CVE-2023-41064

Imagine someone could take over your phone simply by sending you a picture — you don't even need to click anything beyond letting the image load. That's effectively what this flaw allows: a corrupted image file tricks the device into running an attacker's code, giving them control over the device and whatever data or accounts are accessible from it.

This matters to you if your business uses iPhones, iPads, or Macs that haven't been updated recently. The attack works simply by the device displaying or processing a malicious image — there's no need for the user to click a link or enter credentials, just view the image.

Attackers are already exploiting this flaw in real-world attacks, and Apple itself confirms active exploitation — this is not a theoretical risk. CISA has ordered US federal agencies to patch by October 2, 2023, which has already passed, meaning any unpatched device has been vulnerable for a long time. Treat this as an emergency: update affected devices today.

1. Inventory all Apple devices (iPhone, iPad, Mac) in use for business, noting OS version via Settings > General > About (iOS/iPadOS) or Apple menu > About This Mac (macOS).
2. Confirm exposure: any device below the fixed versions listed is vulnerable and should be treated as already potentially compromised if it has been in regular use since early September 2023, given confirmed in-the-wild exploitation.
3. Apply vendor fixes per branch: iOS 16.6.1 / iPadOS 16.6.1, macOS Ventura 13.5.2, macOS Monterey 12.6.9, iOS/iPadOS 15.7.9, macOS Big Sur 11.7.10. No breaking changes expected; these are security-only point releases.
4. There is no practical workaround short of disabling image rendering (e.g., avoiding Messages/Safari/Mail attachments), which is not feasible for normal business use — patching is the only real mitigation.
5. CISA KEV due date (October 2, 2023) has passed; prioritize immediate patching for any device not yet updated.
6. After patching, monitor for signs of prior compromise (unexpected battery drain, unfamiliar profiles/configurations, unusual network activity) since exploitation predates the fix.
7. Reference advisories: HT213905, HT213906, HT213913, HT213914, HT213915.

CVSS 7.8 (High), AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H — local vector reflecting in-process exploitation via image parsing, no privileges required, user interaction required (image rendering), full impact to confidentiality, integrity, and availability. Weakness is CWE-120 (buffer copy without checking size of input / classic buffer overflow) in Apple's ImageIO or related image-processing framework. Confirmed listed in CISA KEV (added 2023-09-11) based on Apple's own report of active exploitation; EPSS predicted a high likelihood of exploitation before KEV listing confirmed it as fact, so EPSS is superseded here. No public exploit code is on record, but exploitation in the wild has been confirmed independently of any public PoC — likely used in targeted spyware campaigns, consistent with Apple's historical pattern for zero-day image/font parsing bugs (e.g., paired with CVE-2023-41061 in the same advisory). Press attention is rising, consistent with its use in high-profile targeted attack disclosures.