CVE-2023-42916: Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability

CVE-2023-42916 is an out-of-bounds read vulnerability in WebKit that affects multiple Apple products, including iOS, iPadOS, macOS, and Safari. When WebKit processes maliciously crafted web content, the flaw can allow disclosure of sensitive information. It can also affect other HTML parsers that rely on WebKit, not only Apple Safari. For IT and security teams this matters because WebKit is a common rendering engine; exposure can occur simply by loading untrusted web content on managed devices or in applications that embed it.

CISA directs organizations to apply remediations or mitigations per vendor instructions, or to discontinue use of the product if neither is available. Known ransomware use is not documented for this CVE.

How it works

The weakness is classified as CWE-125, an out-of-bounds read. In this class of flaw, software reads data past the end (or before the start) of an allocated buffer. In WebKit, the trigger is processing of specially crafted web content. An attacker who can cause a vulnerable instance of WebKit to parse that content may obtain information that should not have been accessible, such as data from adjacent memory. The CISA summary states that the result may be disclosure of sensitive information. Exact exploit mechanics, memory layouts, or required content formats are not provided in the available facts and must be confirmed against the vendor advisory; defenders should treat any untrusted web content as a potential vector for this class of issue.

Am I affected? How to find it in your systems

The vulnerability is present in Apple iOS, iPadOS, macOS, and Safari WebKit, and can impact other products that use WebKit for HTML processing. Typical locations include Apple-managed endpoints (phones, tablets, laptops, desktops), Safari browsers, and any third-party applications or services that embed WebKit for rendering or parsing HTML.

• Inventory all Apple devices and record their OS and Safari versions; also identify non-Apple software that declares WebKit as a dependency or rendering engine.
• Compare installed versions and configurations against the vendor advisory for CVE-2023-42916; do not rely on version numbers or build identifiers that are not listed in that advisory.
• Review web-proxy, browser, and endpoint telemetry for processing of untrusted or anomalous web content, especially content that coincides with unexpected information disclosure or process crashes in WebKit-related components. Public detail on specific log signatures is limited, so treat any unexplained WebKit activity involving external content as worth investigation.

How to remediate

Patch first. Apply the remediations or updates supplied by Apple (or by the vendor of any non-Apple product that embeds the affected WebKit) exactly as described in the official advisory. Confirm successful installation through your patch-management or MDM tooling and re-inventory the environment afterward.

After patching, apply standard hardening for this class of vulnerability:

• Keep all WebKit-dependent software on a supported, regularly updated release train.
• Restrict the ability of untrusted users or processes to load arbitrary web content where operationally feasible.
• Enforce least-privilege execution for browser and rendering processes so that any residual information disclosure has limited impact.

If remediations or mitigations are unavailable, CISA guidance is to discontinue use of the product.

If you can't patch immediately

Until the vendor update can be applied, reduce risk with compensating controls appropriate to an out-of-bounds-read issue in a web-content parser:

• Network segmentation and egress filtering to limit which devices can reach untrusted web content.
• Virtual patching or WAF rules that block or sanitize known malicious web-content patterns associated with WebKit issues (validate any signatures against current threat intelligence and the vendor advisory).
• Temporary disabling of non-essential WebKit-based features or browsers on high-value systems.
• Heightened monitoring of WebKit processes, browser crash reports, and anomalous memory or information-disclosure indicators, with alerts routed to the security operations team.

These measures lower exposure but do not eliminate the underlying flaw; schedule the official remediation as soon as possible.

If your data may have been exposed

Vulnerabilities that allow sensitive-information disclosure through crafted web content can contribute to broader compromise if an attacker obtains credentials, tokens, or other secrets. Known ransomware use is not documented for this CVE, yet any confirmed exploitation should be treated as a potential breach. Review affected systems for unauthorized access, rotate exposed credentials, and examine logs for related activity. Readers can also run a free exposure scan of their email addresses against known breach data sets to determine whether those addresses appear in previously disclosed incidents.