CVE-2023-41064: Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability

CVE-2023-41064 · Severity: critical · CVSS 7.8 · Exploited in the wild · Published 2023-09-11

A buffer overflow vulnerability in Apple's ImageIO framework allows for arbitrary code execution when processing a maliciously crafted image. The issue was addressed through improved memory handling across multiple Apple operating systems.

Technologies: Apple iPadOS, Apple macOS, Apple watchOS, Cisco IOS. Vendors: Apple, Cisco.

Quick answers

Is CVE-2023-41064 exploited in the wild?
Yes. CVE-2023-41064 is known to be exploited in the wild, first recorded on 11 September 2023. Treat it as urgent.
How severe is CVE-2023-41064?
Critical severity, with a CVSS score of 7.8, published 11 September 2023.
Which products and versions are affected?
Apple iOS up to 15.7.9, 16.0 to 16.6.1; Apple iPadOS up to 15.7.9, 16.0 to 16.6.1; Apple macOS Monterey up to 12.6.9; Apple macOS Ventura up to 13.5.2; and 1 more.
Is there a fix for CVE-2023-41064?
A patch was published on 2023-09-11: Fixed in iOS 16.6.1, iPadOS 16.6.1, macOS Monterey 12.6.9, macOS Ventura 13.5.2, iOS 15.7.9, iPadOS 15.7.9, and macOS Big Sur 11.7.10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-41064 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2023-41064?
Check whether you run Apple iPadOS, Apple macOS, Apple watchOS or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Affected products

  • Apple iOS up to 15.7.9, 16.0 to 16.6.1
  • Apple iPadOS up to 15.7.9, 16.0 to 16.6.1
  • Apple macOS Monterey up to 12.6.9
  • Apple macOS Ventura up to 13.5.2
  • Apple macOS Big Sur up to 11.7.10

Timeline

  • 2023-09-11: disclosed
  • 2023-09-11: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
  • 2023-09-11: patched: Fixed in iOS 16.6.1, iPadOS 16.6.1, macOS Monterey 12.6.9, macOS Ventura 13.5.2, iOS 15.7.9, iPadOS 15.7.9, and macOS Big Sur 11.7.10
  • 2023-09-11: exploited: Apple is aware of reports that this issue may have been actively exploited.

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.