Apple Ios And Ipados vulnerabilities

CVE-2023-40393 [HIGH] CWE-306 CVE-2023-40393: An authentication issue was addressed with improved state management. This issue is fixed in iOS 17 An authentication issue was addressed with improved state management. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. Photos in the Hidden Photos Album may be viewed without authentication.

CVE-2026-20652 [HIGH] CWE-400 CVE-2026-20652: The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7. The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. A remote attacker may be able to cause a denial-of-service.

CVE-2026-65343 [HIGH] CWE-416 CVE-2026-65343: A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26. A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. A remote attacker may be able to cause unexpected system termination.

CVE-2025-43413 [HIGH] CWE-284 CVE-2025-43413: An access issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 26.1 An access issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A sandboxed app may be able to observe system-wide network connections.

CVE-2026-28959 [HIGH] CWE-120 CVE-2026-28959: A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination.

CVE-2025-43399 [HIGH] CWE-359 CVE-2025-43399: This issue was addressed with improved redaction of sensitive information. This issue is fixed in iO This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, macOS Sequoia 15.7.2, macOS Tahoe 26.1. An app may be able to access protected user data.

CVE-2025-43500 [HIGH] CWE-359 CVE-2025-43500: A privacy issue was addressed with improved handling of user preferences. This issue is fixed in iOS A privacy issue was addressed with improved handling of user preferences. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. An app may be able to access sensitive user data.

CVE-2026-28960 [HIGH] CWE-20 CVE-2026-28960: A denial-of-service issue was addressed with improved validation. This issue is fixed in iOS 18.7.10 A denial-of-service issue was addressed with improved validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10. A remote attacker may be able to cause a denial-of-service.

CVE-2026-28906 [HIGH] CWE-359 CVE-2026-28906: This issue was addressed through improved state management. This issue is fixed in iOS 18.7.9 and iP This issue was addressed through improved state management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, visionOS 26.5. An attacker may be able to track users through their IP address.

CVE-2026-28860 [HIGH] CWE-20 CVE-2026-28860: The issue was addressed with improved input validation. This issue is fixed in iOS 18.7.7 and iPadOS The issue was addressed with improved input validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. A local attacker may be able to modify the state of the Keychain.

CVE-2026-28938 [HIGH] CWE-359 CVE-2026-28938: A privacy issue was addressed by moving sensitive data. This issue is fixed in iOS 26.6 and iPadOS 2 A privacy issue was addressed by moving sensitive data. This issue is fixed in iOS 26.6 and iPadOS 26.6. An app may be able to fingerprint the user.

CVE-2026-43654 [HIGH] CWE-497 CVE-2026-43654: The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to disclose kernel memory.

CVE-2026-64752 [HIGH] CWE-787 CVE-2026-64752: A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Processing a maliciously crafted image may lead to arbitrary code execution.

CVE-2026-20688 [CRITICAL] CWE-22 CVE-2026-20688: A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.4 and iP A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, visionOS 26.4. An app may be able to break out of its sandbox.

CVE-2026-64740 [CRITICAL] CWE-22 CVE-2026-64740: A parsing issue in the handling of directory paths was addressed with improved path validation. This A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6. A malicious app may be able to break out of its sandbox.

CVE-2023-23532 [HIGH] CVE-2023-23532: This issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, iOS 16.4 a This issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, iOS 15.7.6 and iPadOS 15.7.6. An app may be able to break out of its sandbox.

CVE-2020-9967 [HIGH] CWE-787 CVE-2020-9967: Multiple memory corruption issues were addressed with improved input validation. This issue is fixed Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, tvOS 14.0, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, watchOS 7.0, iOS 14.0 and iPadOS 14.0. A remote attacker may be able to cause unexpected system termination or corrupt kernel memo

CVE-2020-27917 [HIGH] CWE-416 CVE-2020-27917: A use after free issue was addressed with improved memory management. This issue is fixed in macOS B A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 14.2 and iPadOS 14.2, iCloud for Windows 11.5, tvOS 14.2, iTunes 12.11 for Windows. Processing maliciously crafted web content may lead to code execution.

CVE-2025-31234 [HIGH] CWE-119 CVE-2025-31234: The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.5 and iPadOS The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5. An attacker may be able to cause unexpected system termination or corrupt kernel memory.

CVE-2021-1816 [HIGH] CWE-119 CVE-2021-1816: A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 14.5 and i A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5. A malicious application may be able to execute arbitrary code with kernel privileges.