Actively exploited · Published Sep 7, 2023 · Assigned by apple
CVE-2023-41061
High 7.8 Exploited
In plain English
A high-severity improper input validation in iOS and iPadOS from Apple. Attackers are actively exploiting it in the wild (listed by CISA on September 11, 2023). The chance it is exploited in the next 30 days is estimated at 4.4% (higher than 91% of all known vulnerabilities). Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Oct 2, 2023.
Official description
A validation issue was addressed with improved logic. This issue is fixed in watchOS 9.6.2, iOS 16.6.1 and iPadOS 16.6.1. A maliciously crafted attachment may result in arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apple | iOS and iPadOS | unspecified – before 16.6 |
| Apple | watchOS | unspecified – before 9.6 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://support.apple.com/en-us/HT213905
- https://support.apple.com/en-us/HT213907
- https://support.apple.com/kb/HT213907
- https://support.apple.com/kb/HT213905
- http://seclists.org/fulldisclosure/2023/Sep/5
- http://seclists.org/fulldisclosure/2023/Sep/4
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41061 government-resource