Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-28204 is a medium-severity Out-of-bounds Read (CWE-125) vulnerability in Apple Ipados. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked in the top 3% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
An out-of-bounds read vulnerability, tracked as CVE-2023-28204 and assigned CWE-125, affects Apple's web content processing components in Safari and multiple operating systems. The flaw was addressed through improved input validation and impacts watchOS before 9.5, tvOS before 16.5, macOS Ventura before 13.4, iOS and iPadOS before 15.7.6 or 16.5, and Safari before 16.5. With a CVSS 3.1 score of 6.5, the issue resides in network-accessible code that handles untrusted web content.
An unauthenticated remote attacker can trigger the vulnerability by causing a victim to process malicious web content, resulting in disclosure of sensitive information from the affected device. Exploitation requires user interaction such as visiting a crafted web page but needs no privileges on the target system.
Apple security advisories for the fixed releases (HT213757, HT213758, HT213761, and HT213762) recommend immediate installation of the listed updates. The vendor states it is aware of reports indicating the issue may have been actively exploited in the wild. The current EPSS score remains low at 0.0008 with no indicated rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-31912
Vulnerability Data
An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing web content may disclose sensitive information.…
more
Apple is aware of a report that this issue may have been actively exploited.
- CWE(s)
- KEV Date Added
- 22 May 2023
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Vulnerability scanning and recording can discover instances of out-of-bounds reads after code is deployed.
Routine patching replaces vulnerable code containing out-of-bounds read flaws.
Secure-development practices such as bounds checking and memory-safe languages directly prevent out-of-bounds reads.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.