Improper Verification of Cryptographic Signature in iPadOS and Apple iOS - CVE-2023-41991
Published: September 21, 2023 / Updated: February 21, 2025
Vulnerability identifier: #VU81041
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-41991
CWE-ID: CWE-347
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker application to bypass implemented security restrictions.
The vulnerability exists due to improper verification of cryptographic signature within the Security component. A remote attacker can create a specially crafted application that can bypass signature validation process, trick the victim into installing it and compromise the affected system.
Note, the vulnerability is being actively exploited in the wild.
Affected software
iPadOS
Apple iOS
watchOS
macOS
Apple iOS
watchOS
macOS
How to mitigate CVE-2023-41991
Install updates from vendor's website.
iPadOS - addressed in versions 16.7, 17.0.1
Apple iOS - addressed in versions 16.7 20H19, 17.0.1 21A340
watchOS - addressed in versions 9.6.3, 10.0.1
macOS - update to 13.6 22G120
Apple iOS - addressed in versions 16.7 20H19, 17.0.1 21A340
watchOS - addressed in versions 9.6.3, 10.0.1
macOS - update to 13.6 22G120