CVE-2023-41074
HighCVSS 8.8Exploitation Probability (EPSS)
Very high risk90th percentile - higher than 90% of all known CVEs
Summary
The issue was addressed with improved checks. This issue is fixed in tvOS 17, Safari 17, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may lead to arbitrary code execution.
Risk Assessment
Processing malicious web content could allow an attacker to execute arbitrary code on the device, potentially leading to full system compromise and user data exposure.
Recommendation
Update Apple operating systems to the latest versions (iOS 17, iPadOS 17, macOS Sonoma 14, tvOS 17, watchOS 10) and Safari to version 17.
Other vulnerabilities in Apple WebKit
See all- CVE-2023-32435HighActively exploited
A memory corruption issue was addressed with improved state management. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.
- CVE-2023-32409HighActively exploited
The issue was addressed with improved bounds checks. A remote attacker may be able to break out of Web Content sandbox. Apple is aware of a report that this issue may have been actively exploited.
- CVE-2023-32373HighActively exploited
A use-after-free issue was addressed with improved memory management. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
- CVE-2021-1789HighActively exploited
A type confusion issue exists in Apple products (macOS, iOS, iPadOS, watchOS, tvOS, Safari) due to improper state handling. Processing maliciously crafted web content may lead to arbitrary code execution.
- CVE-2025-43531Low
A race condition was addressed with improved state handling. Processing maliciously crafted web content may lead to an unexpected process crash.
Original NVD description (English source)
The issue was addressed with improved checks. This issue is fixed in tvOS 17, Safari 17, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may lead to arbitrary code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS