CVE-2023-41061

high

Description

A validation issue was addressed with improved logic. This issue is fixed in watchOS 9.6.2, iOS 16.6.1 and iPadOS 16.6.1. A maliciously crafted attachment may result in arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

References

http://seclists.org/fulldisclosure/2023/Sep/5

http://seclists.org/fulldisclosure/2023/Sep/4

https://googleprojectzero.blogspot.com/2025/03/blasting-past-webp.html

https://www.darkreading.com/mobile-security/apple-drops-another-webkit-zero-day-bug

https://www.bleepingcomputer.com/news/apple/apple-fixes-webkit-zero-day-exploited-in-extremely-sophisticated-attacks/

https://www.bleepingcomputer.com/news/apple/apple-fixes-zero-day-exploited-in-extremely-sophisticated-attacks/

https://securityaffairs.com/174066/hacking/apple-fixes-iphone-and-ipad-bug-exploited-in-extremely-sophisticated-attacks.html

https://www.bleepingcomputer.com/news/security/apple-fixes-this-years-first-actively-exploited-zero-day-bug/

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-317a

https://storage.googleapis.com/gweb-uniblog-publish-prod/documents/Year_in_Review_of_ZeroDays.pdf

https://www.tenable.com/blog/cve-2023-41064-cve-2023-4863-cve-2023-5129-faq-imageio-webp-zero-days

https://support.apple.com/kb/HT213907

https://support.apple.com/kb/HT213905

https://support.apple.com/en-us/HT213907

https://support.apple.com/en-us/HT213905

Details

Source: Mitre, NVD

Published: 2023-09-07

Updated: 2024-11-29

Named Vulnerability: BLASTPASSKnown Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 7.2

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 7.8

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Severity: High

EPSS

EPSS: 0.03562