Skip to main content

Ipados CVE-2023-43010

HIGH
Out-of-bounds Write (CWE-787)
2026-03-12 product-security@apple.com
Buffer Overflow Memory Corruption Apple Ipados Iphone Os
8.8
CVSS 3.1 · Vendor: apple
View

Vulnerability Assessment

Weakness
CWE
CWE-787
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

CVSS 8.8 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: Required.
Exploit ScenarioDerived

An attacker could exploit this vulnerability to memory corruption.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

The issue was addressed with improved memory handling. This issue is fixed in iOS 17.2 and iPadOS 17.2, macOS Sonoma 14.2, Safari 17.2, iOS 16.7.15 and iPadOS 16.7.15, iOS 15.8.7 and iPadOS 15.8.7. [CVSS 8.8 HIGH]

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The issue was addressed with improved memory handling. This issue is fixed in iOS 17.2 and iPadOS 17.2, macOS Sonoma 14.2, Safari 17.2, iOS 16.7.15 and iPadOS 16.7.15, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption.

Know when Ipados gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apple) PRIMARY 8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SUSE HIGH
Red Hat 8.8 HIGH

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Mar 12, 2026 - 01:15 nvd
HIGH 8.8

DescriptionCVE.org

The issue was addressed with improved memory handling. This issue is fixed in iOS 17.2 and iPadOS 17.2, macOS Sonoma 14.2, Safari 17.2, iOS 16.7.15 and iPadOS 16.7.15, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption.

Executive ViewAI

Why It Matters

CVE-2023-43010 is a high-severity memory handling vulnerability affecting Apple devices (iOS, iPadOS, macOS) and Safari that could allow attackers to execute arbitrary code or cause system compromise. Organizations with Apple devices in their environment face potential data breach and operational disruption risks until patching is completed.

Business Impact: High
Compensating Controls

Apply vendor patch. Patches are available for all affected platforms (iOS 17.2, iPadOS 17.2, macOS Sonoma 14.2, Safari 17.2, and legacy OS versions 16.7.15 and 15.8.7). Until patched, restrict affected devices from accessing critical systems and sensitive data; implement network segmentation to isolate vulnerable endpoints; disable unnecessary browser features if using Safari; enforce VPN usage on mobile devices.

Threat Intelligence Overview

EPSS Score
0.0%
Top 96% exploitable
Data Quality
5 sources
Confidence: Medium
NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
High

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Affected Products (CPE)CVE.org

cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

More in Ipados

View all
CVE-2022-2294 HIGH
8.8 Jul 28

Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
CVE-2025-31277 HIGH POC
8.8 Jul 30

WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
CVE-2023-43000 HIGH POC
8.8 Nov 05

A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 8.8), this vulnerability
CVE-2023-41974 HIGH POC
7.8 Jan 10

A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 7.8), this vulnerability
CVE-2025-43510 HIGH POC
7.8 Dec 12

Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
CVE-2025-24201 CRITICAL
10.0 Mar 11

A critical out-of-bounds write in WebKit's rendering engine allows maliciously crafted web content to escape the Web Con
CVE-2025-43520 MEDIUM POC
5.5 Dec 12

Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
CVE-2024-44308 HIGH
8.8 Nov 20

Arbitrary code execution in Apple Safari, iOS/iPadOS, macOS Sequoia, and visionOS occurs when processing maliciously cra
CVE-2022-37434 CRITICAL POC
9.8 Aug 05

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header
CVE-2025-14174 HIGH
8.8

Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such

CVE-2025-6558 HIGH
8.8

Remote code execution in Google Chrome's ANGLE graphics layer allows attackers to compromise systems via crafted HTML pa
CVE-2025-43529 HIGH
8.8 Dec 17

WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2024:8180 ADVISORY https://access.redhat.com/errata/RHSA-2024:8492 ADVISORY https://access.redhat.com/errata/RHSA-2024:8496 ADVISORY https://access.redhat.com/errata/RHSA-2024:9144 ADVISORY https://access.redhat.com/errata/RHSA-2024:9636 ADVISORY https://access.redhat.com/errata/RHSA-2024:9646 ADVISORY https://access.redhat.com/errata/RHSA-2024:9653 ADVISORY https://access.redhat.com/errata/RHSA-2024:9679 ADVISORY https://access.redhat.com/errata/RHSA-2024:9680 ADVISORY https://access.redhat.com/errata/RHSA-2025:10364 ADVISORY https://vuldb.com/?id.350602 ADVISORY https://vuldb.com/?id.350603 ADVISORY https://vuldb.com/?id.350604 REF http://seclists.org/fulldisclosure/2026/Mar/1 REF https://access.redhat.com/security/cve/CVE-2023-43010 REF https://bugzilla.redhat.com/show_bug.cgi?id=2448778 REF https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-43010.json REF https://support.apple.com/en-us/120300 REF https://support.apple.com/en-us/120877 REF https://support.apple.com/en-us/120879 REF https://support.apple.com/en-us/126632 REF https://support.apple.com/en-us/126646

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy