CVE-2023-41064
Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability
Description
CVE-2023-41064 is a buffer overflow vulnerability in Apple iOS, iPadOS, and macOS that can be triggered by processing a maliciously crafted image, leading to arbitrary code execution on the affected device. The flaw resides in the image processing framework and was addressed by Apple with improved memory handling in iOS 16.6.1, iPadOS 16.6.1, macOS Ventura 13.5.2, macOS Monterey 12.6.9, macOS Big Sur 11.7.10, iOS 15.7.9, and iPadOS 15.7.9. Apple has acknowledged reports that CVE-2023-41064 may have been actively exploited in the wild prior to the patch release, and CISA has confirmed this by adding it to the Known Exploited Vulnerabilities catalog. With an EPSS score of 85.4% placing it in the 99.3rd percentile, this vulnerability represents a critical threat to unpatched Apple devices.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | ipados | < 15.7.9; >= 16.0, < 16.6.1 |
| apple | iphone os | < 15.7.9; >= 16.0, < 16.6.1 |
| apple | macos | >= 11.0, < 11.7.10; >= 12.0, < 12.6.9; >= 13.0, < 13.5.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://www.openwall.com/lists/oss-security/2023/09/21/4(Mailing List)
- https://support.apple.com/en-us/HT213905(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT213906(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT213913(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT213914(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT213915(Release Notes, Vendor Advisory)
- https://support.apple.com/kb/HT213913(Release Notes, Vendor Advisory)
- https://support.apple.com/kb/HT213915(Release Notes, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41064(US Government Resource)
Weakness Type
CWE-120: Buffer Copy without Checking Size of Input
CVE-2023-41064 involves a classic buffer overflow in Apple's image processing components, where input data from a crafted image is copied into a buffer without adequate size validation. This allows an attacker to overflow the buffer and overwrite adjacent memory, potentially corrupting program state and redirecting execution flow to attacker-controlled code.
Learn more: CWE-120 — Buffer Copy without Checking Size of Input
Impact Analysis
CVE-2023-41064 requires local access for exploitation, typically achieved by delivering a malicious image file to the target device through messaging, email, or web browsing. Attack Complexity (Low): no special conditions or timing requirements are needed for successful exploitation. Privileges Required (None): no authentication or prior access to the device is needed. User Interaction (Required): the victim must process the malicious image, though this may occur automatically depending on the delivery mechanism (e.g., iMessage processing images without user action). Confidentiality (High): successful exploitation can grant the attacker access to all data on the device, including messages, photos, credentials, and other sensitive personal information. Integrity (High): arbitrary code execution allows the attacker to install surveillance software, modify system configurations, and tamper with data. Availability (High): the attacker can crash applications, disable security features, or render the device unusable. With a CVSS score of 7.8 (High) and an EPSS score of 85.4%, CVE-2023-41064 poses an extreme risk, particularly as it has been linked to sophisticated spyware operations targeting individuals.
Exploit Maturity
Apple has confirmed that CVE-2023-41064 may have been actively exploited prior to the release of patches, and CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 2, 2023. The EPSS score of 85.4% places this vulnerability in the 99.3rd percentile, indicating a very high probability of exploitation activity. While no specific public exploit code is tagged in the available references, the confirmed zero-day exploitation in the wild and the association with sophisticated attack campaigns demonstrate that reliable exploit techniques exist. This vulnerability has been reported in the context of zero-click exploit chains used for deploying spyware on targeted devices, making it a critical concern for high-value targets.
Remediation
- Apply Apple security updates immediately: Update to iOS 16.6.1, iPadOS 16.6.1, macOS Ventura 13.5.2, macOS Monterey 12.6.9, macOS Big Sur 11.7.10, iOS 15.7.9, or iPadOS 15.7.9 as detailed in Apple's security advisories (HT213905, HT213906, HT213913, HT213914, HT213915). CISA required remediation by October 2, 2023.
- Enable automatic updates on all Apple devices: Configure iOS, iPadOS, and macOS devices to install security updates automatically to ensure timely protection against zero-day vulnerabilities. Verify that managed devices in enterprise environments receive updates through MDM policies.
- Enable Lockdown Mode for high-risk users: For individuals who may be targeted by sophisticated spyware attacks, enable Apple's Lockdown Mode on iOS 16+, iPadOS 16+, and macOS Ventura. Lockdown Mode restricts image processing and other attack surfaces that are commonly exploited in zero-click attack chains.
- Monitor devices for compromise indicators: Review Apple device logs and endpoint detection telemetry for signs of exploitation, including unexpected crashes in image processing services, unusual network connections, and anomalous process behavior. For organizations concerned about spyware, consider deploying mobile threat detection solutions.
- Implement defense-in-depth for image handling: Where possible, configure email and messaging gateways to strip or sanitize image attachments from untrusted sources. Restrict automatic image rendering in communication applications to reduce the attack surface for image-based exploits.
Technical Details
CVE-2023-41064 is a buffer overflow (CWE-120: Buffer Copy without Checking Size of Input) in Apple's image processing framework, where insufficient bounds checking during the processing of image data allows an attacker to trigger an out-of-bounds write by supplying a specially crafted image file. The vulnerability was addressed by Apple with improved memory handling, indicating that the fix involved adding proper size validation before buffer copy operations during image decoding. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) shows that while the attack vector is classified as local, the practical delivery mechanism is remote through messaging or web content that triggers local image processing, with low complexity, no privileges required, and user interaction limited to receiving and processing the image. The scope is unchanged, meaning the code execution occurs within the context of the image processing service, but given that this service runs with sufficient privileges on Apple platforms, successful exploitation can lead to complete device compromise including persistent access and data exfiltration.
Frequently Asked Questions
Is CVE-2023-41064 being actively exploited?
Yes, CVE-2023-41064 has been actively exploited in the wild. Apple acknowledged reports of active exploitation prior to releasing patches, and CISA confirmed this by adding the vulnerability to its Known Exploited Vulnerabilities catalog. The EPSS score of 85.4% further indicates a very high probability of ongoing exploitation.
What products are affected by CVE-2023-41064?
CVE-2023-41064 affects Apple iOS (versions prior to 16.6.1 and 15.7.9), iPadOS (versions prior to 16.6.1 and 15.7.9), macOS Ventura (prior to 13.5.2), macOS Monterey (prior to 12.6.9), and macOS Big Sur (prior to 11.7.10). All iPhones, iPads, and Macs running vulnerable versions are at risk.
How do I fix CVE-2023-41064?
Update to iOS 16.6.1, iPadOS 16.6.1, macOS Ventura 13.5.2, macOS Monterey 12.6.9, or macOS Big Sur 11.7.10. Enable automatic updates on all Apple devices and consider activating Lockdown Mode for users at elevated risk of targeted attacks.
How severe is CVE-2023-41064?
CVE-2023-41064 has a CVSS score of 7.8 (High severity) with full impact on confidentiality, integrity, and availability through arbitrary code execution. The EPSS score of 85.4% places it in the 99.3rd percentile, and its association with zero-day exploitation and sophisticated spyware campaigns makes it one of the most critical Apple vulnerabilities to remediate.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.