PT-2023-5027 · Apple · Watchos+2

Published 2023-09-07 · Updated 2025-10-23 · CVE-2023-41061

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 16.6.1 Apple iPadOS versions prior to 16.6.1 Apple watchOS versions prior to 9.6.2

Description A validation issue was addressed with improved logic. This issue may result in arbitrary code execution when a maliciously crafted attachment is processed. Apple is aware of a report that this issue may have been actively exploited. The vulnerability is related to the Wallet component and may allow an attacker to execute code via a maliciously crafted attachment.

Recommendations For Apple iOS versions prior to 16.6.1, update to iOS 16.6.1 or later to fix the issue. For Apple iPadOS versions prior to 16.6.1, update to iPadOS 16.6.1 or later to fix the issue. For Apple watchOS versions prior to 9.6.2, update to watchOS 9.6.2 or later to fix the issue. As a temporary workaround, consider disabling the processing of attachments in the Wallet application until a patch is available. Restrict access to the Wallet component to minimize the risk of exploitation. Avoid using the Wallet application to process attachments from untrusted sources until the issue is resolved.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2023-05568

CVE-2023-41061

Affected Products

Ios

Ipados

Watchos

References · 115

• https://support.apple.com/kb/HT213905 · Vendor Advisory
• https://support.apple.com/en-us/HT213907 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-41061 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05568 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-41061 · Security Note
• https://twitter.com/RsSI47041968/status/1700186113967808643 · Twitter Post
• https://twitter.com/the_ayo_ifedapo/status/1700064484641968286 · Twitter Post
• https://twitter.com/NickM_Actual/status/1701012469874115072 · Twitter Post
• https://twitter.com/cipherstorm/status/1700079814663942632 · Twitter Post
• https://twitter.com/Rulaelhalabi/status/1700507364917441001 · Twitter Post
• https://twitter.com/kawn2020/status/1701061338532110473 · Twitter Post
• https://twitter.com/TheCyberSecHub/status/1700067226450330021 · Twitter Post
• https://t.me/true_secator/4825 · Telegram Post
• https://t.me/cvenotify/94805 · Telegram Post
• https://twitter.com/fletch_ai/status/1699967542851182844 · Twitter Post