Apple iOS vulnerabilities

CVE-2025-43437 [LOW] CWE-200 CVE-2025-43437: An information disclosure issue was addressed with improved privacy controls. This issue is fixed in An information disclosure issue was addressed with improved privacy controls. This issue is fixed in iOS 26.1 and iPadOS 26.1. An app may be able to fingerprint the user.

CVE-2026-43657 [LOW] CWE-269 CVE-2026-43657: A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.5 and A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.5 and iPadOS 26.5. A malicious app may be able to enumerate installed apps.

CVE-2026-86893 [LOW] CWE-269 CVE-2026-86893: A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iP A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to read device name.

CVE-2026-20656 [LOW] CWE-285 CVE-2026-20656: A logic issue was addressed with improved validation. This issue is fixed in Safari 26.3, iOS 18.7.5 A logic issue was addressed with improved validation. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, macOS Tahoe 26.3. An app may be able to access a user's Safari history.

CVE-2026-28957 [LOW] CWE-284 CVE-2026-28957: An issue with app access to camera metadata was addressed with improved logic. This issue is fixed i An issue with app access to camera metadata was addressed with improved logic. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, visionOS 26.5. An app may be able to capture a user's screen.

CVE-2026-84605 [LOW] CWE-863 CVE-2026-84605: An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7 An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An app may be able to read the device's name.

CVE-2013-5137 [LOW] CWE-264 CVE-2013-5137: IOKit in Apple iOS before 7 allows attackers to send user-interface events to the foreground app by IOKit in Apple iOS before 7 allows attackers to send user-interface events to the foreground app by leveraging control over a background app and using the (1) task-completion API or (2) VoIP API.

CVE-2011-3427 [LOW] CWE-200 CVE-2011-3427: The Data Security component in Apple iOS before 5 and Apple TV before 4.4 does not properly restrict The Data Security component in Apple iOS before 5 and Apple TV before 4.4 does not properly restrict use of the MD5 hash algorithm within X.509 certificates, which makes it easier for man-in-the-middle attackers to spoof servers or obtain sensitive information via a crafted certificate.

CVE-2014-1360 [LOW] CWE-20 CVE-2014-1360: Lockdown in Apple iOS before 7.1.2 does not properly verify data from activation servers, which make Lockdown in Apple iOS before 7.1.2 does not properly verify data from activation servers, which makes it easier for physically proximate attackers to bypass the Activation Lock protection mechanism via unspecified vectors.

CVE-2013-0963 [LOW] CWE-20 CVE-2013-0963: Identity Services in Apple iOS before 6.1 does not properly handle validation failures of AppleID ce Identity Services in Apple iOS before 6.1 does not properly handle validation failures of AppleID certificates, which might allow physically proximate attackers to bypass authentication by leveraging an incorrect assignment of an empty string value to an AppleID.

CVE-2014-4371 [LOW] CWE-665 CVE-2014-4371: The network-statistics interface in the kernel in Apple iOS before 8 and Apple TV before 7 does not The network-statistics interface in the kernel in Apple iOS before 8 and Apple TV before 7 does not properly initialize memory, which allows attackers to obtain sensitive memory-content and memory-layout information via a crafted application, a different vulnerability than CVE-2014-4419, CVE-2014-4420, and CVE-2014-4421.

CVE-2014-4419 [LOW] CVE-2014-4419: The network-statistics interface in the kernel in Apple iOS before 8 and Apple TV before 7 does not The network-statistics interface in the kernel in Apple iOS before 8 and Apple TV before 7 does not properly initialize memory, which allows attackers to obtain sensitive memory-content and memory-layout information via a crafted application, a different vulnerability than CVE-2014-4371, CVE-2014-4420, and CVE-2014-4421.

CVE-2014-4420 [LOW] CVE-2014-4420: The network-statistics interface in the kernel in Apple iOS before 8 and Apple TV before 7 does not The network-statistics interface in the kernel in Apple iOS before 8 and Apple TV before 7 does not properly initialize memory, which allows attackers to obtain sensitive memory-content and memory-layout information via a crafted application, a different vulnerability than CVE-2014-4371, CVE-2014-4419, and CVE-2014-4421.

CVE-2014-4421 [LOW] CVE-2014-4421: The network-statistics interface in the kernel in Apple iOS before 8 and Apple TV before 7 does not The network-statistics interface in the kernel in Apple iOS before 8 and Apple TV before 7 does not properly initialize memory, which allows attackers to obtain sensitive memory-content and memory-layout information via a crafted application, a different vulnerability than CVE-2014-4371, CVE-2014-4419, and CVE-2014-4420.

CVE-2015-1085 [LOW] CWE-264 CVE-2015-1085: AppleKeyStore in Apple iOS before 8.3 does not properly restrict a certain passcode-confirmation int AppleKeyStore in Apple iOS before 8.3 does not properly restrict a certain passcode-confirmation interface, which makes it easier for attackers to verify correct passcode guesses via a crafted app.

CVE-2021-30804 [LOW] CVE-2021-30804: A permissions issue was addressed with improved validation. This issue is fixed in iOS 14.7. A malic A permissions issue was addressed with improved validation. This issue is fixed in iOS 14.7. A malicious application may be able to access Find My data.

CVE-2017-7148 [LOW] CWE-200 CVE-2017-7148: An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Location Framework" component. It allows attackers to obtain sensitive location information via a crafted app that reads the location variable.

CVE-2020-9773 [LOW] CVE-2020-9773: The issue was addressed with improved handling of icon caches. This issue is fixed in iOS 14.0 and i The issue was addressed with improved handling of icon caches. This issue is fixed in iOS 14.0 and iPadOS 14.0. A malicious application may be able to identify what other applications a user has installed.

CVE-2024-23262 [LOW] CWE-863 CVE-2024-23262: This issue was addressed with additional entitlement checks. This issue is fixed in iOS 16.7.6 and i This issue was addressed with additional entitlement checks. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, visionOS 1.1. An app may be able to spoof system notifications and UI.

CVE-2024-23228 [LOW] CWE-200 CVE-2024-23228: This issue was addressed through improved state management. This issue is fixed in iOS 17.3 and iPad This issue was addressed through improved state management. This issue is fixed in iOS 17.3 and iPadOS 17.3. Locked Notes content may have been unexpectedly unlocked.