CVE-2023-43000
published 2025-11-05CVE-2023-43000: A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS…
PriorityP186high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2026-03-26
Exploited in the wild
EPSS
3.96%
89.3th percentile
A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios_15.8.7_and_ipados | — | — |
| apple | ios_16.6_and_ipados | — | — |
| apple | ios_and_ipados | >= unspecified < 16.6 | 16.6 |
| apple | ios_and_ipados | >= unspecified < 15.8.7 | 15.8.7 |
| apple | ipados | < 15.8.7 | 15.8.7 |
| apple | ipados | >= 16.0 < 16.6 | 16.6 |
| apple | iphone_os | < 15.8.7 | 15.8.7 |
| apple | iphone_os | >= 16.0 < 16.6 | 16.6 |
| apple | macos | < 13.5 | 13.5 |
| apple | macos | >= unspecified < 13.5 | 13.5 |
| apple | macos_ventura | — | — |
| apple | safari | < 16.6 | 16.6 |
| apple | safari | — | — |
| apple | safari | >= unspecified < 16.6 | 16.6 |
| debian | webkit2gtk | < webkit2gtk 2.42.1-1~deb12u1 (bookworm) | webkit2gtk 2.42.1-1~deb12u1 (bookworm) |
| debian | wpewebkit | < webkit2gtk 2.42.1-1~deb12u1 (bookworm) | webkit2gtk 2.42.1-1~deb12u1 (bookworm) |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
0xf00dbeef
- →Coruna exploit kit payloads are served from URLs ending with '.min.js'; network detection should flag iOS devices fetching .min.js resources from suspicious domains, especially in conjunction with hidden iFrame injection. ↗
- →Binary payloads use a custom file format with magic header 0xf00dbeef, encrypted with ChaCha20 and compressed with LZW. Network/file inspection should look for this magic byte sequence in HTTP responses. ↗
- →The JavaScript framework uses XOR-based string obfuscation (e.g., array.map(x => String.fromCharCode(x ^ 101))) and XOR integer encoding (e.g., i.p1=(1111970405 ^ 1111966034)). These patterns can be used in JS deobfuscation detection rules. ↗
- →The exploit kit bails out if the device is in Lockdown Mode or the user is in private browsing; enabling Lockdown Mode on iOS devices is an effective mitigation and detection bypass indicator. ↗
- →Delivery mechanism is a hidden iFrame injected on compromised websites; monitor for hidden iFrame injection patterns on iOS user-agent traffic, particularly from financial/crypto-themed domains. ↗
- →Post-exploitation implant targets cryptocurrency wallet apps via function hooks; monitor for anomalous inter-process activity or hooking behavior in apps such as io.metamask.MetaMask, com.bitkeep.os, app.phantom, and com.solflare.mobile. ↗
- →Implant configuration is delivered as a 7-ZIP archive protected with a unique hard-coded password, encoded in JSON with module URLs, SHA-256 hashes, and sizes. Detection should look for 7-ZIP downloads from iOS devices post-exploitation. ↗
- ·CVE associations in the exploit chain table are preliminary and subject to revision as analysis is ongoing. ↗
- ·The exploit kit is not effective against the latest version of iOS; all detections and mitigations are relevant only for devices running iOS 16.2–16.5.1 (for CVE-2023-43000 specifically) or up to iOS 17.2.1 for the broader kit. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv8.8HIGH
vulncheck8.8HIGH
cisa8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Apple
CVE-2023-43000: iOS 15.8.7 and iPadOS 15.8.7
vendor_apple·2026-03-11·CVSS 8.8
CVE-2023-43000 [HIGH] CVE-2023-43000: iOS 15.8.7 and iPadOS 15.8.7
Apple Security Update: About the security content of iOS 15.8.7 and iPadOS 15.8.7
Product: iOS 15.8.7 and iPadOS
Version: 15.8.7
CVE: CVE-2023-43000
Component: WebKit
Impact: Processing maliciously crafted web content may lead to memory corruption. This fix associated with the Coruna exploit was shipped in iOS 16.6 on July 24, 2023. This update brings that fix to devices that cannot update to the latest iOS version.
