Description
A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A malicious app may be able to bypass signature validation. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apple | iOS and iPadOS | unspecified – < 16.7 | 16.7 |
| Apple | macOS | unspecified – < 13.6 | 13.6 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 3 repositories
-
itsgiddd/CVE-2023-41991 ★ 6 · Nov 28, 2023
-
dmytrozykov/appsign ★ 1 · Mar 18, 2025
iOS/macOS library that exploits CVE-2023-41991 for signing iOS applications.
-
lambertse/CoreTrust-bypass ★ 0 · Oct 15, 2026
CVE-2023-41991 vulnerability exploitation - allow malicious app able to bypass the signature validation.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- WID-SEC-2023-2454 Apple iOS und iPadOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 5, 2026
- WID-SEC-2023-2453 Apple macOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 13, 2025
- WID-SEC-2023-2427 Apple iOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 21, 2023