Actively exploited in the wild
Apple Multiple Products WebKit Type Confusion Vulnerability
Apple - Multiple Products · Listed in the CISA KEV since 2023-06-23. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2023-32439
HighCVSS 8.8KEVSummary
A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, iOS 15.7.7 and iPadOS 15.7.7, macOS Ventura 13.4.1, Safari 16.5.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Risk Assessment
An attacker could remotely execute arbitrary code on the victim's device via malicious web content, potentially leading to full system compromise. The vulnerability is actively exploited.
Recommendation
Immediately update Apple systems to the latest versions (iOS 16.5.1, iPadOS 16.5.1, iOS 15.7.7, iPadOS 15.7.7, macOS Ventura 13.4.1, Safari 16.5.1). Avoid visiting untrusted websites.
Other vulnerabilities in Apple iOS, iPadOS, macOS, Safari
See all- CVE-2023-42917HighActively exploited
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2, iPadOS 17.1.2, macOS Sonoma 14.1.2, and Safari 17.1.2. Processing web content may lead to arbitrary code execution.
- CVE-2023-23529HighActively exploited
A type confusion issue was addressed with improved checks. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.3.1 and iPadOS 16.3.1, macOS Ventura 13.2.1, Safari 16.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
- CVE-2022-32893HighActively exploited
An out-of-bounds write issue in Apple systems was addressed with improved bounds checking. This affects iOS 15.6.1, iPadOS 15.6.1, macOS Monterey 12.5.1, and Safari 15.6.1. Processing malicious web content may lead to arbitrary code execution.
Original NVD description (English source)
A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, iOS 15.7.7 and iPadOS 15.7.7, macOS Ventura 13.4.1, Safari 16.5.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.