CVE-2023-41061

A validation issue was addressed with improved logic. This issue is fixed in watchOS 9.6.2, iOS 16.6.1 and iPadOS 16.6.1. A maliciously crafted attachment may result in arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

• CWE-20

• http://seclists.org/fulldisclosure/2023/Sep/4Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2023/Sep/5Mailing List, Third Party Advisory
• https://support.apple.com/en-us/HT213905Vendor Advisory
• https://support.apple.com/en-us/HT213907Vendor Advisory
• https://support.apple.com/kb/HT213905Vendor Advisory
• https://support.apple.com/kb/HT213907Vendor Advisory
• http://seclists.org/fulldisclosure/2023/Sep/4Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2023/Sep/5Mailing List, Third Party Advisory
• https://support.apple.com/en-us/HT213905Vendor Advisory
• https://support.apple.com/en-us/HT213907Vendor Advisory
• https://support.apple.com/kb/HT213905Vendor Advisory
• https://support.apple.com/kb/HT213907Vendor Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41061US Government Resource

Published

Sep 7, 2023

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-41055LibreY is a fork of LibreX, a framework-less and javascript-…7.5
• CVE-2023-41056Redis is an in-memory database that persists on disk. Redis …8.1
• CVE-2023-41057hyper-bump-it is a command line tool for updating the versio…5.5
• CVE-2023-41058Parse Server is an open source backend server. In affected v…7.5
• CVE-2023-4106Mattermost fails to check if the requesting user is a guest …6.5
• CVE-2023-41060A type confusion issue was addressed with improved checks. T…8.8
• CVE-2023-41063The issue was addressed with improved memory handling. This …7.8
• CVE-2023-41064A buffer overflow issue was addressed with improved memory h…7.8
• CVE-2023-41065A privacy issue was addressed with improved private data red…3.3
• CVE-2023-41066An authentication issue was addressed with improved state ma…5.5
• CVE-2023-41067A logic issue was addressed with improved checks. This issue…5.5
• CVE-2023-41068An access issue was addressed with improved access restricti…7.8