CVE-2023-43000
Apple Multiple Products: Use-After-Free
As of , CVE-2023-43000 in Apple Multiple Products is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch soon.
- Exploited
- Yes: CISA listed it on 5 March 2026
- US federal deadline
- 26 March 202621 days after CISA listed it. US federal civilian agencies must fix it by then.
- Used in ransomware campaigns
- Not known to CISA
- EPSS score
- 0.04Higher than 90% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
- Public exploit
- None foundNeither Metasploit nor Exploit-DB lists one.
- Fix
- Vendor advice: support.apple.comLinks below, from CISA's entry.
What CISA says to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA's required action
What the flaw is
Apple macOS, iOS, iPadOS, and Safari 16.6 contain a use-after-free vulnerability due to the processing of maliciously crafted web content that may lead to memory corruption.
CISA's description
A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption.
The CVE record's description, from apple
- CVE published
- 5 November 2025
- Assigned by
- apple
- CVSS
- 8.8 High (CVSS 3.1, from CISA-ADP)
- CWE-416
- Use After Free
- CISA SSVC, exploitation
- active
- CISA SSVC, automatable
- no
- CISA SSVC, technical impact
- total
Timeline
- The CVE record was published.
- CISA added it to its list of exploited vulnerabilities.
- The US federal deadline to fix it.
Multiple Products: other exploited entries
| Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|
| CVE-2026-86950Out-of-Bounds Write | Apple Multiple Products | Patch nowForensic triage required by CISA; listed in the last 14 days | 0.01 | ||
| CVE-2021-30860Integer Overflow | Apple Multiple Products | Patch this weekEPSS 0.76 | 0.76 | ||
| CVE-2023-32434Integer Overflow | Apple Multiple Products | Patch this weekEPSS 0.52 | 0.52 | ||
| CVE-2019-8605Use-After-Free | Apple Multiple Products | Patch soonVerified Exploit-DB entry | 0.18 | ||
| CVE-2020-3837Memory Corruption | Apple Multiple Products | Patch soonVerified Exploit-DB entry | 0.15 | ||
| CVE-2019-8506Type Confusion | Apple Multiple Products | Patch soonVerified Exploit-DB entry | 0.16 | ||
| CVE-2023-28205WebKit Use-After-Free | Apple Multiple Products | Patch soon | 0.27 | ||
| CVE-2021-30807Memory Corruption | Apple Multiple Products | Patch soon | 0.29 | ||
| CVE-2025-31200Memory Corruption | Apple Multiple Products | Patch soon | 0.19 | ||
| CVE-2025-24085Use-After-Free | Apple Multiple Products | Patch soon | 0.18 |
Read further
- CVE recordcve.org
- NVD entrynvd.nist.gov
- CISA's catalogcisa.gov
- EPSS for this CVEapi.first.org