PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-4666 Apple CVE debrief

CVE-2016-4666 is a high-severity Apple WebKit memory-corruption issue that could let a remote attacker use a crafted website to execute code or crash the browser/process. NVD lists iOS versions before 10.1, Safari before 10.0.1, and tvOS before 10.0.1 as affected.

Vendor
Apple
Product
Safari
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-20
Original CVE updated
2026-05-13
Advisory published
2017-02-20
Advisory updated
2026-05-13

Who should care

Organizations and individuals running affected Apple devices or browsers should care, especially endpoint teams managing iOS, Safari, and tvOS fleets. Because the attack path is a crafted website and the CVSS vector includes user interaction, anyone who may browse untrusted content on affected versions is in scope.

Technical summary

The CVE record describes a WebKit component memory corruption flaw (CWE-119). NVD classifies it as network-reachable with low attack complexity, no privileges required, and user interaction required (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The outcome can be arbitrary code execution or denial of service via application crash when a crafted website is processed.

Defensive priority

High. The issue combines remote delivery, code-execution potential, and affected consumer-facing software. Prioritize patching or upgrading any exposed Apple device or Safari installation at or below the vulnerable versions.

Recommended defensive actions

  • Upgrade iOS to 10.1 or later on affected devices.
  • Upgrade Safari to 10.0.1 or later on affected systems.
  • Upgrade tvOS to 10.0.1 or later on affected devices.
  • Review asset inventories for Apple endpoints that may still run pre-fix versions.
  • Treat untrusted web content as a trigger path on vulnerable systems until upgrades are complete.

Evidence notes

The CVE record and NVD detail identify Apple as the vendor and WebKit as the affected component. The supplied NVD metadata lists the vulnerable version ranges: iOS before 10.1, Safari before 10.0.1, and tvOS before 10.0.1. NVD also assigns CWE-119 and CVSS v3.0 8.8 High with user interaction required. Public disclosure date in the supplied record is 2017-02-20T08:59:00.447Z; the record was last modified on 2026-05-13T00:24:29.033Z.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-4666 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-4666

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-4666 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-4666

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.