Memory corruption in Apple Safari and Apple iOS - CVE-2016-4657
Published: August 25, 2016 / Updated: May 24, 2022
Vulnerability identifier: #VU4575
CSH Severity: Critical
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-4657
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to boundary error in WebKit. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note: the vulnerability was being actively exploited.
Affected software
Apple Safari
Apple iOS
Apple iOS
How to mitigate CVE-2016-4657
Update to version 9.3.5.
Links to Public Exploits and PoC-codes
- Exploit #6416 - Nintendo Switch - WebKit Code Execution (PoC) (June 17, 2021)
- Exploit #2094 - Switcheroo (Exploiting CVE-2016-4657 to JailBreak the Nintendo Switch) (March 18, 2020)
- Exploit #1901 - CVE-2016-4657-Switch-Browser-Binary (code for webkit exploit, Nintendo Switch) (March 18, 2020)
- Exploit #1847 - WebKit not_number defineProperties UAF (March 18, 2020)