CVE-2023-41991mediumunder attackCWE-295

CVE-2023-41991: medium-severity vulnerability in Apple macOS

Published · Updated

Follow this CVE+ Monitor macOS+ Monitor iOS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

68Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 5.5epss 13%
from disclosure to weapon68 days
Published on NVDSep 21
1st PoC+68d
CISA KEV+4d
Action required by CISAfederal deadline: 2023-10-16

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

A flaw in certificate validation allowed malicious apps to bypass signature checks on Apple devices. This could let attackers run unauthorized code or impersonate trusted applications.

Technical detail

CWE-295 certificate validation bypass affecting iOS, iPadOS, and macOS. A malicious app could circumvent signature verification mechanisms through improper certificate validation logic. The vulnerability has been exploited in the wild against iOS versions prior to 16.7; fixed in macOS Ventura 13.6, iOS 16.7, and iPadOS 16.7.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A malicious app may be able to bypass signature validation. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected products
Apple · iOS and iPadOSApple · macOS
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Apple macOS

In the same product, most dangerous first.

CVE-2021-30860HIGHCVE-2021-30860EPSS 76.0%KEVCVE-2021-30657MEDIUMCVE-2021-30657EPSS 68.5%KEVCVE-2025-43300CRITICALCVE-2025-43300EPSS 63.2%KEVCVE-2023-32434HIGHCVE-2023-32434EPSS 58.2%KEVCVE-2023-41064HIGHCVE-2023-41064EPSS 53.4%KEVCVE-2021-30807HIGHCVE-2021-30807EPSS 28.8%KEV