CVE-2023-32409

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2023-32409 is a bounds-checking flaw in Apple's Web Content sandbox implementation. It affects watchOS prior to 9.5, tvOS prior to 16.5, macOS Ventura prior to 13.4, iOS and iPadOS prior to 15.7.8 and 16.5, and Safari prior to 16.5. The vulnerability was resolved by adding improved bounds checks in those releases.

A remote attacker can exploit the issue over the network with no privileges or user interaction required. Successful exploitation allows escape from the Web Content sandbox, resulting in high-integrity impact on the host system as reflected by the CVSS 8.6 rating with changed scope.

Apple security advisories for the listed updates state that installing the patched versions of watchOS, tvOS, macOS, iOS, iPadOS, and Safari eliminates the vulnerability.

Apple has stated that it is aware of reports indicating the flaw may have been actively exploited in the wild. The associated EPSS score rose materially from a low baseline to a peak of 0.0214 on 2024-06-18 before receding to its current value of 0.0030.