Input validation error in iPadOS and Apple iOS - CVE-2023-41061
Published: September 7, 2023
Vulnerability identifier: #VU80543
CSH Severity: Critical
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-41061
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to insufficient validation of user-supplied input in Wallet. A remote attacker can trick the victim to open a specially crafted attachment and execute arbitrary code on the system.
Note, the vulnerability is being exploited in the wild.
Affected software
iPadOS
Apple iOS
watchOS
Apple iOS
watchOS
How to mitigate CVE-2023-41061
Install updates from vendor's website.
iPadOS - update to 16.6.1
Apple iOS - update to 16.6.1 20G81
watchOS - update to 9.6.2
Apple iOS - update to 16.6.1 20G81
watchOS - update to 9.6.2