Apple iOS vulnerabilities

CVE-2024-44251 [LOW] CVE-2024-44251: This issue was addressed through improved state management. This issue is fixed in iOS 18.1 and iPad This issue was addressed through improved state management. This issue is fixed in iOS 18.1 and iPadOS 18.1. An attacker may be able to view restricted content from the lock screen.

CVE-2024-23240 [LOW] CVE-2024-23240: The issue was addressed with improved checks. This issue is fixed in iOS 17.4 and iPadOS 17.4. Shake The issue was addressed with improved checks. This issue is fixed in iOS 17.4 and iPadOS 17.4. Shake-to-undo may allow a deleted photo to be re-surfaced without authentication.

CVE-2024-40851 [LOW] CVE-2024-40851: This issue was addressed by restricting options offered on a locked device. This issue is fixed in i This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.1 and iPadOS 18.1. An attacker with physical access may be able to access contact photos from the lock screen.

CVE-2024-54556 [LOW] CWE-284 CVE-2024-54556: This issue was addressed through improved state management. This issue is fixed in iOS 18.1 and iPad This issue was addressed through improved state management. This issue is fixed in iOS 18.1 and iPadOS 18.1. A user may be able to view restricted content from the lock screen.

CVE-2025-31216 [LOW] CWE-284 CVE-2025-31216: The issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadO The issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7. An attacker with physical access to a device may be able to override managed Wi-Fi profiles.

CVE-2026-20642 [LOW] CWE-284 CVE-2026-20642: An input validation issue was addressed. This issue is fixed in iOS 26.3 and iPadOS 26.3. A person w An input validation issue was addressed. This issue is fixed in iOS 26.3 and iPadOS 26.3. A person with physical access to an iOS device may be able to access photos from the lock screen.

CVE-2015-1109 [LOW] CWE-200 CVE-2015-1109: NetworkExtension in Apple iOS before 8.3 stores credentials in VPN configuration logs, which makes i NetworkExtension in Apple iOS before 8.3 stores credentials in VPN configuration logs, which makes it easier for physically proximate attackers to obtain sensitive information by reading a log file.

CVE-2011-3245 [LOW] CWE-255 CVE-2011-3245: The Keyboards component in Apple iOS before 5 displays the final character of an entered password du The Keyboards component in Apple iOS before 5 displays the final character of an entered password during a subsequent use of a keyboard, which allows physically proximate attackers to obtain sensitive information by reading this character.

CVE-2015-7000 [LOW] CWE-200 CVE-2015-7000: Notification Center in Apple iOS before 9.1 mishandles changes to "Show on Lock Screen" settings, wh Notification Center in Apple iOS before 9.1 mishandles changes to "Show on Lock Screen" settings, which allows physically proximate attackers to obtain sensitive information by looking for a (1) Phone or (2) Messages notification on the lock screen soon after a setting was disabled.

CVE-2014-4367 [LOW] CWE-264 CVE-2014-4367: Apple iOS before 8 enables Voice Dial during all upgrade actions, which makes it easier for physical Apple iOS before 8 enables Voice Dial during all upgrade actions, which makes it easier for physically proximate attackers to launch unintended calls by speaking a telephone number.

CVE-2013-5158 [LOW] CWE-264 CVE-2013-5158: The Social subsystem in Apple iOS before 7 does not properly restrict access to the cache of Twitter The Social subsystem in Apple iOS before 7 does not properly restrict access to the cache of Twitter icons, which allows physically proximate attackers to obtain sensitive information about recent Twitter interaction via unspecified vectors.

CVE-2013-0980 [LOW] CWE-264 CVE-2013-0980: The Passcode Lock implementation in Apple iOS before 6.1.3 does not properly manage the lock state, The Passcode Lock implementation in Apple iOS before 6.1.3 does not properly manage the lock state, which allows physically proximate attackers to bypass an intended passcode requirement by leveraging an error in the emergency-call feature.

CVE-2014-1274 [LOW] CWE-200 CVE-2014-1274: FaceTime in Apple iOS before 7.1 allows physically proximate attackers to obtain sensitive FaceTime FaceTime in Apple iOS before 7.1 allows physically proximate attackers to obtain sensitive FaceTime contact information by using the lock screen for an invalid FaceTime call.

CVE-2015-5851 [LOW] CWE-200 CVE-2015-5851: The convenience initializer in the Multipeer Connectivity component in Apple iOS before 9 does not r The convenience initializer in the Multipeer Connectivity component in Apple iOS before 9 does not require an encrypted session, which allows local users to obtain cleartext multipeer data via an encrypted-to-unencrypted downgrade attack.

CVE-2014-1348 [LOW] CWE-310 CVE-2014-1348: Mail in Apple iOS before 7.1.2 advertises the availability of data protection for attachments but st Mail in Apple iOS before 7.1.2 advertises the availability of data protection for attachments but stores cleartext attachments under mobile/Library/Mail/, which makes it easier for physically proximate attackers to obtain sensitive information by mounting the data partition.

CVE-2014-4357 [LOW] CWE-200 CVE-2014-4357: Accounts Framework in Apple iOS before 8 and Apple TV before 7 allows attackers to obtain sensitive Accounts Framework in Apple iOS before 8 and Apple TV before 7 allows attackers to obtain sensitive information by reading log data that was not intended to be present in a log.

CVE-2013-0978 [LOW] CWE-200 CVE-2013-0978: The ARM prefetch abort handler in the kernel in Apple iOS before 6.1.3 and Apple TV before 5.2.1 doe The ARM prefetch abort handler in the kernel in Apple iOS before 6.1.3 and Apple TV before 5.2.1 does not ensure that it has been invoked in an abort context, which makes it easier for local users to bypass the ASLR protection mechanism via crafted code.

CVE-2015-5863 [LOW] CWE-200 CVE-2015-5863: IOStorageFamily in Apple iOS before 9 does not properly initialize an unspecified data structure, wh IOStorageFamily in Apple iOS before 9 does not properly initialize an unspecified data structure, which allows local users to obtain sensitive information from kernel memory via unknown vectors.

CVE-2015-5898 [LOW] CWE-200 CVE-2015-5898: CFNetwork in Apple iOS before 9 relies on the hardware UID for its cache encryption key, which makes CFNetwork in Apple iOS before 9 relies on the hardware UID for its cache encryption key, which makes it easier for physically proximate attackers to obtain sensitive information by obtaining this UID.

CVE-2008-4230 [LOW] CWE-200 CVE-2008-4230: The Passcode Lock feature in Apple iPhone OS 1.0 through 2.1 and iPhone OS for iPod touch 1.1 throug The Passcode Lock feature in Apple iPhone OS 1.0 through 2.1 and iPhone OS for iPod touch 1.1 through 2.1 displays SMS messages when the emergency-call screen is visible, which allows physically proximate attackers to obtain sensitive information by reading these messages. NOTE: this might be a duplicate of CVE-2008-4593.