CVE-2023-41993The issue was addressed with improved checks.
Updated under an hour ago ()
Does this affect you?
It affects Apple macOS and 14 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Sep 25, 2023; federal agencies had to remediate by Oct 16, 2023. Treat that date as your deadline.
Do this next
Free account, 1 product
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
- CVSS
- 8.8 HIGH (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-754
- Known exploited
- Added to CISA KEV Sep 25, 2023; federal remediation due Oct 16, 2023Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- EPSS (exploitation in the next 30 days)
- 24.35% (percentile 98)
- Assigned by
- apple
- NVD analysis
- Analyzed
- Record last updated
- Nov 4, 2025
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Apple macOS apple:macos (from the name) | from unspecified before 14 | CNA record |
apple iphone_os apple:iphone_os | before 17.0.1 | CISA ADP |
apple ipad_os apple:ipad_os | before 17.0.1 | CISA ADP |
apple macos apple:macos | before 14.0 | CISA ADP |
fedoraproject fedora fedoraproject:fedora | 37 | CISA ADP |
debian debian_linux debian:debian_linux | 11.0; 12.0 | CISA ADP |
oracle graalvm oracle:graalvm | 20.3.13 | CISA ADP |
oracle jdk oracle:jdk | 1.8.0 | CISA ADP |
oracle jre oracle:jre | 1.8.0 | CISA ADP |
netapp cloud_insights_acquisition_unit netapp:cloud_insights_acquisition_unit | all versions | CISA ADP |
netapp cloud_insights_storage_workload_security_agent netapp:cloud_insights_storage_workload_security_agent | all versions | CISA ADP |
netapp oncommand_insight netapp:oncommand_insight | all versions | CISA ADP |
netapp oncommand_workflow_automation netapp:oncommand_workflow_automation | all versions | CISA ADP |
apple ipados apple:ipados | before 17.0.1 | NVD |
apple iphone_os apple:iphone_os | before 17.0.1 | NVD |
apple macos apple:macos | before 14.0 | NVD |
fedoraproject fedora fedoraproject:fedora | 37; 38; 39 | NVD |
debian debian_linux debian:debian_linux | 11.0; 12.0 | NVD |
oracle graalvm oracle:graalvm | 20.3.13; 21.3.9 | NVD |
oracle jdk oracle:jdk | 1.8.0 | NVD |
oracle jre oracle:jre | 1.8.0 | NVD |
netapp active_iq_unified_manager netapp:active_iq_unified_manager | all versions; all versions | NVD |
netapp cloud_insights_acquisition_unit netapp:cloud_insights_acquisition_unit | all versions | NVD |
netapp cloud_insights_storage_workload_security_agent netapp:cloud_insights_storage_workload_security_agent | all versions | NVD |
netapp oncommand_insight netapp:oncommand_insight | all versions | NVD |
netapp oncommand_workflow_automation netapp:oncommand_workflow_automation | all versions | NVD |
webkitgtk webkitgtk+ webkitgtk:webkitgtk+ | before 2.42.2 | NVD |
References
- https://support.apple.com/en-us/HT213940vendor-advisory
- https://security.gentoo.org/glsa/202401-33third-party-advisory
- https://security.netapp.com/advisory/ntap-20240426-0004/third-party-advisory
- https://support.apple.com/kb/HT213926vendor-advisory
- https://support.apple.com/kb/HT213930vendor-advisory
- https://webkitgtk.org/security/WSA-2023-0009.htmlthird-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41993us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.