The macOS 13.5.2, iOS 16.6.1, iPadOS 16.6.1, and watchOS 9.6.2 updates that Apple released today includes fixes for security vulnerabilities that Apple says may have been actively exploited in the wild.
According to Apple's security support page, in iOS, iPadOS, and macOS, processing a maliciously crafted image could lead to arbitrary code execution, allowing a hacker to gain access to the operating system with a simple picture. Apple fixed the ImageIO process by addressing a buffer overflow issue to improve memory handling.
In iOS, iPadOS, and watchOS, a maliciously crafted attachment in the Wallet app could also lead to arbitrary code execution. Apple addressed the validation issue with improved logic.
As these updates include important security fixes, everyone should install iOS 16.6.1, iPadOS 16.6.1, macOS 13.5.2, and watchOS 9.6.2 as soon as possible. Apple recommends these software updates for all users.
Update: As reported by Citizen Lab, the vulnerabilities are part of a "BLASTPASS" exploit chain that was observed having been used in the wild to deliver NSO Group's Pegasus spyware. Pegasus is of critical concern to government officials, journalists, activists, and others with potentially sensitive information on their devices.
The zero-click vulnerability allowed attackers to send a maliciously crafted PassKit (Wallet) image to a target via iMessage, infecting their device "without any interaction from the victim."
The attacks can be blocked by applying today's updates or by enabling Lockdown Mode on your device.
