Apple tvOS vulnerabilities
2,551 known vulnerabilities affecting apple/tvos.
Total CVEs
2,551
CISA KEV
41
actively exploited
Public exploits
209
Exploited in wild
78
Severity breakdown
CRITICAL178HIGH1308MEDIUM925LOW64UNKNOWN76
Vulnerabilities
Page 31 of 128
CVE-2022-22632P3CRITICALCVSS 9.8fixed in 15.4≥ unspecified, < 15.42022-03-18
CVE-2022-22632 [CRITICAL] CVE-2022-22632: A logic issue was addressed with improved state management. This issue is fixed in tvOS 15.4, iOS 15
A logic issue was addressed with improved state management. This issue is fixed in tvOS 15.4, iOS 15.4 and iPadOS 15.4, macOS Big Sur 11.6.5, watchOS 8.5, macOS Monterey 12.3. A malicious application may be able to elevate privileges.
nvdapple
CVE-2022-22641P3CRITICALCVSS 9.8fixed in 15.4≥ unspecified, < 15.42022-03-18
CVE-2022-22641 [CRITICAL] CWE-416 CVE-2022-22641: A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 15
A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 15.4, iOS 15.4 and iPadOS 15.4, macOS Monterey 12.3. An application may be able to gain elevated privileges.
nvdapple
CVE-2024-40815P3HIGHCVSS 7.5fixed in 17.62024-07-29
CVE-2024-40815 [HIGH] CWE-362 CVE-2024-40815: A race condition was addressed with additional validation. This issue is fixed in iOS 17.6 and iPadO
A race condition was addressed with additional validation. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, macOS Ventura 13.6.8, tvOS 17.6, watchOS 10.6. A malicious attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.
nvdapple
CVE-2025-43342P3CRITICALCVSS 9.8fixed in 26.0fixed in 262025-09-15
CVE-2025-43342 [CRITICAL] CWE-20 CVE-2025-43342: A correctness issue was addressed with improved checks. This issue is fixed in Safari 26, iOS 18.7 a
A correctness issue was addressed with improved checks. This issue is fixed in Safari 26, iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. Processing maliciously crafted web content may lead to an unexpected process crash.
nvdapple
CVE-2026-43769P3CRITICALCVSS 9.8fixed in 26.62026-07-27
CVE-2026-43769 [CRITICAL] CWE-190 CVE-2026-43769: An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.10
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination.
nvd
CVE-2016-1783P3HIGHCVSS 8.8fixed in 9.22016-03-24
CVE-2016-1783 [HIGH] CWE-119 CVE-2016-1783: WebKit in Apple iOS before 9.3, Safari before 9.1, and tvOS before 9.2 allows remote attackers to ex
WebKit in Apple iOS before 9.3, Safari before 9.1, and tvOS before 9.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
nvdapple
CVE-2017-15412P3HIGHCVSS 8.8v11.32018-03-29
CVE-2017-15412 [HIGH] CVE-2017-15412: tvOS 11.3
Apple Security Update: About the security content of tvOS 11.3
Product: tvOS
Version: 11.3
CVE: CVE-2017-15412
Component: Kernel
Impact: A malicious application may be able to determine kernel memory layout
Description: An information disclosure issue existed in the transition of program state. This issue was addressed with improved state handling.
apple
CVE-2021-21779P3HIGHCVSS 8.8v14.62021-05-24
CVE-2021-21779 [HIGH] CVE-2021-21779: tvOS 14.6
Apple Security Update: About the security content of tvOS 14.6
Product: tvOS
Version: 14.6
CVE: CVE-2021-21779
Component: WebKit
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: A use after free issue was addressed with improved memory management.
apple
CVE-2017-7160P3HIGHCVSS 8.8fixed in 11.22017-12-27
CVE-2017-7160 [HIGH] CWE-119 CVE-2017-7160: An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2
An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2 is affected. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. tvOS before 11.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service
nvdapple
CVE-2017-13885P3HIGHCVSS 8.8fixed in 11.22018-04-03
CVE-2017-13885 [HIGH] CWE-119 CVE-2017-13885: An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2
An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2 is affected. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. tvOS before 11.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of servi
nvdapple
CVE-2017-7068P3HIGHCVSS 8.8≤ 10.2.12017-07-20
CVE-2017-7068 [HIGH] CWE-119 CVE-2017-7068: An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. tvOS before 10.2.2 is affected. watchOS before 3.2.3 is affected. The issue involves the "libarchive" component. It allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via
nvdapple
CVE-2017-7157P3HIGHCVSS 8.8fixed in 11.22017-12-27
CVE-2017-7157 [HIGH] CWE-119 CVE-2017-7157: An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2
An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2 is affected. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. tvOS before 11.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service
nvdapple
CVE-2024-7264P3MEDIUMCVSS 6.5v26.22025-12-12
CVE-2024-7264 [MEDIUM] CVE-2024-7264: tvOS 26.2
Apple Security Update: About the security content of tvOS 26.2
Product: tvOS
Version: 26.2
CVE: CVE-2024-7264
Component: CVE-2024-7264
apple
CVE-2017-7156P3HIGHCVSS 8.8fixed in 11.22017-12-27
CVE-2017-7156 [HIGH] CWE-119 CVE-2017-7156: An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2
An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2 is affected. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. tvOS before 11.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service
nvdapple
CVE-2017-13856P3HIGHCVSS 8.8fixed in 11.22017-12-25
CVE-2017-13856 [HIGH] CWE-119 CVE-2017-13856: An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2
An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2 is affected. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. tvOS before 11.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of servi
nvdapple
CVE-2017-13870P3HIGHCVSS 8.8fixed in 11.22017-12-25
CVE-2017-13870 [HIGH] CWE-119 CVE-2017-13870: An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2
An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2 is affected. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. tvOS before 11.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of servi
nvdapple
CVE-2017-13866P3HIGHCVSS 8.8fixed in 11.22017-12-25
CVE-2017-13866 [HIGH] CWE-119 CVE-2017-13866: An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2
An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2 is affected. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. tvOS before 11.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of servi
nvdapple
CVE-2014-1266P3HIGHCVSS 7.4≥ 6.0, < 6.0.22014-02-22
CVE-2014-1266 [HIGH] CWE-295 CVE-2014-1266: The SSLVerifySignedServerKeyExchange function in libsecurity_ssl/lib/sslKeyExchange.c in the Secure
The SSLVerifySignedServerKeyExchange function in libsecurity_ssl/lib/sslKeyExchange.c in the Secure Transport feature in the Data Security component in Apple iOS 6.x before 6.1.6 and 7.x before 7.0.6, Apple TV 6.x before 6.0.2, and Apple OS X 10.9.x before 10.9.2 does not check the signature in a TLS Server Key Exchange message, which allows man-in-the-m
nvd
CVE-2017-2355P3HIGHCVSS 8.8fixed in 10.1.12017-02-20
CVE-2017-2355 [HIGH] CWE-119 CVE-2017-2355: An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. iCloud before 6.1.1 is affected. iTunes before 12.5.5 is affected. tvOS before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized
nvdapple
CVE-2017-2354P3HIGHCVSS 8.8fixed in 10.1.12017-02-20
CVE-2017-2354 [HIGH] CWE-119 CVE-2017-2354: An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. iCloud before 6.1.1 is affected. iTunes before 12.5.5 is affected. tvOS before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corrupt
nvdapple