CVE-2023-43000

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Oct 28, 2026

Description

A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Apple	macOS	>= unspecified, < 13.5
Apple	iOS and iPadOS	>= unspecified, < 16.6
Apple	Safari	>= unspecified, < 16.6
Apple	iOS and iPadOS	>= unspecified, < 15.8.7

References

https://support.apple.com/en-us/120324Release Notes, Vendor Advisory
https://support.apple.com/en-us/120331Release Notes, Vendor Advisory
https://support.apple.com/en-us/120338Release Notes, Vendor Advisory
https://support.apple.com/en-us/126632Release Notes, Vendor Advisory
https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kitExploit, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-43000US Government Resource

Timeline

Published: Nov 5, 2025
Last modified: Oct 28, 2026
Added to CISA KEV: Mar 5, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-43015.4A cross-site request forgery (CSRF) vulnerability in Jenkins Fortify Plugin 22.1.38 and earlier allows attackers to connect to an attacker-s CVE-2023-430108.8The issue was addressed with improved memory handling. This issue is fixed in iOS 17.2 and iPadOS 17.2, macOS Sonoma 14.2, Safari 17.2, iOS CVE-2023-430139.8Asset Management System v1.0 is vulnerable to an unauthenticated SQL Injection vulnerability on the 'email' parameter of index.php page, a CVE-2023-430148.8Asset Management System v1.0 is vulnerable to an Authenticated SQL Injection vulnerability on the 'first_name' and 'last_name' parameters CVE-2023-430155.4IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript CVE-2023-430167.3IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker CVE-2023-430177.2IBM Security Verify Access 10.0.0.0 through 10.0.6.1 could allow a privileged user to install a configuration file that could allow remote a CVE-2023-430187.5IBM CICS TX Standard 11.1 and Advanced 10.1, 11.1 performs an operation at a privilege level that is higher than the minimum level required,CVE-2023-43024.3A missing permission check in Jenkins Fortify Plugin 22.1.38 and earlier allows attackers with Overall/Read permission to connect to an atta CVE-2023-430215.3IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message CVE-2023-430296.8IBM Storage Virtualize vSphere Remote Plug-in 1.0 and 1.1 could allow a remote user to obtain sensitive credential information after deploym CVE-2023-43036.1Jenkins Fortify Plugin 22.1.38 and earlier does not escape the error message for a form validation method, resulting in an HTML injection vu