EXPOSURES › CVE-2016-4657
CVE-2016-4657
HIGH ⌖ ON CISA KEV · EXPLOITEDApple iOS WebKit memory corruption flaw allows remote code execution via malicious websites.
A memory corruption vulnerability in Apple iOS WebKit enables attackers to execute arbitrary code or cause denial-of-service by visiting a crafted website. Defense-industrial-base organizations must ensure all iOS devices and WebKit-dependent systems are patched, as this flaw was actively exploited in the wild and represents a critical exposure to ransomware and data breaches.
Shame score — A memory corruption vulnerability in a widely used component like WebKit that allows remote code execution and was actively exploited in the wild demonstrates severe negligence and a high risk of data breach or ransomware infection.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Apple iOS WebKit contains a memory corruption vulnerability that allows attackers to execute remote code or cause a denial-of-service (DoS) via a crafted web site. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.