CVE-2023-43000: Apple Multiple Products use-after-free in Web Content processing

CVE-2023-43000 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2025-11-05

Apple macOS, iOS, and Safari are affected by a security flaw that allows attackers to compromise devices through malicious websites. By tricking a user into visiting a specially crafted webpage, an attacker could gain unauthorized access to sensitive data or take control of the device. This vulnerability has been exploited in the wild, making immediate updates critical for protecting personal and corporate information.

Technologies: Apple iPadOS, Apple macOS, Apple Multiple Products, Apple Safari. Vendors: Apple.

Quick answers

Is CVE-2023-43000 exploited in the wild?
Yes. CVE-2023-43000 is known to be exploited in the wild, first recorded on 5 March 2026. Treat it as urgent.
How severe is CVE-2023-43000?
Critical severity, with a CVSS score of 8.8, published 5 November 2025.
Which products and versions are affected?
Apple iPadOS before 16.6, before 15.8.7; Apple macOS before 13.5; Apple Safari before 16.6.
Is there a fix for CVE-2023-43000?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2023-43000 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2023-43000?
Check whether you run Apple iPadOS, Apple macOS, Apple Multiple Products or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free (UAF) vulnerability exists in multiple Apple operating systems and the Safari web browser due to improper memory management when processing web content. The flaw is triggered when a user visits a maliciously crafted website, allowing an attacker to cause memory corruption. This can be leveraged for remote code execution (RCE) on the target device. The vulnerability has been observed in active exploitation as part of an exploit kit. Apple has addressed the issue by improving memory management in macOS Ventura 13.5, iOS/iPadOS 16.6, Safari 16.6, and iOS/iPadOS 15.8.7.

Affected products

  • Apple macOS Ventura before 13.5
  • Apple iOS before 16.6, before 15.8.7
  • Apple iPadOS before 16.6, before 15.8.7
  • Apple Safari before 16.6

Timeline

  • 2025-11-05: disclosed: Initial CVE entry received from Apple
  • 2026-03-05: kev added: Added to CISA Known Exploited Vulnerabilities catalog
  • 2026-03-05: advisory: Public advisory published
  • 2026-03-05: exploited: Confirmed active exploitation in the wild

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.