CVE-2023-23529

HIGH KEV

Safari < 16.3 - Remote Code Execution via Type Confusion

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2023-23529 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added February 14, 2023.

Description

A type confusion issue was addressed with improved checks. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.3.1 and iPadOS 16.3.1, macOS Ventura 13.2.1, Safari 16.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

References (5)

Core 5
Core References
Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT213633
Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT213635
Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT213638
Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT213673

Scores

CVSS v3 8.8
EPSS 0.0009
EPSS Percentile 26.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2023-02-14
VulnCheck KEV 2023-02-13
InTheWild.io 2023-02-13
ENISA EUVD EUVD-2023-27629
CWE
CWE-843
Status published
Products (4)
apple/ipados < 15.7.4
apple/iphone_os < 15.7.4
apple/macos 13.0 - 13.2.1
apple/safari < 16.3
Published Feb 27, 2023
KEV Added Feb 14, 2023
Tracked Since Feb 18, 2026