CVE-2023-41064

CVE-2023-41064 is a software vulnerability, specifically a buffer overflow issue found in the iOS ImageIO component. This flaw was discovered and reported by researchers at Citizen Lab in early September. It was being actively exploited as part of an exploit chain, along with another vulnerability (CVE-2023-41061), to infect devices with NSO Group's Pegasus spyware. Both vulnerabilities were rapidly addressed by Apple, which issued two CVEs and advised all users to install new security patches. The exploitation of CVE-2023-41064 was consistent with NSO Group's BLASTPASS exploit, as confirmed by Amnesty International. After the discovery, Apple promptly patched this vulnerability through a software update in September. Despite the severity of the vulnerability, Apple noted that it did not seem to affect devices that had its "Lockdown Mode" enabled. This mode restricts non-essential iOS features to reduce the device's overall attack surface and is designed for users who may be subject to targeted attacks. Citizen Lab's quick identification and reporting of these zero-day flaws, coupled with Apple's rapid response and patch cycle, played a critical role in mitigating the potential damage. The incident underscores the importance of collaboration between cybersecurity researchers, organizations, and software developers in identifying and addressing security threats. The affected victims and their organizations also played a key role in this collaborative effort.