ZeroDay Findings
Sign inSign up

Findings

CVE-2023-41061

Apple iOS, iPadOS, and watchOS Wallet Code Execution Vulnerability

Published Sep 7, 2023 · updated Jun 16, 2026 · apple ipados

A validation issue was addressed with improved logic. This issue is fixed in watchOS 9.6.2, iOS 16.6.1 and iPadOS 16.6.1. A maliciously crafted attachment may result in arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 7, 2023 · Catalog

    Detected

    A validation issue was addressed with improved logic. This issue is fixed in watchOS 9.6.2, iOS 16.6.1 and iPadOS 16.6.1. A maliciously crafted attachment may result in arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

  2. Sep 11, 2023 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  3. Oct 2, 2023 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  4. Jun 16, 2026 · Catalog

    Updated

    A validation issue was addressed with improved logic. This issue is fixed in watchOS 9.6.2, iOS 16.6.1 and iPadOS 16.6.1. A maliciously crafted attachment may result in arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date Oct 2, 2023

Affected

  • cpe apple/ipadosversion unspecified
  • cpe apple/iphone osversion unspecified
  • cpe apple/watchosversion unspecified
  • vendor Apple iOS, iPadOS, and watchOSversion unspecified

Sources

  • CISA KEVCVE-2023-41061

    Apple iOS, iPadOS, and watchOS contain an unspecified vulnerability due to a validation issue affecting Wallet in which a maliciously crafted attachment may result in code execution. This vulnerability was chained with CVE-2023-41064.

    cisa.gov
  • CVE.orgCVE-2023-41061

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2023-41061

    30-day exploitation probability 4.4%

    first.org
  • NIST NVDCVE-2023-41061

    A validation issue was addressed with improved logic. This issue is fixed in watchOS 9.6.2, iOS 16.6.1 and iPadOS 16.6.1. A maliciously crafted attachment may result in arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

    nvd.nist.gov

References