PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-7654 Apple CVE debrief

CVE-2016-7654 is a high-severity Apple WebKit memory-corruption issue that can be triggered through a crafted website. The supplied record ties it to remote code execution and denial of service on affected iOS, Safari, iCloud, and iTunes releases. Organizations should prioritize updating exposed Apple endpoints and user-facing browsers/apps to the fixed versions noted in the record.

Vendor
Apple
Product
Unknown
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-20
Original CVE updated
2026-05-13
Advisory published
2017-02-20
Advisory updated
2026-05-13

Who should care

Apple device and endpoint administrators, security teams managing iOS fleets, and users or support teams running affected Safari, iCloud, or iTunes versions on Apple platforms.

Technical summary

The NVD record classifies the weakness as CWE-119 and gives a CVSS v3.0 vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue is described as WebKit memory corruption reachable via a crafted website, enabling remote code execution or application crash. The supplied record describes affected releases as iOS before 10.2, Safari before 10.0.2, iCloud before 6.1, and iTunes before 12.5.4; the CPE criteria in the same record enumerate vulnerable versions up to iPhone OS 10.1.1, Safari 10.0.1, iCloud 6.0.1, and iTunes 12.5.3.

Defensive priority

High. Internet-reachable, user-triggered browser-content flaws with code execution potential should be patched promptly, especially on managed Apple devices still on affected versions.

Recommended defensive actions

  • Update iOS, Safari, iCloud, and iTunes on affected systems to the fixed releases referenced by the record (iOS 10.2, Safari 10.0.2, iCloud 6.1, and iTunes 12.5.4 or later).
  • Inventory Apple endpoints and confirm no devices remain on versions covered by the vulnerable CPE criteria in the record.
  • Prioritize remediation for systems that regularly browse untrusted web content or support higher-risk user workflows.
  • Use the linked Apple vendor advisories and NVD record to validate the version scope before and after patching.

Evidence notes

Evidence is drawn from the supplied NVD record, which includes Apple vendor advisory references, third-party advisories, the CVSS vector, and CPE criteria. The CVE was published on 2017-02-20 and last modified on 2026-05-13; use the publish date for disclosure timing and the modified date only as record-maintenance context. The record contains a version-scope discrepancy between the narrative description and the CPE criteria, so both are noted here.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-7654 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-7654

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-7654 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-7654

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.