Description: A use-after-free issue was addressed with improved memory management.
CISA
Apple Multiple products Use-After-Free Vulnerability
cisa·2026-03-05·CVSS 8.8
CVE-2023-43000 [HIGH] CWE-416 Apple Multiple products Use-After-Free Vulnerability
Vulnerability: Apple Multiple products Use-After-Free Vulnerability
Affected: Apple Multiple Products
Apple macOS, iOS, iPadOS, and Safari 16.6 contain a use-after-free vulnerability due to the processing of maliciously crafted web content that may lead to memory corruption.
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: https://support.apple.com/en-us/120324 ; https://support.apple.com/en-us/120331 ; https://support.apple.com/en-us/120338 ; https://nvd.nist.gov/vuln/detail/CVE-2023-43000
Remediation Due Date: 2026-03-26
Red Hat
webkitgtk: Processing maliciously crafted web content may lead to memory corruption
vendor_redhat·2025-11-20·CVSS 8.8
CVE-2023-43000 [HIGH] CWE-416 webkitgtk: Processing maliciously crafted web content may lead to memory corruption
webkitgtk: Processing maliciously crafted web content may lead to memory corruption
A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption.
A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in memory corruption.
Statement: To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.
Additionally, this issue can cause memory corruption and the possibility of remote code execution is n
Apple
CVE-2023-43000: Safari 16.6
vendor_apple·2023-07-24·CVSS 8.8
CVE-2023-43000 [HIGH] CVE-2023-43000: Safari 16.6
Apple Security Update: About the security content of Safari 16.6
Product: Safari
Version: 16.6
CVE: CVE-2023-43000
Component: WebKit
Impact: Processing maliciously crafted web content may lead to memory corruption
Description: A use-after-free issue was addressed with improved memory management.
Apple
CVE-2023-43000: macOS Ventura 13.5
vendor_apple·2023-07-24·CVSS 8.8
CVE-2023-43000 [HIGH] CVE-2023-43000: macOS Ventura 13.5
Apple Security Update: About the security content of macOS Ventura 13.5
Product: macOS Ventura
Version: 13.5
CVE: CVE-2023-43000
Component: WebKit
Impact: Processing maliciously crafted web content may lead to memory corruption
Description: A use-after-free issue was addressed with improved memory management.
Apple
CVE-2023-43000: iOS 16.6 and iPadOS 16.6
vendor_apple·2023-07-24·CVSS 8.8
CVE-2023-43000 [HIGH] CVE-2023-43000: iOS 16.6 and iPadOS 16.6
Apple Security Update: About the security content of iOS 16.6 and iPadOS 16.6
Product: iOS 16.6 and iPadOS
Version: 16.6
CVE: CVE-2023-43000
Component: WebKit
Impact: Processing maliciously crafted web content may lead to memory corruption
Description: A use-after-free issue was addressed with improved memory management.
Debian
CVE-2023-43000: webkit2gtk - A use-after-free issue was addressed with improved memory management. This issue...
vendor_debian·2023·CVSS 8.8
CVE-2023-43000 [HIGH] CVE-2023-43000: webkit2gtk - A use-after-free issue was addressed with improved memory management. This issue...
A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption.
Scope: local
bookworm: resolved (fixed in 2.42.1-1~deb12u1)
bullseye: resolved (fixed in 2.42.1-1~deb11u1)
forky: resolved (fixed in 2.42.0-1)
sid: resolved (fixed in 2.42.0-1)
trixie: resolved (fixed in 2.42.0-1)
GHSA
GHSA-96ff-3rwm-724g: A use-after-free issue was addressed with improved memory management
ghsa_unreviewed·2025-11-05
CVE-2023-43000 [HIGH] CWE-416 GHSA-96ff-3rwm-724g: A use-after-free issue was addressed with improved memory management
A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6. Processing maliciously crafted web content may lead to memory corruption.
