Apple Ios And Ipados vulnerabilities
2,045 known vulnerabilities affecting apple/ios_and_ipados.
Total CVEs
2,045
CISA KEV
58
actively exploited
Public exploits
18
Exploited in wild
73
Severity breakdown
CRITICAL112HIGH696MEDIUM941LOW130UNKNOWN166
Vulnerabilities
Page 20 of 103
CVE-2023-40423P3HIGHCVSS 7.8≥ unspecified, < 16.7≥ unspecified, < 17.12023-10-25
CVE-2023-40423 [HIGH] CWE-119 CVE-2023-40423: The issue was addressed with improved memory handling. This issue is fixed in iOS 17.1 and iPadOS 17
The issue was addressed with improved memory handling. This issue is fixed in iOS 17.1 and iPadOS 17.1, macOS Monterey 12.7.1, iOS 16.7.2 and iPadOS 16.7.2, macOS Ventura 13.6.1, macOS Sonoma 14.1. An app may be able to execute arbitrary code with kernel privileges.
nvd
CVE-2023-32384P3HIGHCVSS 7.8≥ unspecified, < 15.7≥ unspecified, < 16.52023-06-23
CVE-2023-32384 [HIGH] CWE-120 CVE-2023-32384: A buffer overflow was addressed with improved bounds checking. This issue is fixed in watchOS 9.5, t
A buffer overflow was addressed with improved bounds checking. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, macOS Big Sur 11.7.7, macOS Monterey 12.6.6, iOS 16.5 and iPadOS 16.5. Processing an image may lead to arbitrary code execution.
nvd
CVE-2025-31221P3HIGHCVSS 7.5fixed in 18.52025-05-12
CVE-2025-31221 [HIGH] CWE-190 CVE-2025-31221: An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.5 an
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, watchOS 11.5. A remote attacker may be able to leak memory.
nvd
CVE-2023-40396P3HIGHCVSS 7.8≥ unspecified, < 172024-07-29
CVE-2023-40396 [HIGH] CWE-77 CVE-2023-40396: The issue was addressed with improved memory handling. This issue is fixed in iOS 17 and iPadOS 17,
The issue was addressed with improved memory handling. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14, watchOS 10, tvOS 17. An app may be able to execute arbitrary code with kernel privileges.
nvd
CVE-2026-64747P3HIGHCVSS 7.8fixed in 18.7.10fixed in 26.62026-07-27
CVE-2026-64747 [HIGH] CWE-120 CVE-2026-64747: A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 18.7.10 an
A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to execute arbitrary code with kernel privileges.
nvd
CVE-2026-43776P3HIGHCVSS 7.8fixed in 18.7.10fixed in 26.62026-07-27
CVE-2026-43776 [HIGH] CWE-120 CVE-2026-43776: A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 an
A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.
nvd
CVE-2025-46285P3HIGHCVSS 7.8fixed in 18.7.3fixed in 26.22025-12-12
CVE-2025-46285 [HIGH] CWE-190 CVE-2025-46285: An integer overflow was addressed by adopting 64-bit timestamps. This issue is fixed in iOS 18.7.3 a
An integer overflow was addressed by adopting 64-bit timestamps. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. An app may be able to gain root privileges.
nvd
CVE-2026-43723P3HIGHCVSS 7.8fixed in 18.7.10fixed in 26.62026-07-27
CVE-2026-43723 [HIGH] CWE-22 CVE-2026-43723: A path handling issue was addressed with improved validation. This issue is fixed in iOS 18.7.10 and
A path handling issue was addressed with improved validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to gain root privileges.
nvd
CVE-2026-20615P3HIGHCVSS 7.8fixed in 26.32026-02-11
CVE-2026-20615 [HIGH] CWE-22 CVE-2026-20615: A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.3 and iP
A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3, visionOS 26.3. An app may be able to gain root privileges.
nvd
CVE-2026-64765P3HIGHCVSS 7.8fixed in 18.7.10fixed in 26.62026-07-27
CVE-2026-64765 [HIGH] CWE-190 CVE-2026-64765: An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.10
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.
nvd
CVE-2026-64766P3HIGHCVSS 7.8fixed in 18.7.10fixed in 26.62026-07-27
CVE-2026-64766 [HIGH] CWE-190 CVE-2026-64766: An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.10
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.
nvd
CVE-2025-43376P3HIGHCVSS 7.5fixed in 18.7.7fixed in 262025-11-04
CVE-2025-43376 [HIGH] CVE-2025-43376: A logic issue was addressed with improved state management. This issue is fixed in Safari 26, iOS 18
A logic issue was addressed with improved state management. This issue is fixed in Safari 26, iOS 18.7.7 and iPadOS 18.7.7, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. A remote attacker may be able to view leaked DNS queries with Private Relay turned on.
nvd
CVE-2026-28865P3HIGHCVSS 7.5fixed in 18.7.7fixed in 26.42026-03-25
CVE-2026-28865 [HIGH] CWE-285 CVE-2026-28865: An authentication issue was addressed with improved state management. This issue is fixed in iOS 18.
An authentication issue was addressed with improved state management. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. An attacker in a privileged network position may be able to intercept network traffic.
nvd
CVE-2026-28969P3HIGHCVSS 7.5fixed in 18.7.9fixed in 26.5+1 more2026-05-11
CVE-2026-28969 [HIGH] CWE-416 CVE-2026-28969: A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.7, macOS Sequoia 15.8, macOS Sonoma 14.8.7, macOS Tahoe 26.5, macOS Tahoe 26.7, tvOS 26.5, tvOS 27, visionOS 26.5, visionOS 27, watchOS 26.5,
nvd
CVE-2025-31238P3HIGHCVSS 7.3fixed in 18.52025-05-12
CVE-2025-31238 [HIGH] CWE-119 CVE-2025-31238: The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadO
The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to memory corruption.
nvd
CVE-2026-28876P3HIGHCVSS 7.5fixed in 18.7.7fixed in 26.42026-03-25
CVE-2026-28876 [HIGH] CWE-284 CVE-2026-28876: A parsing issue in the handling of directory paths was addressed with improved path validation. This
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, visionOS 26.4. An app may be able to access sensitive user data.
nvd
CVE-2023-23526P3CRITICALCVSS 9.8≥ unspecified, < 16.42023-05-08
CVE-2023-23526 [CRITICAL] CVE-2023-23526: This was addressed with additional checks by Gatekeeper on files downloaded from an iCloud shared-by
This was addressed with additional checks by Gatekeeper on files downloaded from an iCloud shared-by-me folder. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4. A file from an iCloud shared-by-me folder may be able to bypass Gatekeeper.
nvd
CVE-2026-28954P3HIGHCVSS 7.5fixed in 18.7.92026-05-11
CVE-2026-28954 [HIGH] CWE-290 CVE-2026-28954: A file quarantine bypass was addressed with additional checks. This issue is fixed in iOS 18.7.9 and
A file quarantine bypass was addressed with additional checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. A maliciously crafted disk image may bypass Gatekeeper checks.
nvd
CVE-2026-28990P3HIGHCVSS 7.5fixed in 18.7.10fixed in 26.52026-05-11
CVE-2026-28990 [HIGH] CWE-119 CVE-2026-28990: The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing a maliciously crafted image may corrupt process memory.
nvd
CVE-2026-28913P3HIGHCVSS 7.5fixed in 26.52026-05-11
CVE-2026-28913 [HIGH] CWE-119 CVE-2026-28913: The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.
nvd