What’s Vulnerable › Vulnerabilities

CVE-2023-41061: Apple iOS, iPadOS, and watchOS Wallet Code Execution Vulnerability

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2023-09-11
• EPSS: 4.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-09-07 · updated 2026-06-17
• Weakness: CWE-20

Description

A validation issue was addressed with improved logic. This issue is fixed in watchOS 9.6.2, iOS 16.6.1 and iPadOS 16.6.1. A maliciously crafted attachment may result in arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Affected products

• Apple iPadOS: before 16.6.1 — fixed in 16.6.1
• Apple Iphone Os: before 16.6.1 — fixed in 16.6.1
• Apple watchOS: before 9.6.2 — fixed in 9.6.2

How to fix

Upgrade to a fixed version: Apple iPadOS 16.6.1; Apple Iphone Os 16.6.1; Apple watchOS 9.6.2. Check the vendor advisory for mitigations.

References

• http://seclists.org/fulldisclosure/2023/Sep/4
• http://seclists.org/fulldisclosure/2023/Sep/5
• https://support.apple.com/en-us/HT213905
• https://support.apple.com/en-us/HT213907
• https://support.apple.com/kb/HT213905
• https://support.apple.com/kb/HT213907
• http://seclists.org/fulldisclosure/2023/Sep/4
• http://seclists.org/fulldisclosure/2023/Sep/5
• https://support.apple.com/en-us/HT213905
• https://support.apple.com/en-us/HT213907
• https://support.apple.com/kb/HT213905
• https://support.apple.com/kb/HT213907

Get alerted when CVE-2023-41061 or the next vulnerability affects your stack