CVE-2023-42917: Apple Multiple Products WebKit Memory Corruption Vulnerability

CVE-2023-42917 is a memory corruption flaw in Apple’s WebKit engine that can allow code execution when a device processes maliciously crafted web content. It affects Apple iOS, iPadOS, macOS, and Safari, and can also impact other HTML parsers that rely on WebKit. For IT and security teams this matters because successful exploitation can give an attacker control of the affected process or device, so prompt inventory and remediation are essential.

Public detail is limited to the CISA summary and the CWE classification; exact version ranges, scores, and exploit mechanics must be confirmed against Apple’s vendor advisory.

How it works

The weakness is classified as CWE-787 (out-of-bounds write). In WebKit, this class of memory corruption occurs when the engine mishandles certain web content, writing data outside the intended memory bounds. An attacker who can deliver specially crafted web content—typically via a malicious webpage or embedded HTML—can trigger the corruption. If successful, the corruption can lead to arbitrary code execution in the context of the WebKit process. The same underlying engine is used by Safari and by some non-Apple products that embed WebKit for HTML processing, so the attack surface extends beyond pure Apple devices. No further exploit mechanics are provided in the available facts; defenders should treat any untrusted web content as a potential trigger and rely on the vendor advisory for technical depth.

Am I affected? How to find it in your systems

WebKit is present on Apple iOS, iPadOS, and macOS devices and in the Safari browser. It may also appear in third-party applications or appliances that embed WebKit for HTML rendering or parsing. Inventory steps include:

• Enumerate all managed Apple devices (iPhones, iPads, Macs) and record their OS and Safari versions via MDM, Apple Business Manager, or endpoint management tools.
• Identify any non-Apple products or custom applications that list WebKit or WebKitGTK as a dependency; check package inventories, SBOM data, or vendor documentation.
• Confirm the exact affected versions and configurations against Apple’s security advisory for CVE-2023-42917; do not rely on generic version lists.

Telemetry signs of possible exploitation are limited because the facts do not describe specific indicators. Monitor for unexpected WebKit or Safari process crashes, anomalous network connections originating from browser processes, or sudden privilege changes after web browsing. Correlate any such events with recent visits to untrusted sites. If your environment uses network proxies or secure web gateways, review their logs for requests that coincide with client-side crashes.

How to remediate

The primary action is to apply the remediations or mitigations published by Apple for the affected products. Follow the vendor instructions exactly; CISA’s required action is to apply those remediations or, if none are available, discontinue use of the product. After patching:

• Verify that the update has been successfully installed on every managed device through your MDM or inventory system.
• For third-party products that embed WebKit, obtain and apply the corresponding vendor update that addresses the same WebKit issue.
• Harden the browser environment by enabling available exploit mitigations (for example, site isolation or content security features) once the patched version is confirmed.

Document the patch deployment and retain evidence for compliance or incident-response purposes.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls:

• Segment devices that must remain on vulnerable versions; limit their ability to reach untrusted web content through network controls or proxy filtering.
• Deploy virtual patching or WAF rules that block known malicious web content patterns associated with WebKit memory-corruption attacks, if your security vendor supplies such signatures.
• Disable or restrict non-essential WebKit-dependent features and third-party applications that process untrusted HTML.
• Increase monitoring of browser and WebKit process activity, crash dumps, and outbound connections; alert on anomalies.
• Consider temporary policy that forces users to browse only through a fully patched remote browser isolation service if available.

These measures lower risk but do not eliminate it; schedule the official patch as soon as operationally feasible.

If your data may have been exposed

Actively exploited memory-corruption vulnerabilities can lead to device compromise and subsequent data exposure. Known ransomware use of this CVE is not documented in the available facts. If you suspect compromise, follow your incident-response plan: isolate affected systems, preserve forensic evidence, and rotate credentials that may have been accessible from the device. As an additional check, you can run a free exposure scan of your email addresses against known breach data sets to determine whether any associated accounts appear in public breach corpora.