How to Fix CVE-2023-41991: Certificate Validation Bypass in Apple iOS, iPadOS and macOS

What is CVE-2023-41991?

CVE-2023-41991 is an improper certificate validation flaw in Apple's operating systems. In Apple's words: “A certificate validation issue was addressed. A malicious app may be able to bypass signature validation.” The Security Desk has classified it as CWE-295, Improper Certificate Validation, matching the CISA enrichment record.

Here is what that means in plain terms. Apple platforms rely on code signing to decide whether a piece of software is trustworthy. A signed certificate proves the code came from who it claims to. This bug let a malicious app sneak past that signature check. The app does not get there by magic, it has to already be on the device, which is why the CVSS vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N: local attack vector, user interaction required, and a high integrity impact with no confidentiality or availability loss. So this is not remote code execution and it is not a denial of service. It is an integrity bypass.

Why does a 5.5 medium-severity bug matter so much? Because it was not used alone. CVE-2023-41991 was one link in an exploit chain caught in the wild against real iPhones, alongside CVE-2023-41992 and CVE-2023-41993. The certificate-validation bypass is the piece that lets a tampered or unsigned component run after an earlier flaw gets a foothold. Apple confirms it “may have been actively exploited against versions of iOS before iOS 16.7,” and CISA put it on the KEV list four days after the patch shipped. The CVSS number undersells the real-world risk because the metric scores the single flaw, not the chain it belongs to.

The fix is simple and definitive: install Apple's patched build. There is no configuration change, no registry edit, no command-line patch. You move the operating system to a version that contains the corrected signature-validation code, and the bug is gone.

Which builds are affected

Two product families are in scope, and each has its own patched release:

• iPhone and iPad. every iOS and iPadOS build before 16.7 is affected. The fix is iOS 16.7 and iPadOS 16.7 (Apple advisory HT213927).
• Mac, every macOS Ventura build before 13.6 is affected. The fix is macOS Ventura 13.6 (Apple advisory HT213931).

One point that trips people up: Apple shipped the iOS 17 and macOS Sonoma lines around the same window, and those newer trains already contain this fix. If a device is on iOS 17.0 or later, or macOS Sonoma, you are covered and do not need to step back to 16.7. The 16.7 and 13.6 releases exist specifically so people who cannot move to the new major version still get the security fix.

How to fix CVE-2023-41991

This is an Apple operating-system update, full stop. Ignore any generic Linux package-manager or Windows-Update instructions you may have seen elsewhere, they do not apply to iOS, iPadOS, or macOS. Here is the correct path for each device type.

On an iPhone or iPad

1. Open Settings → General → Software Update.
2. If the device offers iOS 16.7 / iPadOS 16.7 (or any later release such as iOS 17.x), tap Download and Install.
3. Keep the device on Wi-Fi and charging until it reboots and finishes.
4. After the reboot, go back to Settings → General → About and confirm the Software Version reads 16.7 or higher.

If the device is older and 16.7 is the newest version it supports, that is fine, 16.7 is a fully patched build for this CVE.

On a Mac

1. Open the Apple menu → System Settings → General → Software Update (on older macOS this is System Preferences → Software Update).
2. Install macOS Ventura 13.6 if offered, or move to macOS Sonoma, either contains the fix.
3. Let the Mac restart and complete the install.
4. Confirm the result under Apple menu → About This Mac: the version should read 13.6 or later.

For a managed fleet (MDM)

If you run iPhones, iPads, or Macs through an MDM such as Microsoft Intune, Jamf Pro, or Kandji, drive the update from there rather than asking users to tap through it themselves:

• Push a software-update / OS-update command targeting the affected devices, with the minimum OS set to 16.7 (iOS/iPadOS) or 13.6 (macOS).
• Use a compliance policy that flags any device below those builds as non-compliant, and gate access to corporate resources on compliance until the device updates.
• In Jamf, scope a Smart Group on “Operating System Version less than 16.7” and attach the update policy to it.
• Re-run the inventory after the maintenance window and confirm the affected Smart Group or compliance bucket has emptied out.

On Supervised devices, MDM can force the update and even schedule the reboot. On personally owned (BYOD) devices, MDM can only prompt and report, so pair the push with a clear deadline and a conditional-access block for stragglers.

Verify the fix landed

Verification here is reassuringly low-tech because the fix is a version bump. There is no patched binary to fingerprint and no service to restart, the whole OS carries the change. Confirm three things:

1. The reported OS version. On-device under About, or in your MDM inventory, the build must be iOS/iPadOS 16.7+ or macOS 13.6+. That single fact is the proof the fix is present.
2. Fleet-wide coverage. Pull the OS-version column for every enrolled device and confirm zero rows below the fixed build. Half-updated fleets are the usual failure mode, one stale device is still one exploitable device.
3. Scanner agreement. If you run an MDM-integrated or network vulnerability scanner, re-scan and confirm it no longer reports CVE-2023-41991 against the updated devices.

If you can't patch immediately

Apple did not publish a configuration workaround for this issue, and there is no setting that disables signature validation safely, so the update is the only real remediation. That said, you can shrink the window of exposure while updates roll out:

• Only install apps from the App Store or your managed app catalog. The bug requires a malicious app on the device first. Blocking sideloading and unknown configuration profiles removes the most common delivery route.
• Audit installed configuration profiles and enterprise apps on devices you manage, and remove anything unrecognized.
• Treat high-risk users as a priority cohort. Because this CVE was used in a targeted exploit chain, journalists, executives, and other likely targets should be updated first, and may benefit from Apple's Lockdown Mode until they are on a patched build.
• Watch for unexpected reboots or crash reports. Exploit chains of this kind often leave a trail in device crash logs; collect them from managed devices and review anything anomalous.

