PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-4743 Apple CVE debrief

CVE-2016-4743 is a WebKit memory-corruption issue affecting multiple Apple products. According to the CVE description, a crafted website could be used to obtain sensitive information from process memory or cause a denial of service through memory corruption and application crash behavior. Apple software named in the record includes iOS, Safari, iCloud, and iTunes, with fixed-version guidance referenced through Apple support advisories and the NVD record.

Vendor
Apple
Product
CVE-2016-4743
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-20
Original CVE updated
2026-05-13
Advisory published
2017-02-20
Advisory updated
2026-05-13

Who should care

Apple device administrators, security teams managing Safari/iOS endpoints, and users or fleets running the affected Apple software versions should prioritize this issue. It is especially relevant anywhere WebKit-based browsing or embedded web content is common.

Technical summary

The issue is a WebKit memory corruption flaw (CWE-119) in Apple software. The public record indicates that visiting a crafted website could trigger exposure of sensitive process memory or an application crash/denial of service. NVD assigns CVSS 3.0 7.1 (HIGH) and lists confidentiality and availability impact, with user interaction required in the vector metadata.

Defensive priority

High

Recommended defensive actions

  • Review Apple’s linked vendor advisories for the affected product lines and confirm patch levels against the fixed versions referenced in the CVE record.
  • Prioritize upgrades for iOS, Safari, iCloud, and iTunes instances that fall below the affected-version cutoffs in the record.
  • Treat browser and web-content paths as the main exposure area and ensure WebKit-dependent software is updated promptly across managed endpoints.
  • Use standard vulnerability management to verify remediation status, since the NVD record and Apple advisories are the authoritative references in this corpus.

Evidence notes

The supplied CVE description states that iOS before 10.2, Safari before 10.0.2, iCloud before 6.1, and iTunes before 12.5.4 are affected, and that the issue involves WebKit. The NVD metadata also maps the issue to CWE-119 and provides CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H. The NVD CPE criteria in the corpus show slightly different cutoff values for some products (for example, iPhone OS through 10.1.1, Safari through 10.0.1, iCloud through 6.0.1, and iTunes through 12.5.3), so the vendor advisory links should be used alongside the narrative description when validating exposure.

Official resources

Publicly disclosed in the CVE record on 2017-02-20T08:59:01.277Z. Use that publication date, not later record modification timestamps, for disclosure timing.