BLACKOUT MAP

Apple · iOS, iPadOS, and macOS

CVE-2023-41064

Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability

Exploited in attacks High 7.8 Attack chance: 53%
Share

What it is

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 16.6.1 and iPadOS 16.6.1, macOS Monterey 12.6.9, macOS Ventura 13.5.2, iOS 15.7.9 and iPadOS 15.7.9, macOS Big Sur 11.7.10. Processing a maliciously crafted image may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

CISA: Apple iOS, iPadOS, and macOS contain a buffer overflow vulnerability in ImageIO when processing a maliciously crafted image, which may lead to code execution. This vulnerability was chained with CVE-2023-41061.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: October 2, 2023

Added to the CISA list
September 11, 2023
Published
September 7, 2023
Severity
High 7.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS)
53% in the top 1.0% of all known vulnerabilities
Weakness
CWE-120
More details
NVD · CVE.org · CISA
All references (6)

More exploited flaws from Apple

AddedVulnerabilityProductSeverityAttack chance
Aug 21, 2025Out-of-Bounds WriteCVE-2025-43300iOS, iPadOS, and macOSCritical 10.065%
Apr 10, 2023IOSurfaceAccelerator Out-of-Bounds WriteCVE-2023-28206iOS, iPadOS, and macOSHigh 8.623%
Mar 30, 2023Out-of-Bounds WriteCVE-2021-30900iOS, iPadOS, and macOSHigh 7.85.2%
Sep 14, 2022Remote Code ExecutionCVE-2022-32917iOS, iPadOS, and macOSHigh 7.85.6%
Sep 8, 2022Input ValidationCVE-2020-9934iOS, iPadOS, and macOSMedium 5.53.2%
Feb 11, 2022Webkit Use-After-FreeCVE-2022-22620iOS, iPadOS, and macOSHigh 8.816%
Nov 3, 2021WebKit Remote Code ExecutionCVE-2021-1870iOS, iPadOS, and macOSCritical 9.87.7%
Nov 3, 2021WebKit Remote Code ExecutionCVE-2021-1871iOS, iPadOS, and macOSCritical 9.87.0%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.