CVE Watch21 sept 2026

CVE-2023-43000

Apple Multiple products Use-After-Free Vulnerability

CVSS

8.8

Alto

EPSS

4.0%

p90

KEV

SÍ

5 mar 2026

Exploit Today

0-100

Publicado: 5 nov 2025 · Última mod.: 21 sept 2026 · CWE-416

EPSS · 30d

3.9%EPSS · 30 días4.0%

2026-09-182026-10-15

Ficha del catálogo KEV

Producto

Apple / Multiple Products

Vulnerabilidad

Apple Multiple products Use-After-Free Vulnerability

Añadido a KEV

5 mar 2026

Remediar antes de

26 mar 2026

Uso conocido en ransomware

Descripción resumida

Apple macOS, iOS, iPadOS, and Safari 16.6 contain a use-after-free vulnerability due to the processing of maliciously crafted web content that may lead to memory corruption.

Acción requerida

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notas

https://support.apple.com/en-us/120324 ; https://support.apple.com/en-us/120331 ; https://support.apple.com/en-us/120338 ; https://nvd.nist.gov/vuln/detail/CVE-2023-43000

Descripción técnica

A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-857489.9 CRÍ

—

———MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2.6h CVE-2026-1109228.8 ALT

—

———Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)10h CVE-2026-1109218.8 ALT

—

———Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)10h CVE-2026-1109198.8 ALT

—

———Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)10h CVE-2026-1084468.8 ALT

—

———Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.5h