ZeroDay Findings
Sign inSign up

Findings

CVE-2023-41064

Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability

Published Sep 7, 2023 · updated Jun 16, 2026 · apple ipados

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 16.6.1 and iPadOS 16.6.1, macOS Monterey 12.6.9, macOS Ventura 13.5.2, iOS 15.7.9 and iPadOS 15.7.9, macOS Big Sur 11.7.10. Processing a maliciously crafted image may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 7, 2023 · Catalog

    Detected

    A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 16.6.1 and iPadOS 16.6.1, macOS Monterey 12.6.9, macOS Ventura 13.5.2, iOS 15.7.9 and iPadOS 15.7.9, macOS Big Sur 11.7.10. Processing a maliciously crafted image may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

  2. Sep 11, 2023 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  3. Oct 2, 2023 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  4. Jun 16, 2026 · Catalog

    Updated

    A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 16.6.1 and iPadOS 16.6.1, macOS Monterey 12.6.9, macOS Ventura 13.5.2, iOS 15.7.9 and iPadOS 15.7.9, macOS Big Sur 11.7.10. Processing a maliciously crafted image may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date Oct 2, 2023

Affected

  • cpe apple/ipadosversion unspecified
  • cpe apple/iphone osversion unspecified
  • cpe apple/macosversion unspecified
  • vendor Apple iOS, iPadOS, and macOSversion unspecified

Sources

  • CISA KEVCVE-2023-41064

    Apple iOS, iPadOS, and macOS contain a buffer overflow vulnerability in ImageIO when processing a maliciously crafted image, which may lead to code execution. This vulnerability was chained with CVE-2023-41061.

    cisa.gov
  • CVE.orgCVE-2023-41064

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2023-41064

    30-day exploitation probability 53.4%

    first.org
  • NIST NVDCVE-2023-41064

    A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 16.6.1 and iPadOS 16.6.1, macOS Monterey 12.6.9, macOS Ventura 13.5.2, iOS 15.7.9 and iPadOS 15.7.9, macOS Big Sur 11.7.10. Processing a maliciously crafted image may lead to arbitrary

    nvd.nist.gov

References