CVE-2023-28205

HIGH KEV

Apple Safari < 16.4.1 - Use After Free

Title source: rule

Description

A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 and iPadOS 15.7.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Exploits (2)

nomisec WORKING POC 17 stars

by ntfargo · client-side

https://github.com/ntfargo/uaf-2023-28205

View Code ZIP pw:eip

nomisec WRITEUP 4 stars

by seregonwar · client-side

https://github.com/seregonwar/uaf-2023-28205

View Code ZIP pw:eip

References (5)

[Release Notes] https://support.apple.com/en-us/HT213720

[Release Notes] https://support.apple.com/en-us/HT213721

[Release Notes] https://support.apple.com/en-us/HT213722

[Release Notes] https://support.apple.com/en-us/HT213723

[US Government Resource] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28205

Scores

CVSS v3 8.8

EPSS 0.0007

EPSS Percentile 20.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CISA KEV 2023-04-10

VulnCheck KEV 2023-04-07

InTheWild.io 2023-04-07

ENISA EUVD EUVD-2023-31913

CWE

CWE-416

Status published

Products (4)

apple/ipados < 15.7.5

apple/iphone_os < 15.7.5

apple/macos < 13.3.1

apple/safari < 16.4.1

Published Apr 10, 2023

KEV Added Apr 10, 2023

Tracked Since Feb 18, 2026