CVE-2023-42890

—

CVSS 3.1

8.8 high

EPSS

3%p87

Published

Dec 12, 2023 (Dec 12, 2023)

Modified

Jun 17, 2026

Description

The issue was addressed with improved memory handling. This issue is fixed in Safari 17.2, macOS Sonoma 14.2, watchOS 10.2, iOS 17.2 and iPadOS 17.2, tvOS 17.2. Processing web content may lead to arbitrary code execution.

Vendors: apple
Products: safari, ipados, iphone os, macos, tvos, watchos
Weakness: CWE-94
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (3.2%)

In the news2 stories

Apple Releases Security Updates to Patch Critical iOS and macOS Security Flaws

The Hacker NewsDec 15, 00:00 UTC · Dec 15, 2023Vulnerability in the wildCVE-2023-45866 CVE-2023-42890 CVE-2023-42883+2 CVEs1

Apple released iOS 17.2 to address a dozen of security flaws

Security AffairsDec 12, 08:13 UTC · Dec 12, 2023Exploit / PoC in the wildCVE-2023-42898 CVE-2023-42890 CVE-2023-42916+1 CVEs