Why this one was an emergency, not a routine update

Plenty of medium-severity CVEs can wait for the next patch cycle. This one could not, and the reason is the company it kept. CVE-2023-41991 shipped in the same Apple update as two other actively exploited flaws and was documented as part of a live attack chain. Apple's confirmation of in-the-wild exploitation, combined with the CISA KEV listing and the 2023-10-16 federal remediation deadline, put it firmly in the “patch this week” bucket. A certificate-validation bypass is exactly the kind of integrity primitive that turns a partial compromise into a full one, so even at 5.5 it earned emergency handling.

References

• Official vendor advisory: https://support.apple.com/en-us/HT213927
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-41991
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://support.apple.com/en-us/HT213931

This guide was assembled from the official vendor advisory, NVD record, and CISA KEV listing on 2026-05-25. Always confirm against the vendor advisory before applying changes in production.

How CVE-2023-41991 fits the exploit chain

This flaw did not surface in isolation. Apple patched it in the same coordinated release as CVE-2023-41992 and CVE-2023-41993, and security researchers who reported the cluster tied all three to a single in-the-wild spyware delivery chain. Understanding that context changes how you should treat a bug that, on paper, reads as a mere medium-severity integrity issue.

Think of an exploit chain as a relay. One bug gets the attacker a foothold, the next escalates, and a third lets attacker-controlled code keep running. A certificate-validation bypass like CVE-2023-41991 is the kind of link that lets a tampered or unsigned component pass a trust check it should have failed. On its own it grants no remote access and crashes nothing. Bolt it onto a memory-corruption bug that already executes code, and the signature bypass removes a guardrail Apple put there specifically to stop unsigned payloads from running. That is why a 5.5 score deserves emergency handling here: the metric rates one isolated flaw, while the real-world deployment weaponised it as part of a kit.

The practical takeaway is that you cannot reason about this CVE the way you would about a stand-alone medium bug buried in a quarterly bulletin. Apple's own language is unusually direct: it is “aware of a report that this issue may have been actively exploited.” When Apple says that and CISA adds the CVE to KEV four days after the patch ships, the only safe assumption is that working exploit code exists and is being used against high-value targets.

Who is most at risk

Because the exploitation seen in the wild was targeted rather than mass-market, the risk profile is uneven. A typical consumer who installs apps only from the App Store faces a much smaller chance of encountering this specific chain than a person who is individually interesting to a well-resourced adversary. That does not make patching optional for anyone, it just shapes the order in which you should move.

• High-risk individuals first. Journalists, activists, executives, diplomats, and anyone who has reason to believe they are a target should update before everyone else. They are also the people who benefit most from enabling Apple's Lockdown Mode as a defence-in-depth measure while updates roll out across a fleet.
• Managed corporate devices next. Any iPhone, iPad, or Mac that touches corporate data should be moved to a patched build inside the same emergency window your federal counterparts worked to. The CISA remediation deadline of 2023-10-16 is a reasonable internal target even for private organisations.
• General population. Standard users should still update promptly, but the targeted nature of the observed attacks means the catastrophic-compromise scenario is concentrated in the first two groups.

Verifying claims against the source record

One habit that saves real trouble: confirm every number against Apple's advisory and the CVE record rather than trusting a third-party summary. Aggregator sites and news write-ups frequently mislabel this CVE's vulnerability class, and a wrong class leads to a wrong fix. For the record, the authoritative facts are these.

• Vulnerability class: CWE-295, improper certificate validation. It is not remote code execution, not a use-after-free, and not a denial of service.
• Affected products: Apple iOS and iPadOS before 16.7, and Apple macOS before Ventura 13.6. No other vendor or product is in scope.
• Fixed builds: iOS 16.7, iPadOS 16.7, and macOS Ventura 13.6, all shipped 2023-09-21 (Apple advisories HT213927 and HT213931).
• Severity: CVSS 3.1 base 5.5, vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. Local vector, user interaction required, high integrity impact only.
• Exploitation: active. CISA KEV entry dated 2023-09-25. The record carries no separate ransomware-campaign flag, so do not claim ransomware use that the source does not support.

If a tool or article you are reading disagrees with any of the five facts above, the source record wins. There is no command-line remediation, no package-manager update, and no registry change for this CVE because none of the affected products use those mechanisms. The fix is an Apple operating-system update delivered through Software Update or your MDM, and the proof is the reported build number. Anything that tells you to run a Linux package command or a Windows hotfix query against an iPhone is simply wrong for this CVE.

Related fixes

Other flaws in this area worth reviewing while you patch this one:

• How to Fix CVE-2023-37450: Denial of Service in Apple Safari
• How to Fix CVE-2023-41974: Use-After-Free in Apple iOS and iPadOS
• How to Fix CVE-2023-28205: Remote Code Execution in Safari, iOS and iPadOS, macOS
• How to Fix CVE-2023-32409: Apple Safari (Bundle Sibling)
• How to Fix CVE-2023-23529: Remote Code Execution in Safari, iOS and iPadOS, macOS