CVE-2023-41061
Apple iOS, iPadOS, and watchOS Wallet Code Execution Vulnerability
Description
CVE-2023-41061 is a high-severity input validation vulnerability affecting Apple iOS, iPadOS, and watchOS. The flaw stems from improper validation logic that allows a maliciously crafted attachment to trigger arbitrary code execution on the target device. An attacker exploiting CVE-2023-41061 can gain full control over the affected Apple device, compromising the confidentiality, integrity, and availability of all data stored on it. Apple has acknowledged reports of active exploitation in the wild, and CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, underscoring the urgency of patching affected iOS, iPadOS, and watchOS devices.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | ipados | < 16.6.1 |
| apple | iphone os | < 16.6.1 |
| apple | watchos | < 9.6.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://seclists.org/fulldisclosure/2023/Sep/4(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2023/Sep/5(Mailing List, Third Party Advisory)
- https://support.apple.com/en-us/HT213905(Vendor Advisory)
- https://support.apple.com/en-us/HT213907(Vendor Advisory)
- https://support.apple.com/kb/HT213905(Vendor Advisory)
- https://support.apple.com/kb/HT213907(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41061(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
CWE-20 describes a weakness where software does not properly validate input, allowing attackers to craft inputs that are not expected by the rest of the application. In the case of CVE-2023-41061, Apple's watchOS, iOS, and iPadOS fail to adequately validate attachment data, enabling a specially crafted attachment to bypass security controls and execute arbitrary code.
Learn more: CWE-20 — Improper Input Validation
Impact Analysis
CVE-2023-41061 carries a CVSS v3.1 score of 7.8 (High), reflecting serious potential consequences when exploited. The vulnerability requires local access, meaning an attacker must deliver the malicious attachment to the device, for example via email or messaging, and user interaction is required to open or view it. However, no authentication or special privileges are needed to craft and send the exploit payload. Once triggered, the impact is severe across all three security dimensions: Confidentiality (High): an attacker can access all data on the device, including personal messages, credentials, and sensitive files. Integrity (High): arbitrary code execution allows the attacker to modify system files, install persistent malware, or alter application behavior. Availability (High): the attacker can render the device inoperable or disrupt critical services. With an EPSS score of 0.985% placing it in the 76.5th percentile, exploitation probability is moderate but the confirmed active exploitation in the wild makes immediate remediation essential.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-41061 in the wild by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 2, 2023. Apple itself acknowledged awareness of exploitation reports in its security advisory. No public proof-of-concept exploit code has been identified in the available references, suggesting this vulnerability may have been leveraged in targeted attacks rather than broadly available exploit campaigns. The EPSS score of 0.985% (76.5th percentile) indicates a moderate but real probability of exploitation activity, consistent with the targeted nature of many Apple zero-day attacks.
Remediation
- Apply Apple security updates immediately as directed by CISA's required action: update to iOS 16.6.1, iPadOS 16.6.1, or watchOS 9.6.2 or later to address the CVE-2023-41061 validation flaw. Refer to Apple's vendor advisories at HT213905 and HT213907 for device-specific guidance.
- Enforce Mobile Device Management (MDM) policies to ensure all managed iOS, iPadOS, and watchOS devices in your organization are running patched firmware versions and cannot defer critical security updates.
- Restrict attachment handling by configuring email gateways and messaging platforms to scan and quarantine suspicious attachments before they reach end-user devices, reducing the attack surface for maliciously crafted files.
- Monitor for indicators of compromise by reviewing device logs for unusual process execution, unexpected network connections, or signs of persistence mechanisms that could indicate prior exploitation of CVE-2023-41061.
- Educate users about attachment safety and reinforce the importance of not opening unexpected or suspicious attachments, especially from unknown senders, as user interaction is required to trigger this vulnerability.
Technical Details
CVE-2023-41061 is rooted in an improper input validation weakness (CWE-20) within Apple's attachment processing logic across iOS, iPadOS, and watchOS. The vulnerability arises because the affected software fails to apply sufficient validation checks on attachment data before processing it, allowing specially crafted content to bypass expected constraints. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates that while the attack vector is local — requiring the malicious attachment to be delivered to and opened on the device — the attack complexity is low, meaning no race conditions or special configurations are needed. The scope remains unchanged, so exploitation affects only the vulnerable component's security context, but given that this is the operating system itself, the impact encompasses the entire device. Apple addressed the flaw by improving the validation logic applied to attachments, ensuring that malformed or malicious content is properly rejected before it can trigger code execution.
Frequently Asked Questions
Is CVE-2023-41061 being actively exploited?
Yes, CVE-2023-41061 has been confirmed as actively exploited in the wild. Apple acknowledged reports of exploitation in its security advisories, and CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 2, 2023. While the ransomware association is currently unknown, the confirmed active exploitation makes immediate patching critical.
What products are affected by CVE-2023-41061?
CVE-2023-41061 affects Apple iOS, iPadOS, and watchOS. Specifically, the vulnerability is fixed in iOS 16.6.1, iPadOS 16.6.1, and watchOS 9.6.2, meaning all earlier versions of these operating systems are potentially vulnerable to the malicious attachment code execution flaw.
How do I fix CVE-2023-41061?
Update your Apple devices to iOS 16.6.1, iPadOS 16.6.1, or watchOS 9.6.2 or later immediately. These updates contain the improved validation logic that addresses the vulnerability. Use MDM solutions for enterprise-managed devices to enforce timely updates across your fleet.
How severe is CVE-2023-41061?
CVE-2023-41061 is rated High severity with a CVSS v3.1 score of 7.8 out of 10. Successful exploitation enables arbitrary code execution, giving an attacker full control over the device's data and functionality. The EPSS score places it in the 76.5th percentile for exploitation probability, and confirmed active exploitation elevates the practical risk significantly.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.