CVE-2023-41064

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 16.6.1 and iPadOS 16.6.1, macOS Monterey 12.6.9, macOS Ventura 13.5.2, iOS 15.7.9 and iPadOS 15.7.9, macOS Big Sur 11.7.10. Processing a maliciously crafted image may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

• CWE-120
• CWE-120

• http://www.openwall.com/lists/oss-security/2023/09/21/4Mailing List
• https://support.apple.com/en-us/HT213905Release Notes, Vendor Advisory
• https://support.apple.com/en-us/HT213906Release Notes, Vendor Advisory
• https://support.apple.com/en-us/HT213913Release Notes, Vendor Advisory
• https://support.apple.com/en-us/HT213914Release Notes, Vendor Advisory
• https://support.apple.com/en-us/HT213915Release Notes, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2023/09/21/4Mailing List
• https://support.apple.com/en-us/HT213905Release Notes, Vendor Advisory
• https://support.apple.com/en-us/HT213906Release Notes, Vendor Advisory
• https://support.apple.com/en-us/HT213913Release Notes, Vendor Advisory
• https://support.apple.com/en-us/HT213914Release Notes, Vendor Advisory
• https://support.apple.com/en-us/HT213915Release Notes, Vendor Advisory
• https://support.apple.com/kb/HT213913Release Notes, Vendor Advisory
• https://support.apple.com/kb/HT213915Release Notes, Vendor Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41064US Government Resource

Published

Sep 7, 2023

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-41057hyper-bump-it is a command line tool for updating the versio…5.5
• CVE-2023-41058Parse Server is an open source backend server. In affected v…7.5
• CVE-2023-4106Mattermost fails to check if the requesting user is a guest …6.5
• CVE-2023-41060A type confusion issue was addressed with improved checks. T…8.8
• CVE-2023-41061A validation issue was addressed with improved logic. This i…7.8
• CVE-2023-41063The issue was addressed with improved memory handling. This …7.8
• CVE-2023-41065A privacy issue was addressed with improved private data red…3.3
• CVE-2023-41066An authentication issue was addressed with improved state ma…5.5
• CVE-2023-41067A logic issue was addressed with improved checks. This issue…5.5
• CVE-2023-41068An access issue was addressed with improved access restricti…7.8
• CVE-2023-41069This issue was addressed by improving Face ID anti-spoofing …5.5
• CVE-2023-4107Mattermost fails to properly validate the requesting user pe…6.5