CVE-2023-41064
Memory Safety in Apple Macos 11.0 – 11.7.10
Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-41064 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Apple Macos. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique NTDS (T1003.003); ranked in the top 1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A buffer overflow vulnerability addressed through improved memory handling affects image processing components in multiple Apple operating systems. Impacted versions include iOS 16.6.1 and iPadOS 16.6.1, macOS Monterey 12.6.9, macOS Ventura 13.5.2, iOS 15.7.9 and iPadOS 15.7.9, and macOS Big Sur 11.7.10. The flaw, tracked as CVE-2023-41064 with a CVSS score of 7.8 and CWE-120, can be triggered by processing a maliciously crafted image and may result in arbitrary code execution.
An attacker can exploit the issue without privileges by supplying a crafted image file that a user opens or processes on an affected device. Successful exploitation grants the ability to execute arbitrary code with the privileges of the affected process, potentially compromising the system.
Apple security advisories detail fixes released in the listed OS versions and note that the company is aware of reports indicating the vulnerability may have been actively exploited in the wild. The associated EPSS score has reached a peak of 0.8990 with a current value of 0.8535.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-45585
Vulnerability Data
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 16.6.1 and iPadOS 16.6.1, macOS Monterey 12.6.9, macOS Ventura 13.5.2, iOS 15.7.9 and iPadOS 15.7.9, macOS Big Sur 11.7.10. Processing a maliciously crafted image…
more
may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
- CWE(s)
- KEV Date Added
- 11 September 2023
Related Threats
Threat-Actor AttributionAI
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.2.1
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Platform-independent managed code eliminates the need for unchecked native buffer copies that are the root cause of classic buffer overflows.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Vulnerability identification processes such as code review or scanning detect classic buffer overflows before exploitation.
Routine patching replaces vulnerable code containing unchecked buffer copies with corrected versions.
Secure development practices directly enforce bounds checking and input validation that prevent classic buffer overflows.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.