Apple iOS vulnerabilities
4,134 known vulnerabilities affecting apple/iphone_os.
Total CVEs
4,134
CISA KEV
92
actively exploited
Public exploits
276
Exploited in wild
141
Severity breakdown
CRITICAL340HIGH1687MEDIUM1818LOW289
Vulnerabilities
Page 64 of 207
CVE-2015-7109P3CRITICALCVSS 9.3≤ 9.12015-12-11
CVE-2015-7109 [CRITICAL] CWE-119 CVE-2015-7109: IOAcceleratorFamily in Apple OS X before 10.11.2 and tvOS before 9.1 allows attackers to execute arb
IOAcceleratorFamily in Apple OS X before 10.11.2 and tvOS before 9.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
nvd
CVE-2024-27817P3HIGHCVSS 7.8fixed in 16.7.8≥ 17.0, < 17.52024-06-10
CVE-2024-27817 [HIGH] CWE-353 CVE-2024-27817: The issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, i
The issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7, tvOS 17.5, visionOS 1.2. An app may be able to execute arbitrary code with kernel privileges.
nvd
CVE-2026-43733P3HIGHCVSS 7.8fixed in 26.62026-07-27
CVE-2026-43733 [HIGH] CWE-119 CVE-2026-43733: The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6. Processing a maliciously crafted image may corrupt process memory.
nvd
CVE-2026-43729P3HIGHCVSS 7.8fixed in 26.62026-07-27
CVE-2026-43729 [HIGH] CWE-119 CVE-2026-43729: The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. Processing a maliciously crafted image may corrupt process memory.
nvd
CVE-2026-28951P3HIGHCVSS 7.8fixed in 18.7.9≥ 26.0, < 26.52026-05-11
CVE-2026-28951 [HIGH] CWE-863 CVE-2026-28951: An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7
An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to gain root privileges.
nvd
CVE-2026-43711P3HIGHCVSS 7.8fixed in 26.62026-07-27
CVE-2026-43711 [HIGH] CWE-119 CVE-2026-43711: A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 26
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted video file may lead to unexpected app termination.
nvd
CVE-2026-20626P3HIGHCVSS 7.8fixed in 26.32026-02-11
CVE-2026-20626 [HIGH] CWE-862 CVE-2026-20626: This issue was addressed with improved checks. This issue is fixed in iOS 26.3 and iPadOS 26.3, macO
This issue was addressed with improved checks. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Tahoe 26.3, visionOS 26.3. A malicious app may be able to gain root privileges.
nvd
CVE-2026-28865P3HIGHCVSS 7.5fixed in 18.7.7≥ 26.0, < 26.42026-03-25
CVE-2026-28865 [HIGH] CWE-285 CVE-2026-28865: An authentication issue was addressed with improved state management. This issue is fixed in iOS 18.
An authentication issue was addressed with improved state management. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. An attacker in a privileged network position may be able to intercept network traffic.
nvd
CVE-2019-8562P3CRITICALCVSS 9.6fixed in 12.22019-12-18
CVE-2019-8562 [CRITICAL] CWE-787 CVE-2019-8562: A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 12.2, t
A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows. A sandboxed process may be able to circumvent sandbox restrictions.
nvd
CVE-2026-43661P3HIGHCVSS 7.5fixed in 26.52026-05-11
CVE-2026-43661 [HIGH] CWE-121 CVE-2026-43661: A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 26.5
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. Processing a maliciously crafted image may corrupt process memory.
nvd
CVE-2026-28959P3HIGHCVSS 7.5fixed in 18.7.9≥ 26.0, < 26.52026-05-11
CVE-2026-28959 [HIGH] CWE-120 CVE-2026-28959: A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and
A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination.
nvd
CVE-2025-43496P3HIGHCVSS 7.5fixed in 26.12025-11-04
CVE-2025-43496 [HIGH] CWE-359 CVE-2025-43496: The issue was addressed by adding additional logic. This issue is fixed in iOS 18.7.2 and iPadOS 18.
The issue was addressed by adding additional logic. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. Remote content may be loaded even when the 'Load Remote Images' setting is turned off.
nvd
CVE-2025-43500P3HIGHCVSS 7.5fixed in 26.12025-11-04
CVE-2025-43500 [HIGH] CWE-359 CVE-2025-43500: A privacy issue was addressed with improved handling of user preferences. This issue is fixed in iOS
A privacy issue was addressed with improved handling of user preferences. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. An app may be able to access sensitive user data.
nvd
CVE-2026-28969P3HIGHCVSS 7.5fixed in 18.7.9≥ 26.0, < 26.52026-05-11
CVE-2026-28969 [HIGH] CWE-416 CVE-2026-28969: A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination.
nvd
CVE-2025-43502P3HIGHCVSS 7.5fixed in 26.12025-11-04
CVE-2025-43502 [HIGH] CWE-284 CVE-2025-43502: A privacy issue was addressed by removing sensitive data. This issue is fixed in Safari 26.1, iOS 26
A privacy issue was addressed by removing sensitive data. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1. An app may be able to bypass certain Privacy preferences.
nvd
CVE-2026-28906P3HIGHCVSS 7.5fixed in 18.7.9≥ 26.0, < 26.52026-05-11
CVE-2026-28906 [HIGH] CWE-359 CVE-2026-28906: This issue was addressed through improved state management. This issue is fixed in iOS 18.7.9 and iP
This issue was addressed through improved state management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, visionOS 26.5. An attacker may be able to track users through their IP address.
nvd
CVE-2011-0228P3HIGHCVSS 7.5≤ 4.2.9v1.0.0+36 more2011-08-29
CVE-2011-0228 [HIGH] CWE-20 CVE-2011-0228: The Data Security component in Apple iOS before 4.2.10 and 4.3.x before 4.3.5 does not check the bas
The Data Security component in Apple iOS before 4.2.10 and 4.3.x before 4.3.5 does not check the basicConstraints parameter during validation of X.509 certificate chains, which allows man-in-the-middle attackers to spoof an SSL server by using a non-CA certificate to sign a certificate for an arbitrary domain.
nvd
CVE-2026-28860P3HIGHCVSS 7.5fixed in 18.7.7≥ 26.0, < 26.42026-05-11
CVE-2026-28860 [HIGH] CWE-20 CVE-2026-28860: The issue was addressed with improved input validation. This issue is fixed in iOS 18.7.7 and iPadOS
The issue was addressed with improved input validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. A local attacker may be able to modify the state of the Keychain.
nvd
CVE-2026-43654P3HIGHCVSS 7.5fixed in 18.7.9≥ 26.0, < 26.52026-05-11
CVE-2026-43654 [HIGH] CWE-497 CVE-2026-43654: The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to disclose kernel memory.
nvd
CVE-2026-28990P3HIGHCVSS 7.5fixed in 26.52026-05-11
CVE-2026-28990 [HIGH] CWE-119 CVE-2026-28990: The issue was addressed with improved memory handling. This issue is fixed in iOS 26.5 and iPadOS 26
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing a maliciously crafted image may corrupt process memory.
nvd