OSV
CVE-2023-43000: A use-after-free issue was addressed with improved memory management
osv·2025-11-05·CVSS 8.8
CVE-2023-43000 [HIGH] CVE-2023-43000: A use-after-free issue was addressed with improved memory management
A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption.
VulnCheck
Apple Multiple products Use-After-Free Vulnerability
vulncheck·2023·CVSS 8.8
CVE-2023-43000 [HIGH] CWE-416 Apple Multiple products Use-After-Free Vulnerability
Apple Multiple products Use-After-Free Vulnerability
Apple macOS, iOS, iPadOS, and Safari 16.6 contain a use-after-free vulnerability due to the processing of maliciously crafted web content that may lead to memory corruption.
Affected: Apple Multiple Products
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Exploitation References: https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit/; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Remediation Due: 2026-03-26
No detection rules found.
No public exploits indexed.
Bleepingcomputer
Apple patches older iPhones and iPads against Coruna exploits
blogs_bleepingcomputer·2026-03-12·CVSS 7.8
CVE-2023-41974 [HIGH] Apple patches older iPhones and iPads against Coruna exploits
## Apple patches older iPhones and iPads against Coruna exploits
## Sergiu Gatlan
Apple said the patches will fix iOS security issues targeted by multiple exploit chains, many used in zero-day attacks aiming to help attackers escalate permissions to Kernel privileges or gain remote code execution on vulnerable devices.
The list of vulnerabilities addressed by these backported security patches includes:
CVE-2023-41974: A Kernel use-after-free issue addressed with improved memory management
CVE-2024-23222: A WekKit type confusion issue addressed with improved checks
CVE-2023-43000: A WebKit use-after-free issue addressed with improved memory management
CVE-2023-43010: A WebKit issue was addressed with improved memory handling
The list of devices impacted by these vulnerabilities is a
Mandiant
Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit
blogs_mandiant·2026-03-03
Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit
Threat Intelligence
# Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit
March 3, 2026
##### Google Threat Intelligence Group
##### Google Threat Intelligence
Visibility and context on the threats that matter most.
Contact Us & Get a Demo
### Introduction
Google Threat Intelligence Group (GTIG) has identified a new and powerful exploit kit targeting Apple iPhone models running iOS version 13.0 (released in September 2019) up to version 17.2.1 (released in December 2023). The exploit kit, named “Coruna” by its developers, contained five full iOS exploit chains and a total of 23 exploits. The core technical value of this exploit kit lies in its comprehensive collection of iOS exploits, with the most advanced ones using non-public exploitation techniques and mitigation bypas
Mandiant
Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit
blogs_mandiant·2026-03-03
Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit
## Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit
## Google Threat Intelligence Group
## Google Threat Intelligence
Visibility and context on the threats that matter most.
## Introduction
Google Threat Intelligence Group (GTIG) has identified a new and powerful exploit kit targeting Apple iPhone models running iOS version 13.0 (released in September 2019) up to version 17.2.1 (released in December 2023) . The exploit kit, named “Coruna” by its developers, contained five full iOS exploit chains and a total of 23 exploits. The core technical value of this exploit kit lies in its comprehensive collection of iOS exploits, with the most advanced ones using non-public exploitation techniques and mitigation bypasses.
The Coruna exploit kit provides another example of how sophi
Bugzilla
CVE-2023-43000 webkit2gtk4.0: Processing maliciously crafted web content may lead to memory corruption [fedora-42]
bugzilla·2025-11-21·CVSS 8.8
CVE-2023-43000 [HIGH] CVE-2023-43000 webkit2gtk4.0: Processing maliciously crafted web content may lead to memory corruption [fedora-42]
CVE-2023-43000 webkit2gtk4.0: Processing maliciously crafted web content may lead to memory corruption [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora
https://support.apple.com/en-us/120324https://support.apple.com/en-us/120331https://support.apple.com/en-us/120338https://support.apple.com/en-us/126632https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kithttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-43000
2025-11-05
Published
2026-03-05
Added to CISA KEV
Exploited in the wild