CVE-2023-41064: Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 16.6.1 and iPadOS 16.6.1, macOS Monterey 12.6.9, macOS Ventura 13.5.2, iOS 15.7.9 and iPadOS 15.7.9, macOS Big Sur 11.7.10. Processing a maliciously crafted image may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Other sources
Apple iOS, iPadOS, and macOS contain a buffer overflow vulnerability in ImageIO when processing a maliciously crafted image, which may lead to code execution. This vulnerability was chained with CVE-2023-41061.
— CISA
ImageIO. A buffer overflow issue was addressed with improved memory handling.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apple macOSto a version that resolves this vulnerability.Fixed in 11.7.10 - Upgrade
Upgrade
macOSto a version that resolves this vulnerability.Fixed in 12.6.9 - Upgrade
Upgrade
macOS Venturato a version that resolves this vulnerability.Fixed in 13.5.2 - Upgrade
Upgrade
Apple iOS and iPadOSto a version that resolves this vulnerability.Fixed in 16.6.1 - Upgrade
Upgrade
Apple iOS, iPadOS, and macOSto a version that resolves this vulnerability.Fixed in 16.6.1 - Upgrade
Upgrade
Apple iOS and iPadOSto a version that resolves this vulnerability.Fixed in 15.7.9 - Upgrade
Upgrade
Apple iOS, iPadOS, and macOSto a version that resolves this vulnerability.Fixed in 15.7.9 - Compensating control
Apply mitigations per vendor instructions; if mitigations are unavailable, discontinue use of the affected product.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2023-41064?
CVE-2023-41064 is a buffer overflow vulnerability affecting Apple iOS, iPadOS, and macOS.
How severe is CVE-2023-41064?
CVE-2023-41064 has a severity score of 7.8, which is considered high.
Which software versions are affected by CVE-2023-41064?
CVE-2023-41064 affects iOS versions up to but excluding 16.6.1, iPadOS versions up to but excluding 16.6.1, macOS Monterey versions up to but excluding 12.6.9, macOS Ventura versions up to but excluding 13.5.2, iOS versions up to but excluding 15.7.9, and iPadOS versions up to but excluding 15.7.9.
How can I fix CVE-2023-41064?
To fix CVE-2023-41064, update your iOS device to version 16.6.1 or later, update your iPadOS device to version 16.6.1 or later, update your macOS Monterey device to version 12.6.9 or later, update your macOS Ventura device to version 13.5.2 or later, update your iOS device to version 15.7.9 or later, or update your iPadOS device to version 15.7.9 or later.
Where can I find more information about CVE-2023-41064?
You can find more information about CVE-2023-41064 on the Apple support page at the following links: [link1] [link2] [link3]