Apple Ios And Ipados vulnerabilities

CVE-2025-43436 [HIGH] CWE-288 CVE-2025-43436: A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.1 and A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. An app may be able to enumerate a user's installed apps.

CVE-2026-20650 [HIGH] CWE-400 CVE-2026-20650: A denial-of-service issue was addressed with improved validation. This issue is fixed in iOS 26.3 an A denial-of-service issue was addressed with improved validation. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Bluetooth packets.

CVE-2026-28872 [HIGH] CWE-400 CVE-2026-28872: A resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS A resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.4 and iPadOS 26.4. A remote attacker may be able to cause a denial-of-service.

CVE-2026-43661 [HIGH] CWE-121 CVE-2026-43661: A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 26.5 A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. Processing a maliciously crafted image may corrupt process memory.

CVE-2026-28943 [HIGH] CWE-532 CVE-2026-28943: A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.9 and iP A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. An app may be able to determine kernel memory layout.

CVE-2025-43502 [HIGH] CWE-284 CVE-2025-43502: A privacy issue was addressed by removing sensitive data. This issue is fixed in Safari 26.1, iOS 26 A privacy issue was addressed by removing sensitive data. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1. An app may be able to bypass certain Privacy preferences.

CVE-2025-43454 [HIGH] CWE-284 CVE-2025-43454: This issue was addressed through improved state management. This issue is fixed in iOS 18.7.2 and iP This issue was addressed through improved state management. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1. A device may persistently fail to lock.

CVE-2025-43449 [HIGH] CWE-200 CVE-2025-43449: The issue was addressed with improved handling of caches. This issue is fixed in iOS 26.1 and iPadOS The issue was addressed with improved handling of caches. This issue is fixed in iOS 26.1 and iPadOS 26.1. A malicious app may be able to track users between installs.

CVE-2026-28929 [HIGH] CWE-1254 CVE-2026-28929: A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7. A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. Replying to an email could display remote images in Mail in Lockdown Mode.

CVE-2026-28944 [HIGH] CWE-119 CVE-2026-28944: The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2025-43450 [HIGH] CWE-284 CVE-2025-43450: A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.2 and iPadOS 18.7. A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1. An app may be able to learn information about the current camera view before being granted camera access.

CVE-2026-28964 [HIGH] CWE-451 CVE-2026-28964: An inconsistent user interface issue was addressed with improved state management. This issue is fix An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 26.5 and iPadOS 26.5, visionOS 26.5. An app may be able to access sensitive user data.

CVE-2025-46311 [HIGH] CWE-451 CVE-2025-46311: An inconsistent user interface issue was addressed with improved state management. This issue is fix An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2. An app may be able to access sensitive user data.

CVE-2026-20649 [HIGH] CWE-377 CVE-2026-20649: A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.3 and iPad A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, watchOS 26.3. A user may be able to view sensitive user information.

CVE-2026-43730 [CRITICAL] CWE-200 CVE-2026-43730: A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.6 and A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to fingerprint the user.

CVE-2026-64740 [CRITICAL] CWE-22 CVE-2026-64740: A parsing issue in the handling of directory paths was addressed with improved path validation. This A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6. A malicious app may be able to break out of its sandbox.

CVE-2024-54514 [HIGH] CVE-2024-54514: The issue was addressed with improved checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS The issue was addressed with improved checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2, tvOS 18.2, watchOS 11.2. An app may be able to break out of its sandbox.

CVE-2021-1816 [HIGH] CWE-119 CVE-2021-1816: A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 14.5 and i A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5. A malicious application may be able to execute arbitrary code with kernel privileges.

CVE-2025-24137 [HIGH] CWE-843 CVE-2025-24137: A type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.3 and iPadO A type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3, tvOS 18.3, visionOS 2.3. An attacker on the local network may corrupt process memory.

CVE-2020-9972 [HIGH] CWE-120 CVE-2020-9972: A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 14.0 A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 14.0 and iPadOS 14.0. Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution.