CVE-2023-42916

As of 2025-10-23, CVE-2023-42916 is a CVSS 6.5 (MEDIUM-severity) vulnerability. CISA KEV-listed (known exploited). EPSS exploitation probability 0.0%. Threadlinqs Intelligence tracks 1 threat exploiting it.

Last updated: 2025-10-23

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.

CVSS v3 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-125

Exploitation status

CISA KEV-listed (known exploited)

Threats tracking this CVE

• Coruna iOS Exploit Kit — 23 Exploits Across 5 Chains Targeting iOS 13-17.2.1 (CVE-2021-30952, CVE-2023-41974, CVE-2023-43000 + 20 More) — CRITICAL

References

• http://seclists.org/fulldisclosure/2023/Dec/12
• http://seclists.org/fulldisclosure/2023/Dec/13
• http://seclists.org/fulldisclosure/2023/Dec/3
• http://seclists.org/fulldisclosure/2023/Dec/4
• http://seclists.org/fulldisclosure/2023/Dec/5
• http://seclists.org/fulldisclosure/2023/Dec/8
• http://seclists.org/fulldisclosure/2024/Jan/35
• http://www.openwall.com/lists/oss-security/2023/12/05/1
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AD2KIHHCUBQC2YYH3FJWAHI5BG3QETOH/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P5LQS6VEI7VIZNC7QGQ62EOV45R5RJIR/

← all vulnerabilities · Markdown version · Threadlinqs Intelligence

Enriched from CVE.org, NVD (this product uses the NVD API but is not endorsed or certified by the NVD), FIRST EPSS, CISA KEV, and GitHub Security Advisories.