CVE-2016-4728

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-09-25 · updated 2026-06-17
Weakness: CWE-20

Description

WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 mishandles error prototypes, which allows remote attackers to execute arbitrary code via a crafted web site.

Affected products

Apple Iphone Os: before 10.0 — fixed in 10.0
Apple iTunes for Windows: before 12.5.1 — fixed in 12.5.1
Apple Safari: before 10.0 — fixed in 10.0
Apple tvOS: before 10.0 — fixed in 10.0

How to fix

Upgrade to a fixed version: Apple Iphone Os 10.0; Apple iTunes for Windows 12.5.1; Apple Safari 10.0; Apple tvOS 10.0. Check the vendor advisory for mitigations.

References

http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html
http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html
http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html
http://lists.apple.com/archives/security-announce/2016/Sep/msg00012.html
http://www.securityfocus.com/bid/93064
http://www.securitytracker.com/id/1036854
https://support.apple.com/HT207142
https://support.apple.com/HT207143
https://support.apple.com/HT207157
https://support.apple.com/HT207158
http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html
http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html

Get alerted when CVE-2016-4728 or the next vulnerability affects your stack