CVE WatchSep 21, 2026

CVE-2023-43000

Apple Multiple products Use-After-Free Vulnerability

CVSS

8.8

High

EPSS

4.0%

p90

KEV

YES

Mar 5, 2026

Exploit Today

0-100

Published: Nov 5, 2025 · Last modified: Sep 21, 2026 · CWE-416

EPSS · 30d

3.9%EPSS · 30 days4.0%

2026-09-182026-10-16

KEV catalog record

Product

Apple / Multiple Products

Vulnerability

Apple Multiple products Use-After-Free Vulnerability

Added to KEV

Mar 5, 2026

Remediate by

Mar 26, 2026

Known ransomware use

Summary description

Apple macOS, iOS, iPadOS, and Safari 16.6 contain a use-after-free vulnerability due to the processing of maliciously crafted web content that may lead to memory corruption.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

https://support.apple.com/en-us/120324 ; https://support.apple.com/en-us/120331 ; https://support.apple.com/en-us/120338 ; https://nvd.nist.gov/vuln/detail/CVE-2023-43000

Technical description

A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-175913.6 LOW

—

———A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function deallocates an internal buffer before completing a data copy. An attacker who can supply input to an application utilizing this function can trigger the flaw to crash the application or read uninitialized memory data.6h CVE-2026-110753—

—

———Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline. With bind_columns, the parser writes each field into the caller's own scalar without taking a reference to it. When skip_empty_rows skips an empty last line, the parser frees the current field scalar without checking whether it is bound, dropping one reference from the application's variable. The "eof" mode does the same on any empty line. The variable is then freed while the application still references it, so later code uses freed memory and can crash the process.6h CVE-2026-857489.9 CRI

—

——0MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2.11h CVE-2026-1109228.8 HIG

15.0%

——5Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)14h CVE-2026-1109218.8 HIG

12.0%

——4Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)14h CVE-2026-1109198.8 HIG

12.0%