CVE-2023-40414 is a critical severity (CVSS 9.8) use-after-free in WebKit, the engine behind Safari. Processing web content may lead to arbitrary code execution. Apple fixed it in watchOS 10, iOS 17, iPadOS 17, tvOS 17, macOS Sonoma 14 and Safari 17.
What's affected
Apple's note says a use-after-free issue was addressed with improved memory management. The fixed releases are watchOS 10, iOS 17 and iPadOS 17, tvOS 17, macOS Sonoma 14 and Safari 17.
The NVD record scores it 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Apple does not publish scores. Apple's own words are more measured: processing web content may lead to arbitrary code execution, with no mention of attack in the wild. The NVD vector is the reason the number is so high.
The weakness is CWE-416 (use after free). The macOS Sonoma 14 release date in Apple's note is 26 September 2023, and the record's published date is 2024-01-10.
How to check if you're exposed
On a Mac, read the installed version and look for pending updates:
sw_vers
softwareupdate --list
On an iPhone or iPad, open Settings, then General, then About, and read the iOS or iPadOS version. Apple Watch and Apple TV show their version in Settings under General and About as well.
For a managed fleet, use the OS version report in your mobile device management tool and filter for devices below the fixed release.
For Safari alone, which can be updated on older macOS versions, read the version directly:
defaults read /Applications/Safari.app/Contents/Info CFBundleShortVersionString
Safari below 17 on a Mac that cannot run Sonoma is still in scope for this CVE unless Apple has shipped a later update for that macOS branch. Apple's note for that branch is the place to confirm.
What to do now
- Inventory every Apple device that browses the web, including Apple TV and Apple Watch.
- Update to iOS 17, iPadOS 17, tvOS 17, watchOS 10 or macOS Sonoma 14, and Safari 17 where you update it separately.
- For Macs that stay on older macOS, update Safari to the newest version Apple supports for that release and read Apple's note for that branch.
- Run a scan of the devices you cannot update and restrict them from untrusted web content where you can.
- Set a compliance rule for a minimum OS version and review it each month.
Why it matters
WebKit parses and runs untrusted content from every site a user visits. A use after free happens when memory is released and then used again. If an attacker can control what fills that memory, the program can be steered into running their code.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and Apple's note does not say it is exploited. Even so, a score of 9.8 for a browser engine is a reason to move quickly. The fixed releases are old enough now that any device still below them is also missing many later fixes.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does updating the OS cover Safari?
On iOS, iPadOS, tvOS, watchOS and macOS Sonoma 14, Apple lists the fix by operating system release, and Safari 17 is listed separately for Macs on older macOS.
Is CVE-2023-40414 exploited in the wild?
The record's KEV flag is false and Apple's note does not say it is. Treat that as the status at our review date and check the CISA catalog for changes.
Sources
Last reviewed: 19 October 2026.
