Is CVE-2023-42917 being actively exploited?

Yes. CVE-2023-42917 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on December 4, 2023.

What is the CVSS score for CVE-2023-42917?

CVE-2023-42917 has a CVSS 3.1 base score of 8.8 (HIGH).

CVE-2023-42917

HIGH · CVSS 8.8CISA KEV: actively exploitedEPSS 9.3%EU EUVD: exploited

A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.

Key facts

CVSS score: 8.8 (v3.1)
Severity: HIGH
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-787
EPSS score: 9.3% (95th percentile)
In CISA KEV: Yes, added December 4, 2023
In EU EUVD: Yes (EUVD-2023-47338)
Published: November 30, 2023
NVD last modified: June 17, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Apple Multiple Products WebKit Memory Corruption Vulnerability

Added to the KEV catalog on December 4, 2023; federal remediation due December 25, 2023.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2023-47338 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on October 21, 2025.

View on the EU Vulnerability Database

Affected products

apple / ipados
apple / iphone os
apple / macos
apple / safari
debian / debian linux
debian / debian linux
fedoraproject / fedora
fedoraproject / fedora
webkitgtk / webkitgtk+

Certified products that may be affected

13 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Apple macOS 14 Sonoma - Apple Inc. - Common Criteria CCEVS-VR-VID-11584-2025 - active
Apple iPadOS 17: iPad - Apple Inc. - Common Criteria CCEVS-VR-VID-11447-2025 - active
Apple macOS 14 Sonoma: FileVault - Apple Inc. - Common Criteria CCEVS-VR-VID-11448-2025 - active
Strong Customer Authentication for Apple Pay on iPhone 14 Pro with A16 Bionic running iOS 16.4.1Version iOS 16.4.1 (build 20E252) ( ANSSI-CC-2023/59) - Apple Inc. - Common Criteria ANSSI-CC-2023/59 - active
Strong Customer Authentication for Apple Pay on iPhone SE (3rd generation) with A15 Bionic running iOS 16.4.1iOS 16.4.1 (build 20E252) (ANSSI-CC-2023/58) - Apple Inc. - Common Criteria ANSSI-CC-2023/58 - active

See all 13 in the Security Certifications Explorer.

References

http://seclists.org/fulldisclosure/2023/Dec/12(Mailing List, Third Party Advisory)
http://seclists.org/fulldisclosure/2023/Dec/13(Mailing List, Third Party Advisory)
http://seclists.org/fulldisclosure/2023/Dec/3(Mailing List, Third Party Advisory)
http://seclists.org/fulldisclosure/2023/Dec/4(Mailing List, Third Party Advisory)
http://seclists.org/fulldisclosure/2023/Dec/5(Mailing List, Third Party Advisory)
http://seclists.org/fulldisclosure/2023/Dec/8(Mailing List, Third Party Advisory)
http://seclists.org/fulldisclosure/2024/Jan/35(Mailing List, Third Party Advisory)
http://www.openwall.com/lists/oss-security/2023/12/05/1(Mailing List, Third Party Advisory)
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AD2KIHHCUBQC2YYH3FJWAHI5BG3QETOH/(Mailing List)
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P5LQS6VEI7VIZNC7QGQ62EOV45R5RJIR/(Mailing List)
https://security.gentoo.org/glsa/202401-04(Third Party Advisory)
https://support.apple.com/en-us/HT214031(Vendor Advisory)
https://support.apple.com/en-us/HT214032(Vendor Advisory)
https://support.apple.com/en-us/HT214033(Vendor Advisory)
https://support.apple.com/kb/HT214033(Vendor Advisory)
https://support.apple.com/kb/HT214034(Vendor Advisory)
https://support.apple.com/kb/HT214062(Vendor Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-42917(US Government Resource)
https://www.debian.org/security/2023/dsa-5575(Mailing List, Third Party Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain