CVE-2023-41061
KEVApple iOS, iPadOS, and watchOS Wallet Code Execution Vulnerability
Description
Apple iOS, iPadOS, and watchOS contain an unspecified vulnerability due to a validation issue affecting Wallet in which a maliciously crafted attachment may result in code execution. This vulnerability was chained with CVE-2023-41064.
A validation issue was addressed with improved logic. This issue is fixed in watchOS 9.6.2, iOS 16.6.1 and iPadOS 16.6.1. A maliciously crafted attachment may result in arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
CVSS 3.1 vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HPublishedSep 7, 2023
Last modifiedJun 17, 2026
Added to KEVSep 11, 2023
Remediation dueOct 2, 2023
References
- seclists.org/fulldisclosure/2023/Sep/4Mailing ListThird Party Advisory
- seclists.org/fulldisclosure/2023/Sep/5Mailing ListThird Party Advisory
- support.apple.com/en-us/HT213905Vendor Advisory
- support.apple.com/en-us/HT213907Vendor Advisory
- support.apple.com/kb/HT213905Vendor Advisory
- support.apple.com/kb/HT213907Vendor Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41061US Government Resource
0 recent articles mention this CVE
69
Risk assessment · High
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1120 days
- CVSS
- 7.8 HIGH
- EPSS (30-day exploit probability)
- 4.4% · top 9% of all CVEs
- Weakness
- NVD-CWE-noinfo
Recommended actions
- 1.Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.