Apple · iOS, iPadOS, and watchOS
CVE-2023-41061
Apple iOS, iPadOS, and watchOS Wallet Code Execution Vulnerability
What it is
A validation issue was addressed with improved logic. This issue is fixed in watchOS 9.6.2, iOS 16.6.1 and iPadOS 16.6.1. A maliciously crafted attachment may result in arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
CISA: Apple iOS, iPadOS, and watchOS contain an unspecified vulnerability due to a validation issue affecting Wallet in which a maliciously crafted attachment may result in code execution. This vulnerability was chained with CVE-2023-41064.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: October 2, 2023
More exploited flaws from Apple
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Nov 3, 2021 | Out-of-Bounds Write | iOS, iPadOS, and watchOS | High 8.8 | 2.3% |
| Nov 3, 2021 | Memory Corruption | iOS, iPadOS, and watchOS | Medium 4.3 | 2.2% |
| Nov 3, 2021 | WebKit Cross-Site Scripting (XSS) | iOS, iPadOS, and watchOS | Medium 6.1 | 7.1% |
| Sep 29, 2026 | Out-of-Bounds Write | Multiple Products | High 8.8 | 26% |
| Aug 18, 2026 | Improper Authentication | macOS | Critical 9.8 | 1.7% |
| Mar 20, 2026 | Buffer Overflow | Multiple Products | High 8.8 | 1.7% |
| Mar 20, 2026 | Improper Locking | Multiple Products | High 7.8 | 0.4% |
| Mar 20, 2026 | Classic Buffer Overflow | Multiple Products | Medium 5.5 | 0.4% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.