Apple WebKit CVE-2023-42916/42917: Spyware Zero-Day Pair

What to do

1. Pull an OS version report from MDM and flag iPhones and iPads below 17.1.2, 16.7.3 or 15.8.1 on their branch.
2. On Macs, check sw_vers -productVersion and the Safari version; flag Sonoma below 14.1.2 and Monterey or Ventura with Safari below 17.1.2.
3. Update every device to the newest build it supports, not just the 2023 fix, and enforce a minimum OS version in MDM.
4. On Linux, update WebKitGTK and WPE WebKit to 2.42.3 or later, including copies bundled inside apps.
5. Retire or block from corporate access any device too old for iOS 15.8.1; none of Apple's listed fixes cover it.

How to check if you are affected or compromised

• Use MDM history to find devices that ran iOS before 16.7.1 in 2023, the versions Apple says were targeted.
• Run dpkg -l 'libwebkit2gtk*' or rpm -qa 'webkit2gtk*' on Linux hosts and flag versions below 2.42.3.
• No public indicators exist for the PARS Defense tooling as of Oct 23, 2026; for high-risk users' devices, get a professional forensic review.

What happened#

On November 30, 2023, Apple released iOS and iPadOS 17.1.2, macOS Sonoma 14.1.2 and Safari 17.1.2 to fix two WebKit bugs. Clément Lecigne of Google's Threat Analysis Group reported both. Apple's iOS advisory describes CVE-2023-42916 as an out-of-bounds read that "may disclose sensitive information." CVE-2023-42917 is a memory corruption bug, "addressed with improved locking," that may lead to arbitrary code execution. Both trigger when WebKit processes malicious web content. For each, Apple said it "is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1." Apple did not say how the two were used together.

CISA added both to the KEV catalog on December 4, 2023, with a December 25 deadline. The entries warn that the bugs could affect "non-Apple products which rely on WebKit for HTML processing." Apple backported the fixes to iOS 16.7.3 on December 11, 2023 and to iOS 15.8.1 on January 22, 2024. WebKitGTK and WPE WebKit fixed both in 2.42.3 (WSA-2023-0011).

In February 2024, Google's Buying Spying report listed both CVEs under PARS Defense. SecurityWeek describes PARS as a Turkish company. The report says such vendors sell governments tools that exploit consumer devices to install spyware. Victims, delivery method and indicators were still not disclosed as of Oct 23, 2026.

Who is affected#

According to Apple and NVD, the affected versions are iOS and iPadOS before 17.1.2 on the 17 line, before 16.7.3 on 16, and before 15.8.1 on 15. Also affected are macOS Sonoma before 14.1.2, Safari before 17.1.2 on Monterey and Ventura, and WebKitGTK and WPE WebKit before 2.42.3. Help Net Security noted that WebKit powers every browser on iOS and iPadOS, so switching browsers did not help. NVD scores CVE-2023-42917 at CVSS 3.1 8.8 and CVE-2023-42916 at 6.5.

Do you really need to act?#

Most fleets moved past these builds in late 2023, so the verdict is check exposure. The risk sits in three places: iPhones and iPads that stopped updating, Linux apps that bundle an old WebKitGTK, and devices of people a government might target. A device below these builds is also open to later WebKit zero-days in KEV. One is CVE-2024-23222, which Google says the Coruna exploit kit used against iOS 16.6 through 17.2.1. Another is CVE-2025-43529 from the DarkSword chain, which has its own brief. The goal is current builds, not just these two fixes.

What to do now#

1. Pull an OS version report from MDM and flag iPhones and iPads below 17.1.2, 16.7.3 or 15.8.1 on their branch.
2. On Macs, run sw_vers -productVersion and defaults read /Applications/Safari.app/Contents/Info CFBundleShortVersionString. Flag Sonoma below 14.1.2, and Monterey or Ventura with Safari below 17.1.2.
3. Update every device to the newest build it supports, and enforce a minimum OS version in MDM.
4. On Linux, run dpkg -l 'libwebkit2gtk*' or rpm -qa 'webkit2gtk*' and update anything below 2.42.3.
5. Retire or block devices too old for iOS 15.8.1. None of Apple's listed fixes cover them.

How to tell if you were hit#

A version check only shows whether a device was exposed. Apple says exploitation targeted iOS before 16.7.1, so look in MDM history for devices that ran those versions in 2023. No public indicators exist for the PARS Defense tooling as of Oct 23, 2026. If a journalist, activist, executive or official used such a device, get a professional forensic review.

Timeline#

• Nov 30, 2023 — Apple ships iOS 17.1.2, macOS Sonoma 14.1.2 and Safari 17.1.2.
• Dec 4, 2023 — CISA adds both CVEs to KEV.
• Dec 5, 2023 — WebKitGTK and WPE WebKit publish WSA-2023-0011.
• Dec 11, 2023 — iOS and iPadOS 16.7.3 carry the fixes.
• Dec 25, 2023 — Federal remediation deadline.
• Jan 22, 2024 — iOS and iPadOS 15.8.1 carry the fixes.
• Feb 6, 2024 — SecurityWeek reports Google's attribution of both CVEs to PARS Defense.

Vulnerability records

• CVE-2023-42916 · KEV 2023-12-04 · An out-of-bounds read was addressed with improved input validation.
• CVE-2023-42917 · KEV 2023-12-04 · A memory corruption vulnerability was addressed with improved locking.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Apple — About the security content of iOS 17.1.2 and iPadOS 17.1.2 support.apple.com
2. Apple — About the security content of macOS Sonoma 14.1.2 support.apple.com
3. Apple — About the security content of Safari 17.1.2 support.apple.com
4. Apple — About the security content of iOS 16.7.3 and iPadOS 16.7.3 support.apple.com
5. Apple — About the security content of iOS 15.8.1 and iPadOS 15.8.1 support.apple.com
6. WebKitGTK and WPE WebKit — Security Advisory WSA-2023-0011 webkitgtk.org
7. CVE record — CVE-2023-42917 cve.org
8. CVE record — CVE-2023-42916 cve.org
9. NVD — CVE-2023-42917 nvd.nist.gov
10. NVD — CVE-2023-42916 nvd.nist.gov
11. CISA — Known Exploited Vulnerabilities: CVE-2023-42917 cisa.gov
12. CISA — Known Exploited Vulnerabilities: CVE-2023-42916 cisa.gov
13. CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog (Dec 4, 2023) cisa.gov
14. Google — Buying Spying: Insights into Commercial Surveillance Vendors storage.googleapis.com
15. Google Threat Intelligence Group — Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit cloud.google.com

Coverage and analysis

1. SecurityWeek — Google Links Over 60 Zero-Days to Commercial Spyware Vendors securityweek.com
2. Help Net Security — Apple patches two zero-days used to target iOS users (CVE-2023-42916, CVE-2023-42917) helpnetsecurity.com