Search for vulnerabilities
Vulnerability details: VCID-y1nq-qtc2-3ybc
Vulnerability ID VCID-y1nq-qtc2-3ybc
Aliases CVE-2023-32409
Summary The issue was addressed with improved bounds checks. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.8 and iPadOS 15.7.8, Safari 16.5, iOS 16.5 and iPadOS 16.5. A remote attacker may be able to break out of Web Content sandbox. Apple is aware of a report that this issue may have been actively exploited.
Status Published
Exploitability 2.0
Weighted Severity 7.9
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-693 Protection Mechanism Failure
System Score Found at
cvssv3 8.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-32409.json
epss 0.00354 https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss 0.00354 https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss 0.00354 https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss 0.00354 https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss 0.00354 https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss 0.00354 https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss 0.00354 https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss 0.00354 https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss 0.00354 https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss 0.00354 https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss 0.00354 https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss 0.00354 https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss 0.00354 https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss 0.00354 https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss 0.00354 https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss 0.00354 https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss 0.00354 https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss 0.00354 https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss 0.00354 https://api.first.org/data/v1/epss?cve=CVE-2023-32409
cvssv3.1 8.6 https://nvd.nist.gov/vuln/detail/CVE-2023-32409
ssvc Attend https://support.apple.com/en-us/HT213757
ssvc Attend https://support.apple.com/en-us/HT213758
ssvc Attend https://support.apple.com/en-us/HT213761
ssvc Attend https://support.apple.com/en-us/HT213762
ssvc Attend https://support.apple.com/en-us/HT213764
ssvc Attend https://support.apple.com/en-us/HT213842
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-32409.json
https://api.first.org/data/v1/epss?cve=CVE-2023-32409
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32409
2209204 https://bugzilla.redhat.com/show_bug.cgi?id=2209204
cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
CVE-2023-32409 https://nvd.nist.gov/vuln/detail/CVE-2023-32409
HT213757 https://support.apple.com/en-us/HT213757
HT213758 https://support.apple.com/en-us/HT213758
HT213761 https://support.apple.com/en-us/HT213761
HT213762 https://support.apple.com/en-us/HT213762
HT213764 https://support.apple.com/en-us/HT213764
HT213842 https://support.apple.com/en-us/HT213842
Data source KEV
Date added May 22, 2023
Description Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an unspecified vulnerability that can allow a remote attacker to break out of the Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required action Apply updates per vendor instructions.
Due date June 12, 2023
Note 
https://support.apple.com/HT213757, https://support.apple.com/HT213758, https://support.apple.com/HT213761, https://support.apple.com/HT213762, https://support.apple.com/HT213764, https://support.apple.com/HT213765; https://nvd.nist.gov/vuln/detail/CVE-2023-32409
Ransomware campaign use Unknown
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-32409.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-32409
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-01-27T22:14:51Z/ Found at https://support.apple.com/en-us/HT213757
Vector: SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-01-27T22:14:51Z/ Found at https://support.apple.com/en-us/HT213758
Vector: SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-01-27T22:14:51Z/ Found at https://support.apple.com/en-us/HT213761
Vector: SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-01-27T22:14:51Z/ Found at https://support.apple.com/en-us/HT213762
Vector: SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-01-27T22:14:51Z/ Found at https://support.apple.com/en-us/HT213764
Vector: SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-01-27T22:14:51Z/ Found at https://support.apple.com/en-us/HT213842
Exploit Prediction Scoring System (EPSS)
Percentile 0.57022
EPSS Score 0.00354
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T09:39:44.929674+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2023/32xxx/CVE-2023-32409.json 37.0.0