Search for vulnerabilities
Vulnerability details: VCID-g64d-1kxf-37ce
Vulnerability ID VCID-g64d-1kxf-37ce
Aliases CVE-2023-28205
Summary A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 and iPadOS 15.7.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Status Published
Exploitability 2.0
Weighted Severity 7.9
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-416 Use After Free
System Score Found at
cvssv3 8.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-28205.json
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2023-28205
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2023-28205
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2023-28205
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2023-28205
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2023-28205
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2023-28205
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2023-28205
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2023-28205
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2023-28205
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2023-28205
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2023-28205
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2023-28205
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2023-28205
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2023-28205
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2023-28205
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2023-28205
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2023-28205
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2023-28205
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2023-28205
cvssv3.1 8.8 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 8.8 https://nvd.nist.gov/vuln/detail/CVE-2023-28205
cvssv3.1 8.8 https://support.apple.com/en-us/HT213720
ssvc Attend https://support.apple.com/en-us/HT213720
cvssv3.1 8.8 https://support.apple.com/en-us/HT213721
ssvc Attend https://support.apple.com/en-us/HT213721
cvssv3.1 8.8 https://support.apple.com/en-us/HT213722
ssvc Attend https://support.apple.com/en-us/HT213722
cvssv3.1 8.8 https://support.apple.com/en-us/HT213723
ssvc Attend https://support.apple.com/en-us/HT213723
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-28205.json
https://api.first.org/data/v1/epss?cve=CVE-2023-28205
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0108
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32885
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27932
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27954
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28198
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28205
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32370
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32393
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32435
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-35074
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
2185724 https://bugzilla.redhat.com/show_bug.cgi?id=2185724
cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
CVE-2023-28205 https://nvd.nist.gov/vuln/detail/CVE-2023-28205
HT213720 https://support.apple.com/en-us/HT213720
HT213721 https://support.apple.com/en-us/HT213721
HT213722 https://support.apple.com/en-us/HT213722
HT213723 https://support.apple.com/en-us/HT213723
RHSA-2023:1918 https://access.redhat.com/errata/RHSA-2023:1918
RHSA-2023:1919 https://access.redhat.com/errata/RHSA-2023:1919
RHSA-2025:10364 https://access.redhat.com/errata/RHSA-2025:10364
USN-6061-1 https://usn.ubuntu.com/6061-1/
Data source KEV
Date added April 10, 2023
Description Apple iOS, iPadOS, macOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required action Apply updates per vendor instructions.
Due date May 1, 2023
Note 
https://support.apple.com/en-us/HT213720,https://support.apple.com/en-us/HT213721,https://support.apple.com/en-us/HT213722,https://support.apple.com/en-us/HT213723;  https://nvd.nist.gov/vuln/detail/CVE-2023-28205
Ransomware campaign use Unknown
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-28205.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-28205
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://support.apple.com/en-us/HT213720
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-28T21:10:57Z/ Found at https://support.apple.com/en-us/HT213720
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://support.apple.com/en-us/HT213721
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-28T21:10:57Z/ Found at https://support.apple.com/en-us/HT213721
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://support.apple.com/en-us/HT213722
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-28T21:10:57Z/ Found at https://support.apple.com/en-us/HT213722
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://support.apple.com/en-us/HT213723
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-28T21:10:57Z/ Found at https://support.apple.com/en-us/HT213723
Exploit Prediction Scoring System (EPSS)
Percentile 0.17191
EPSS Score 0.00055
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:39:27.934396+00:00 Ubuntu USN Importer Import https://usn.ubuntu.com/6061-1/ 37.0.0