CVE-2023-41061highunder attackCWE-20

CVE-2023-41061: high-severity vulnerability in Apple watchOS

Published · Updated

Follow this CVE+ Monitor iOS+ Monitor iPadOS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

51Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 7.8epss 4.4%
from disclosure to weapon
Published on NVDSep 7
CISA KEV+4d
Action required by CISAfederal deadline: 2023-10-02

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

A flaw in how Apple devices validate attachments allows attackers to run malicious code by sending a specially crafted file. This is dangerous because it can give attackers full control of your device without you needing to do anything except receive the attachment.

Technical detail

A validation bypass in attachment handling (CWE-20) permits arbitrary code execution when a specially crafted attachment is processed. The vulnerability affects iOS, iPadOS, and watchOS; exploitation requires delivery of a malicious attachment and has been observed in active attacks. Fixed in iOS 16.6.1, iPadOS 16.6.1, and watchOS 9.6.2.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A validation issue was addressed with improved logic. This issue is fixed in watchOS 9.6.2, iOS 16.6.1 and iPadOS 16.6.1. A maliciously crafted attachment may result in arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Apple · iOS and iPadOSApple · watchOS
Related CVEs — Apple watchOS

In the same product, most dangerous first.

CVE-2021-30860HIGHCVE-2021-30860EPSS 76.0%KEVCVE-2025-43300CRITICALCVE-2025-43300EPSS 65.2%KEVCVE-2023-41064HIGHCVE-2023-41064EPSS 53.4%KEVCVE-2023-32434HIGHCVE-2023-32434EPSS 51.5%KEVCVE-2023-28205HIGHCVE-2023-28205EPSS 27.1%KEVCVE-2026-86950HIGHCVE-2026-86950EPSS 26.2%KEV