ClosedHighPatched

BLASTPASS: NSO zero-click iPhone exploit chain (CVE-2023-41064, CVE-2023-41061)

Apple iOS, iPadOS, macOS and watchOS

Citizen Lab caught BLASTPASS, a zero-click iMessage exploit chain that delivered NSO Group's Pegasus through malicious PassKit attachments carrying images. Apple fixed the ImageIO and Wallet bugs in emergency updates the same day.

Why this severity: Zero-click, actively exploited (CISA KEV)

Started: Sep 7, 2023
Closed: Sep 11, 2023
CVEs: CVE-2023-41064 CVE-2023-41061

Follow this incident

Updated Sep 11, 2023

Affected

See vendor advisory

Fixed in

iOS 16.6.1 and iPadOS 16.6.1
iOS 15.7.9 and iPadOS 15.7.9
macOS Ventura 13.5.2
macOS Monterey 12.6.9
macOS Big Sur 11.7.10
watchOS 9.6.2

Timeline2

Sep 11, 2023
CISA adds both CVEs to the KEV catalog
Sep 7, 2023
Citizen Lab discloses BLASTPASS; Apple ships iOS 16.6.1 and related updates
Source

Advisories3

News & write-ups1

BLASTPASS: NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in the WildCitizen Lab · Sep 7, 2023 · Write-up

Notes & caveats

Fixed versions from NVD (CVE-2023-41064 / CVE-2023-41061).

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Get notified