CVE-2023-41064

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS...

7.8 HighIn KEVPublic exploit

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 16.6.1 and iPadOS 16.6.1, macOS Monterey 12.6.9, macOS Ventura 13.5.2, iOS 15.7.9 and iPadOS 15.7.9, macOS Big Sur 11.7.10. Processing a maliciously crafted image may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

53.4%Up 53.3 points since Sep 8, 2023

What each source reports

NVD Score used 7.8

Record: CVE-2023-41064
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-120
Updated: 2026-11-02

CVE List 7.8

Record: CVE-2023-41064
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-120
Updated: 2026-11-02

EUVDEUVD-2023-45585 7.8

Record: EUVD-2023-45585
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-8c6q-gxj3-w77f 7.8

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS...

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.5.2, iOS 16.6.1 and iPadOS 16.6.1. Processing a maliciously crafted image may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Record: GHSA-8c6q-gxj3-w77f
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-120
Updated: 2026-11-02

CISA KEV No score

Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability

Apple iOS, iPadOS, and macOS contain a buffer overflow vulnerability in ImageIO when processing a maliciously crafted image, which may lead to code execution. This vulnerability was chained with CVE-2023-41061.

Record: CVE-2023-41064
Weakness: CWE-120
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	MrR0b0t19/vulnerabilidad-LibWebP-CVE-2023-41064	2023-10-30
PoC in GitHub	MrR0b0t19/CVE-2023-41064	2023-11-13
PoC in GitHub	K4Der11000/k4_cve-2023-41064	2025-04-25

History

History
Recorded	Changed	Sources
Nov 3, 2026	exploitation, exploits
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, CISA KEV, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-41064 is a high vulnerability (CVSS 7.8) in Apple Ipados, published September 7, 2023. CISA lists it as known to be exploited, since September 11, 2023. EUVD reports exploitation since September 11, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 53.4%, the 98th percentile. No source names a fixed version.

References

Show 13 moreShow less