CVE-2023-41064: Apple ImageIO buffer overflow allows code execution via crafted image

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with confirmed active exploitation and a high EPSS score, but requires local access plus user interaction, which limits mass remote exploitation.

What it is

A buffer overflow in Apple's ImageIO image processing component was fixed in iOS 16.6.1/iPadOS 16.6.1, iOS 15.7.9/iPadOS 15.7.9, macOS Monterey 12.6.9, macOS Ventura 13.5.2, and macOS Big Sur 11.7.10. Processing a maliciously crafted image can lead to arbitrary code execution, and Apple states the issue may have been actively exploited. It matters because image parsing is a routine, hard-to-avoid action on Apple devices.

Impact

An attacker who gets a crafted image processed can achieve arbitrary code execution in the context of the affected process, with high confidentiality, integrity, and availability impact per the CVSS vector. This can enable full compromise of the device or user data.

Attack surface

The flaw is reached locally by processing a maliciously crafted image; the CVSS vector is AV:L with UI:R and PR:N, meaning no privileges are required but some form of user interaction (for example, opening or previewing the image) is needed. It is not described as remotely reachable without such interaction.

Exploitation

Apple states the issue may have been actively exploited, and CISA added it to the KEV catalog on 2023-09-11 with a 2023-10-02 remediation due date. EPSS gives a 30-day probability of 0.4506 (98.7th percentile), indicating high predicted exploitation activity.

What to do

• Update to the fixed versions: iOS 16.6.1/iPadOS 16.6.1, iOS 15.7.9/iPadOS 15.7.9, macOS Monterey 12.6.9, macOS Ventura 13.5.2, or macOS Big Sur 11.7.10.
• Prioritize patching internet-facing and high-value Apple devices first, consistent with the CISA KEV due date.
• Restrict or disable automatic image preview/rendering paths where feasible until devices are patched.
• Track unpatched Apple endpoints and enforce update compliance through MDM.
• If a device cannot be updated, follow vendor guidance and consider discontinuing use of the affected product per CISA's required action.

Detection

• Monitor for unexpected process crashes or memory corruption events in ImageIO-related processes on Apple endpoints.
• Hunt for suspicious image files delivered via email, messaging, or web downloads that are opened shortly before anomalous process execution.
• Correlate endpoint telemetry for code execution spawned from image-handling processes (for example, preview or messaging clients) with recent file receipt.
• Review Apple security update status across managed devices to find systems still running versions prior to the fixed releases.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.