CVE-2023-32402

MEDIUM EXPLOITED

Safari < 16.5 - Out-of-bounds Read via Web Content Processing

Title source: llm

Exploitation Summary

CVE-2023-32402 has been observed exploited in the wild (reported by VulnCheck KEV).

Description

An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing web content may disclose sensitive information.

References (5)

Core 5

Core References

Release Notes, Vendor Advisory

https://support.apple.com/en-us/HT213757

Release Notes, Vendor Advisory

https://support.apple.com/en-us/HT213758

Release Notes, Vendor Advisory

https://support.apple.com/en-us/HT213761

Release Notes, Vendor Advisory

https://support.apple.com/en-us/HT213762

Release Notes, Vendor Advisory

https://support.apple.com/en-us/HT213764

Scores

CVSS v3 6.5

EPSS 0.0072

EPSS Percentile 49.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

VulnCheck KEV 2023-05-18

CWE

CWE-125

Status published

Products (6)

apple/ipados 16.0 - 16.5

apple/iphone_os 16.0 - 16.5

apple/macos 13.0 - 13.4

apple/safari < 16.5

apple/tvos < 16.5

apple/watchos < 9.5

Published Jun 23, 2023

Tracked Since Feb 18, 2026