CVE-2023-28204

Severity

MEDIUM

CVSS

6.5

EPSS

0.14292

Risk score

56.0

CISA KEV

Yes

PoC

Published

2023-05-22

Modified

2023-05-22

First seen

2026-08-07

Aliases

EUVD-2023-31912, GHSA-M85J-WJRJ-C4RG

Products

Apple:Multiple Products, Apple:Safari unspecified <16.5, Apple:iOS and iPadOS unspecified <15.7, Apple:iOS and iPadOS unspecified <16.5, Apple:macOS unspecified <13.4, Apple:tvOS unspecified <16.5, Apple:watchOS unspecified <9.5

Sources

cisa.gov CVE-2023-28204
euvd EUVD-2023-31912

Description

Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

References

https://www.cisa.gov/known-exploited-vulnerabilities-catalog
https://nvd.nist.gov/vuln/detail/CVE-2023-28204
https://support.apple.com/HT213757
https://support.apple.com/HT213758
https://support.apple.com/HT213761
https://support.apple.com/HT213762
https://support.apple.com/HT213764
https://support.apple.com/HT213765
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-31912
https://support.apple.com/en-us/HT213758
https://support.apple.com/en-us/HT213762
https://support.apple.com/en-us/HT213764
https://support.apple.com/en-us/HT213765
https://support.apple.com/en-us/HT213757
https://support.apple.com/en-us/HT213761
https://security.gentoo.org/glsa/202401-04