CVE-2023-42950 is a high severity (CVSS 8.8) use-after-free in WebKit. Processing maliciously crafted web content may lead to arbitrary code execution. Apple fixed it in Safari 17.2, iOS 17.2, iPadOS 17.2, tvOS 17.2, watchOS 10.2 and macOS Sonoma 14.2. Update browsers and devices that are older.
What's affected
The record lists Safari, iPadOS and iPhone OS, and names the fixes as Safari 17.2, iOS 17.2 and iPadOS 17.2, tvOS 17.2, watchOS 10.2 and macOS Sonoma 14.2.
Apple's iOS 17.2 bulletin lists a WebKit entry with the impact "Processing maliciously crafted web content may lead to arbitrary code execution" and the description "A use after free issue was addressed with improved memory management". It was added on March 22, 2024.
The same CVE also appears outside Apple. An oss-security post from March 26, 2024 carries the WebKitGTK and WPE WebKit advisory WSA-2024-0002, which lists CVE-2023-42950 among its identifiers. Linux users of those ports should check that advisory and their distribution, since version numbers there differ from Apple's. The record also lists a Fedora package announcement.
The weakness is CWE-416.
How to check if you're exposed
On an iPhone or iPad, open Settings, then General, then About, and read the iOS or iPadOS version. Settings, General, Software Update shows whether a newer release is waiting.
On a Mac, the Terminal can print the installed macOS version and list pending updates:
sw_vers
softwareupdate --list
About This Mac in the Apple menu shows the same version number.
On Linux, find out whether WebKitGTK or WPE WebKit is installed and at what version using your package manager, for example:
dpkg -l | grep -i webkit
or the equivalent for your distribution, then compare with the distribution's advisory.
What to do now
- Update Apple devices to the 17.2 releases or later, and Safari to 17.2 or later.
- On Linux, update WebKitGTK or WPE WebKit packages as your distribution releases them.
- Rebuild any application that embeds WPE or WebKitGTK and pin the fixed version.
- Remove web views from applications that do not need to render web content.
- Add the fix to your tracker so each device class has a status.
Why it matters
A browser engine is the part of the system that has to read hostile input all day. The CWE-416 weakness is about code that keeps using memory after it has been freed. In a browser engine that can turn a crafted page into code running inside the browser process.
The vector in the record is network based and needs the user to load the content, which is the normal shape for web engine bugs. The fix is simple but the footprint is wide: Safari, every iOS web view, and the open source ports used on Linux and in embedded products. The KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does Chrome or Firefox have this bug?
The sources we read cover Apple's WebKit and the WebKitGTK and WPE ports. They do not say anything about other browser engines.
Sources
- oss-security: WebKitGTK and WPE WebKit Security Advisory WSA-2024-0002
- Apple: About the security content of iOS 17.2 and iPadOS 17.2
Last reviewed: 19 October 2026.
