CVE-2023-42866 is a high severity (CVSS 8.8) memory handling flaw in WebKit, the engine behind Safari. Processing web content may lead to arbitrary code execution. Apple fixed it in Safari 16.6, iOS 16.6 and iPadOS 16.6, tvOS 16.6, watchOS 9.6 and macOS Ventura 13.5. Update any device still on an earlier release.
What's affected
The record lists Safari, iPadOS and iPhone OS as affected products. Apple's own text names the platforms and the fix:
- Safari: fixed in 16.6.
- iOS and iPadOS: fixed in 16.6.
- macOS Ventura: fixed in 13.5.
- tvOS: fixed in 16.6.
- watchOS: fixed in 9.6.
Apple lists the issue under the WebKit component. Its advisories describe the impact as processing web content leading to arbitrary code execution, and the fix as improved memory handling. Apple added this entry to the bulletins on December 21, 2023, well after the original releases, which is why the NVD record is dated January 2024.
Older operating system lines, such as macOS Monterey, are not named in the record or in the bulletins we read. If you run one, check Apple's security releases page rather than assuming it is covered.
How to check if you're exposed
On an iPhone or iPad, open Settings, then General, then About, and read the iOS or iPadOS version. Settings, General, Software Update shows whether a newer release is waiting.
On a Mac, the Terminal can print the installed macOS version and list pending updates:
sw_vers
softwareupdate --list
About This Mac in the Apple menu shows the same version number.
On Apple TV, Settings, then System, then Software Updates, shows the installed tvOS version.
On Apple Watch, open the Watch app on the paired iPhone, then General, then About, to read the watchOS version.
Safari has its own version number. In Safari, choose Safari, then About Safari, and compare it with 16.6. On macOS releases that ship Safari as part of the system update, updating macOS updates Safari too.
What to do now
- Update iPhone and iPad to iOS or iPadOS 16.6 or later, and Macs on Ventura to 13.5 or later. Newer major releases carry the fix as well.
- Update Safari to 16.6 or later on Macs that run it as a separate update.
- Update Apple TV to tvOS 16.6 or later and Apple Watch to watchOS 9.6 or later.
- Turn on automatic updates so the next WebKit fix arrives without a ticket.
- Inventory which managed devices are still on 15.x or early 16.x releases and set a deadline for them.
Why it matters
The CVSS vector in the record is network based, needs no account and needs the user to load content, which is the usual shape of a browser engine bug: a person visits a page or opens content, and the engine mishandles memory. The record gives no CWE for this entry, and Apple's wording, improved memory handling, points to the memory safety class of problems. Memory flaws in a browser engine are serious because the engine parses untrusted input all day.
The record's KEV flag is false, so CISA does not list this CVE as known exploited. One note for readers who open the tvOS 16.6 bulletin: it carries a line that a different WebKit issue may have been actively exploited. That statement belongs to another CVE and should not be read as applying to this one.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2023-42866 known to be exploited?
The record's KEV flag is false, and the Apple bulletins we read do not say this CVE is exploited. Another WebKit entry in the tvOS 16.6 bulletin does carry an exploitation note, so read each CVE line on its own.
Sources
- Apple: About the security content of iOS 16.6 and iPadOS 16.6
- Apple: About the security content of macOS Ventura 13.5
- Apple: About the security content of tvOS 16.6
Last reviewed: 19 October 2026.
