CVE-2023-41061: Apple iOS, iPadOS, and watchOS Wallet Code Execution Vulnerability

Reference Links

• https://support.apple.com/en-us/HT213907 (Advisory)
• http://seclists.org/fulldisclosure/2023/Sep/4
• http://seclists.org/fulldisclosure/2023/Sep/5
• https://support.apple.com/en-us/HT213905 (Advisory)
• https://support.apple.com/kb/HT213905
• https://support.apple.com/kb/HT213907
• https://support.apple.com/en-us/HT213905,
• https://support.apple.com/kb/HT213907;
• https://nvd.nist.gov/vuln/detail/CVE-2023-41061

Parent vulnerabilities

(Appears in the following advisories)

• HT213907
• HT213905

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2023-41061
• CVE-2023-41064

Frequently Asked Questions

• What is CVE-2023-41061?

  CVE-2023-41061 is a code execution vulnerability in Apple iOS, iPadOS, and watchOS that allows for arbitrary code execution due to a validation issue with attachments.

• How severe is CVE-2023-41061?

  CVE-2023-41061 has a severity rating of 7.8 out of 10, which is considered high.

• Which software versions are affected by CVE-2023-41061?

  CVE-2023-41061 affects watchOS versions up to and excluding 9.6.2, iOS versions up to and excluding 16.6.1, and iPadOS versions up to and excluding 16.6.1.

• How can I fix CVE-2023-41061?

  To fix CVE-2023-41061, update your device to watchOS 9.6.2, iOS 16.6.1, or iPadOS 16.6.1.

• Is there any known exploitation of CVE-2023-41061?

  Apple is aware of a report that CVE-2023-41061 may have been actively exploited.