CVE-2023-37450

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2023-37450 is a vulnerability in Apple's WebKit-based web content processing engine that was addressed through improved input validation checks. It affects multiple Apple platforms and is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, and watchOS 9.6. The flaw permits arbitrary code execution when a victim processes malicious web content, carrying a CVSS 3.1 base score of 8.8.

An unauthenticated remote attacker can exploit the issue by serving specially crafted web content that the target renders in Safari or any WebKit-based application. Successful exploitation grants the attacker the ability to execute arbitrary code with the privileges of the affected process, potentially leading to full device compromise. The attack requires the victim to visit a malicious site or view attacker-controlled content, consistent with the network-attack vector and user-interaction requirement in the CVSS scoring.

Apple security advisories HT213826, HT213841, HT213843, and HT213846 recommend immediate installation of the listed updates. The vendor states it is aware of reports indicating the vulnerability has been actively exploited in the wild. The current EPSS score remains low at 0.0007 with no material upward trajectory reported.