CVE-2023-41064
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS...
CVE-2023-41064 is a high vulnerability (CVSS 7.8) in Apple Ipados, published September 7, 2023. CISA lists it as known to be exploited, since September 11, 2023. EUVD reports exploitation since September 11, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 53.4%, the 99th percentile. No source names a fixed version.
- Severity
- 7.8 HighCVSS 3.1, NVD
- Exploit chance
- 53.4%EPSS, 99th percentile
- Exploitation
- ExploitedCISA KEV,
- Fixed in
- No fix listedNo source names one
Description
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 16.6.1 and iPadOS 16.6.1, macOS Monterey 12.6.9, macOS Ventura 13.5.2, iOS 15.7.9 and iPadOS 15.7.9, macOS Big Sur 11.7.10. Processing a maliciously crafted image may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | MrR0b0t19/vulnerabilidad-LibWebP-CVE-2023-41064 | 2023-10-30 |
| PoC in GitHub | MrR0b0t19/CVE-2023-41064 | 2023-11-13 |
| PoC in GitHub | K4Der11000/k4_cve-2023-41064 | 2025-04-25 |
What each source reports
NVD Score used
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 16.6.1 and iPadOS 16.6.1, macOS Monterey 12.6.9, macOS Ventura 13.5.2, iOS 15.7.9 and iPadOS 15.7.9, macOS Big Sur 11.7.10. Processing a maliciously crafted image may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
- Record
CVE-2023-41064- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
CVE List
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 16.6.1 and iPadOS 16.6.1, macOS Monterey 12.6.9, macOS Ventura 13.5.2, iOS 15.7.9 and iPadOS 15.7.9, macOS Big Sur 11.7.10. Processing a maliciously crafted image may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
- Record
CVE-2023-41064- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
EUVDEUVD-2023-45585
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 16.6.1 and iPadOS 16.6.1, macOS Monterey 12.6.9, macOS Ventura 13.5.2, iOS 15.7.9 and iPadOS 15.7.9, macOS Big Sur 11.7.10. Processing a maliciously crafted image may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
- Record
EUVD-2023-45585- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8c6q-gxj3-w77f
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS...
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.5.2, iOS 16.6.1 and iPadOS 16.6.1. Processing a maliciously crafted image may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
- Record
GHSA-8c6q-gxj3-w77f- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
CISA KEVNo score
Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability
Apple iOS, iPadOS, and macOS contain a buffer overflow vulnerability in ImageIO when processing a maliciously crafted image, which may lead to code execution. This vulnerability was chained with CVE-2023-41061.
- Record
CVE-2023-41064- Weakness
- CWE-120
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
support.apple.com/en-us/HT213914
openwall.com/lists/oss-security/2023/09/21/4
Show 13 moreShow less
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41064
nvd.nist.gov/vuln/detail/CVE-2023-41064
seclists.org/fulldisclosure/2023/Sep/3
github.com/advisories/GHSA-8c6q-gxj3-w77f