HIGH

CVE-2023-41064

Apple Ipados 2023-09-07 CVSS v3.1

CVSS

7.8

KEV

Description

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 16.6.1 and iPadOS 16.6.1, macOS Monterey 12.6.9, macOS Ventura 13.5.2, iOS 15.7.9 and iPadOS 15.7.9, macOS Big Sur 11.7.10. Processing a maliciously crafted image may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Summary dbcve.org

A buffer overflow vulnerability in image processing components of iOS, iPadOS, and macOS allows arbitrary code execution when processing a maliciously crafted image. This vulnerability affects multiple major versions across all three platforms and has been confirmed as actively exploited in the wild.

Mitigation

Apply the available security updates (iOS 16.6.1/15.7.9, iPadOS 16.6.1/15.7.9, macOS 12.6.9/13.5.2/11.7.10) to all affected devices immediately, given confirmed active exploitation.

Weakness (CWE)

CWE-120 Classic Buffer Overflow

EPSS Score

44.78%

Probability of exploitation in next 30 days

98.7th percentile

References

http://www.openwall.com/lists/oss-security/2023/09/21/4 Mailing List https://support.apple.com/en-us/HT213905 Release Notes, Vendor Advisory https://support.apple.com/en-us/HT213906 Release Notes, Vendor Advisory https://support.apple.com/en-us/HT213913 Release Notes, Vendor Advisory https://support.apple.com/en-us/HT213914 Release Notes, Vendor Advisory https://support.apple.com/en-us/HT213915 Release Notes, Vendor Advisory https://support.apple.com/kb/HT213913 Release Notes, Vendor Advisory https://support.apple.com/kb/HT213915 Release Notes, Vendor Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41064 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE