder attackCWE-754

CVE-2023-41993: high-severity vulnerability in Apple macOS

Published · Updated

Follow this CVE+ Monitor macOS+ Monitor webkit2gtk

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

81Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 8.8epss 24%
from disclosure to weapon24 days
Published on NVDSep 21
1st PoC+24d
CISA KEV+4d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
2 products (9 components)
Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 6
no_fix_planned: Out of support scope
Fixed
4 products (116 components)
Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Enterprise Linux AppStream (v. 9) · Red Hat Enterprise Linux Server (v. 7 ELS) · Red Hat Enterprise Linux Server Optional (v. 7 ELS)
fix ↗
Action required by CISAfederal deadline: 2023-10-16

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

A flaw in how macOS and iOS process web content could allow attackers to execute arbitrary code on your device. This vulnerability was actively exploited in the wild before it was patched.

Technical detail

Improper input validation in web content processing (CWE-754) allows remote code execution through crafted web content. The vulnerability affects iOS versions prior to 16.7 and macOS before Sonoma 14, with evidence of active exploitation in the wild prior to patch availability.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Apple · macOS
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Apple macOS

In the same product, most dangerous first.

CVE-2021-30860HIGHCVE-2021-30860EPSS 76.0%KEVCVE-2021-30657MEDIUMCVE-2021-30657EPSS 68.5%KEVCVE-2025-43300CRITICALCVE-2025-43300EPSS 63.2%KEVCVE-2023-32434HIGHCVE-2023-32434EPSS 58.2%KEVCVE-2023-41064HIGHCVE-2023-41064EPSS 53.4%KEVCVE-2021-30807HIGHCVE-2021-30807EPSS 28.8%KEV