Out-of-Bounds Read in Apple WebKit (CVE‑2023‑42916) Risks Sensitive Data Disclosure
What It Is – Apple’s WebKit engine in iOS, iPadOS, macOS and Safari contains an out‑of‑bounds read flaw that can expose memory contents when parsing malicious web pages. The issue is catalogued as CVE‑2023‑42916.
Exploitability – Publicly disclosed; proof‑of‑concept code exists. No known active exploit campaigns, but the vulnerability is trivial to trigger via crafted HTML/JavaScript. CVSS v3.1 base score ≈ 6.5 (Medium).
Affected Products – Apple iOS 16+, iPadOS 16+, macOS 13+, Safari 16+ (and any third‑party browsers that embed WebKit).
Why It Matters for Trust & Control Assurance
- Vulnerability Management – Demonstrates the need for a documented process that inventories software, tracks vendor advisories, and applies patches within defined service‑level windows.
- Evidence of Due Diligence – Continuous monitoring of patch status provides defensible audit evidence that the organization is actively mitigating known risks.
- Supply‑Chain Assurance – WebKit is reused by non‑Apple browsers; a single flaw can propagate across multiple products, highlighting the importance of third‑party component oversight.
Recommended Actions
- Inventory all devices running the affected Apple OS or Safari versions.
- Deploy Apple’s security update (released 2023‑10‑xx) across the inventory within your patch‑management SLA.
- Enable WebKit’s built‑in mitigations (e.g., site isolation) where configurable.
- Log and retain evidence of patch deployment to satisfy control‑monitoring requirements.
- Monitor threat feeds for any emerging exploit activity.
Source: CISA KEV – CVE‑2023‑42916