CVE-2023-41061
ENISA EUVD: EUVD-2023-45582 ↗
Exploited in the Wild
✓ Confirmed 0-Day
★ Google Project Zero
Triaged: Feb. 18, 2026
18 articles
Published: 2023-09-07
EPSS Score
Source: FIRST.org · 2026-05-23
1.15%
probability
This CVE has a 1.15% probability
of being exploited in the next 30 days.
0%
Top 78.7th percentile of all CVEs
100%
CVSS v3.1
Source: VulnerabilityLookup (CIRCL)7.8
HIGH
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Description
VulnerabilityLookup (CNA)A validation issue was addressed with improved logic. This issue is fixed in watchOS 9.6.2, iOS 16.6.1 and iPadOS 16.6.1. A maliciously crafted attachment may result in arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Affected Products
Apple
iOS and iPadOS
unspecified
Apple
watchOS
unspecified
Google Project Zero
Patched
Sept. 7, 2023
Reported by
Apple
Root Cause Analysis
???
Signal Intelligence
Confidence
92%
EPSS
1.15%
CVSS v3.1
7.8
Mentions
18
Last Seen
Mar 11, 2025
CNA Information
CNA Assigner
apple
Analyst Note
CVE-2023-41061 is confirmed as an actively exploited zero-day with strong supporting evidence: Apple's official acknowledgment of active exploitation, high CVSS score (7.8), reporting by Project Zero, and multiple credible sources documenting real-world attacks on iOS/iPadOS devices. The vulnerability involves arbitrary code execution through maliciously crafted attachments, representing a significant threat to affected Apple users.
Triage Info
Decided atFeb 18, 2026
Published DateSep 07, 2023