# BLASTPASS: NSO zero-click iPhone exploit chain (CVE-2023-41064, CVE-2023-41061) · pwn.watch

> Citizen Lab caught BLASTPASS, a zero-click iMessage exploit chain that delivered NSO Group's Pegasus through malicious PassKit attachments carrying images. Apple fixed the ImageIO and Wallet bugs in emergency updates the same day.

Page: https://pwn.watch/i/apple-blastpass-cve-2023-41064-41061 · generated 2026-10-22T21:08:49.695Z

## Status
- Severity: high · status: closed · patch: patched
- Product: Apple iOS, iPadOS, macOS and watchOS
- Started: 2023-09-07 · closed: 2023-09-11
- CVEs: CVE-2023-41064, CVE-2023-41061
- Affected: See vendor advisory
- Fixed in: iOS 16.6.1 and iPadOS 16.6.1; iOS 15.7.9 and iPadOS 15.7.9; macOS Ventura 13.5.2; macOS Monterey 12.6.9; macOS Big Sur 11.7.10; watchOS 9.6.2

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/apple-blastpass-cve-2023-41064-41061/feed.xml
- JSON Feed: https://pwn.watch/i/apple-blastpass-cve-2023-41064-41061/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/apple-blastpass-cve-2023-41064-41061.json
- This file: https://pwn.watch/i/apple-blastpass-cve-2023-41064-41061/llms.txt

## Updates (newest first)
- 2023-09-11: CISA adds both CVEs to the KEV catalog
- 2023-09-07: Citizen Lab discloses BLASTPASS; Apple ships iOS 16.6.1 and related updates (https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/)

## Fix brief
# Security brief: BLASTPASS: NSO zero-click iPhone exploit chain (CVE-2023-41064, CVE-2023-41061)

Source: https://pwn.watch/i/apple-blastpass-cve-2023-41064-41061 · status: closed (closed Sep 11, 2023) · severity: high · updated Sep 11, 2023

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
Citizen Lab caught BLASTPASS, a zero-click iMessage exploit chain that delivered NSO Group's Pegasus through malicious PassKit attachments carrying images. Apple fixed the ImageIO and Wallet bugs in emergency updates the same day.

Severity detail: Zero-click, actively exploited (CISA KEV)

- Product: Apple iOS, iPadOS, macOS and watchOS
- CVE / advisory ids: CVE-2023-41064, CVE-2023-41061

## Affected versions
- See vendor advisory

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- iOS 16.6.1 and iPadOS 16.6.1
- iOS 15.7.9 and iPadOS 15.7.9
- macOS Ventura 13.5.2
- macOS Monterey 12.6.9
- macOS Big Sur 11.7.10
- watchOS 9.6.2

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Latest updates
- Sep 11, 2023: CISA adds both CVEs to the KEV catalog
- Sep 7, 2023: Citizen Lab discloses BLASTPASS; Apple ships iOS 16.6.1 and related updates

## Advisories
- [NVD: CVE-2023-41064](https://nvd.nist.gov/vuln/detail/CVE-2023-41064) (NVD)
- [NVD: CVE-2023-41061](https://nvd.nist.gov/vuln/detail/CVE-2023-41061) (NVD)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) (CISA)

## Write-ups & news
- [BLASTPASS: NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in the Wild](https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/)

## Caveats
Fixed versions from NVD (CVE-2023-41064 / CVE-2023-41061).

---
Machine-readable: https://pwn.watch/i/apple-blastpass-cve-2023-41064-41061.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.