BLASTPASS ImageIO 0-click

CVE-2023-41064 technical analysis

CVE-2023-41064 is a critical-severity iOS vulnerability tracked as 0-click. The published record describes blastpass imageio 0-click affecting ≤16.6. In practical terms, the vulnerability should be evaluated as a specific weakness in a specific component—not as automatic evidence that every affected device can be fully compromised. The execution context, reachable interface, platform mitigations, and availability of a reliable exploit chain all shape real-world risk.

A zero-click vulnerability can be reached through automatically processed content without an intentional tap, open, or approval from the recipient. That delivery property raises urgency, but it does not by itself describe the privilege level gained after exploitation. For CVE-2023-41064, the confirmed impact is: Zero-click RCE via iMessage. No user interaction required. Bypasses BlastDoor. This wording sets the upper boundary supported by the current record. Where vendor documentation is deliberately brief, additional mechanics should remain labeled as researcher analysis until a patch diff, technical paper, or reproducible public proof of concept establishes them.

The disclosure timeline is also important. This record lists 2023-09-07 as the public disclosure or patch date, identifies 2023-09-05 as the discovery information currently available, and credits Citizen Lab. The remediation recorded for affected users is 2023-09-07 (iOS 16.6.1). Readers should use the references at the end of this page as the authoritative source for later corrections because vendors can revise advisories after publication.

Attack surface and exploitation prerequisites

Researchers must verify that the relevant service processes attacker-controlled input automatically on the affected build. Preview generation, message parsing, attachment indexing, and background decoding are common surfaces, but the exact path must be supported by the disclosure.

A defensible assessment separates reachability, exploitation, and post-exploitation. Reachability asks whether untrusted input can arrive at the vulnerable component. Exploitation asks whether that input can reliably produce the documented security effect on the exact affected build. Post-exploitation asks what the resulting process can actually access. This separation prevents a component-level flaw from being incorrectly described as an end-to-end device takeover.

Environmental controls may reduce exposure without removing the underlying defect. Network segmentation can matter for adjacent-network issues; application allow-listing can reduce local attack opportunities; restricted browsing or messaging features may reduce remotely delivered content; and mobile-device management can accelerate patch enforcement. These are compensating controls. The durable resolution remains the vendor update identified in this record.

Detection and forensic triage

The strongest evidence connects a delivered object to automatic processing, a deterministic fault or primitive, and the vulnerable code path. A crafted file that only crashes when opened manually does not prove a zero-click vector.

Preserve message databases, attachment metadata, delivery timestamps, crash logs, and system analytics before deleting content or resetting the device. High-risk users should follow vendor guidance for restricted operating modes and obtain qualified forensic support.

Absence of a visible symptom does not prove absence of exploitation, and a crash alone does not prove a successful compromise. Mobile telemetry is often incomplete, especially on unmanaged consumer devices. Investigators should preserve the device state, record the operating-system build and patch level, document time zones, and acquire logs using a method appropriate to the legal and evidentiary context. Resetting, restoring, or repeatedly testing the device can destroy useful traces.

When this CVE is being assessed after a suspected targeted attack, correlate device evidence with account sign-ins, messaging metadata, network telemetry, MDM events, and identity-provider logs. The goal is to build a timeline that distinguishes attempted delivery, component processing, successful exploitation, and subsequent access. Each stage requires its own evidence.

How to mitigate CVE-2023-41064

The primary mitigation is straightforward: iOS 16.6.1+. Lockdown Mode blocks PassKit attachment processing.

On Apple devices, confirm the exact iOS or iPadOS build in Settings > General > About and compare it with Apple's security release documentation. Hardware generation and the supported update branch can change which fixed release is available. Lockdown Mode can reduce selected attack surfaces for users facing sophisticated targeted threats, but it is not a substitute for installing security updates.

1. Identify the exact device model, operating-system build, and current security patch level.
2. Compare that information with the affected range and fixed release documented by the vendor.
3. Back up necessary evidence before making changes when compromise is suspected.
4. Install the latest supported security release rather than stopping at the first version that mentions the CVE.
5. Verify the installed build after reboot and review related accounts and applications for follow-on activity.

Organizations should track remediation as an asset-management problem, not merely send a general update notice. Record which devices are affected, which are patched, which cannot receive the fixed release, and which require replacement or isolation. For high-risk users, prioritize devices exposed to the relevant delivery vector and preserve potential evidence before remediation.

PoC interpretation and research notes

A proof of concept demonstrates a defined technical property; it does not automatically demonstrate a complete, reliable attack chain. A crash reproducer may confirm reachability, while a stronger PoC may demonstrate controlled disclosure, boundary crossing, or code execution. Researchers should state which outcome is actually reproduced, the tested build, device model, prerequisites, reliability, and whether mitigations were disabled.

This page distinguishes public disclosure from independent reproduction. Its current status is Publicly disclosed. The record is based on the cited public disclosure and has not been represented as proprietary discovery. Any PoC shown above should be reviewed in an isolated lab and used only on systems the researcher owns or is explicitly authorized to test. Public availability is not a guarantee that code is safe, complete, or accurately attributed.

Frequently asked questions about CVE-2023-41064

What is CVE-2023-41064?

CVE-2023-41064 is a iOS 0-click vulnerability associated with blastpass imageio 0-click. It affects ≤16.6, according to the currently cited disclosures. The practical risk depends on the vulnerable component, required access, available mitigations, and whether the device has received 2023-09-07 (iOS 16.6.1).

Is CVE-2023-41064 being exploited in the wild?

The status on this page is “Publicly disclosed.” A vendor-confirmed vulnerability is not necessarily known to be actively exploited. This database uses “Exploited in the wild” only when a cited vendor or authoritative security source reports observed exploitation; public PoC availability is tracked separately.

How do I protect a device from CVE-2023-41064?

Install the latest supported security update and verify the resulting build or patch level. The recorded minimum resolution is 2023-09-07 (iOS 16.6.1). Apply relevant compensating controls while updates are pending, but do not treat configuration changes as equivalent to patching the underlying vulnerability.