CVE-2023-41991
Apple Multiple Products Improper Certificate Validation Vulnerability
Description
CVE-2023-41991 is a certificate validation vulnerability in Apple iOS, iPadOS, and macOS that allows a malicious application to bypass signature validation. The flaw, classified as improper certificate validation (CWE-295), was addressed in iOS 16.7, iPadOS 16.7, and macOS Ventura 13.6. Apple has confirmed that CVE-2023-41991 may have been actively exploited against versions of iOS prior to iOS 16.7, making this a high-priority security update. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 3.2% (87th percentile), all users of affected Apple devices should update immediately.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | ipados | < 16.7; 17.0 |
| apple | iphone os | < 16.7; 17.0 |
| apple | macos | >= 13.0, < 13.6 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References
- https://support.apple.com/en-us/HT213927(Vendor Advisory)
- https://support.apple.com/en-us/HT213931(Vendor Advisory)
- https://support.apple.com/kb/HT213927(Vendor Advisory)
- https://support.apple.com/kb/HT213931(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41991(US Government Resource)
Weakness Type
CWE-295: Improper Certificate Validation
Improper certificate validation occurs when an application fails to correctly verify the authenticity or integrity of a digital certificate, allowing attackers to bypass security controls that depend on certificate-based trust. In CVE-2023-41991, the certificate validation mechanism in Apple's operating systems does not properly verify code signing certificates, enabling a malicious application to present an invalid or forged signature that is incorrectly accepted as valid.
Learn more: CWE-295 — Improper Certificate Validation
Impact Analysis
CVE-2023-41991 is rated Medium severity with a CVSS 3.1 score of 5.5, reflecting a targeted but significant security bypass. The attack vector is local, meaning the attacker must deliver a malicious application to the victim's device, and user interaction is required — the victim must install or execute the malicious app. However, no special privileges are needed to launch the attack, and the attack complexity is low, indicating that no special conditions are required beyond delivering the payload. Confidentiality (None): The vulnerability does not directly expose confidential data. Integrity (High): The primary impact is the ability to bypass signature validation, which undermines the entire code signing trust model that Apple's operating systems rely on to ensure only verified software runs on devices. An attacker who bypasses signature validation can install and execute unauthorized code that appears to be legitimately signed. Availability (None): No direct availability impact has been identified. While the CVSS score is moderate, the real-world significance is substantial because bypassing signature validation is a foundational step in sophisticated attack chains, potentially enabling the installation of spyware or other malicious software that evades Apple's security controls.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-41991 in the wild by adding it to the Known Exploited Vulnerabilities (KEV) catalog, with a remediation deadline of October 16, 2023. Apple's own advisory explicitly states that this issue may have been actively exploited against versions of iOS before iOS 16.7, confirming real-world exploitation in targeted attacks. The EPSS score of 3.2% places this vulnerability in the 87th percentile, indicating a significantly elevated exploitation probability. While the ransomware association is currently listed as unknown, certificate validation bypasses of this nature are commonly used in targeted surveillance operations and advanced persistent threat (APT) campaigns against high-value individuals.
Remediation
- Update Apple devices immediately as directed by the KEV required action: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Update iOS and iPadOS to version 16.7 or later, and macOS Ventura to version 13.6 or later, as documented in Apple's support articles HT213927 and HT213931.
- Enable automatic updates on all Apple devices to ensure future security patches are applied promptly. Navigate to Settings > General > Software Update and enable automatic updates for both iOS/iPadOS and macOS.
- Audit installed applications on affected devices for any applications that may have been installed from untrusted sources, sideloaded, or distributed through enterprise deployment mechanisms that could have exploited the signature validation bypass.
- Implement mobile device management (MDM) controls to restrict application installation to approved sources only, enforce device encryption, and monitor for policy violations that could indicate exploitation of the certificate validation flaw.
- Review device logs and security alerts for indicators of compromise, particularly signs of unauthorized application installation, unexpected provisioning profile activity, or certificate-related anomalies that may indicate exploitation of CVE-2023-41991.
Technical Details
CVE-2023-41991 is an improper certificate validation vulnerability (CWE-295) in Apple's code signing verification subsystem that affects iOS, iPadOS, and macOS. The flaw resides in how the operating system validates digital certificates during the signature verification process for applications — specifically, the validation logic fails to properly check certain certificate properties, allowing a malicious application to present a certificate that should be rejected but is instead accepted as valid. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) indicates that while exploitation requires local access and user interaction (installing the malicious app), the attack complexity is low and no privileges are needed. The high integrity impact reflects the fundamental undermining of Apple's code signing infrastructure — once signature validation is bypassed, the trust chain that prevents unauthorized code execution is broken. This type of vulnerability is particularly valuable in targeted exploitation scenarios where attackers need to deploy custom implants or spyware on victim devices while evading the operating system's built-in security mechanisms.
Frequently Asked Questions
Is CVE-2023-41991 being actively exploited?
Yes, CVE-2023-41991 has been actively exploited in the wild. Apple has confirmed that this issue may have been actively exploited against versions of iOS before iOS 16.7, and CISA has added it to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of October 16, 2023. The exploitation has been linked to targeted attacks rather than widespread campaigns.
What products are affected by CVE-2023-41991?
CVE-2023-41991 affects Apple iOS (versions prior to 16.7), iPadOS (versions prior to 16.7), and macOS Ventura (versions prior to 13.6). This means iPhones, iPads, and Macs running unpatched versions of these operating systems are vulnerable to the certificate validation bypass.
How do I fix CVE-2023-41991?
Update your Apple devices to the latest software versions: iOS 16.7 or later, iPadOS 16.7 or later, and macOS Ventura 13.6 or later. The fixes are available through Apple's standard software update mechanism. Enable automatic updates to ensure timely application of future security patches. See the Remediation section for additional hardening steps.
How severe is CVE-2023-41991?
CVE-2023-41991 is rated Medium severity with a CVSS 3.1 score of 5.5. While the numerical score is moderate, the real-world impact is significant because bypassing signature validation undermines Apple's core security model for application trust. The EPSS score of 3.2% (87th percentile) and confirmed active exploitation make this a high-priority update for all Apple device users.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.