Apple visionOS vulnerabilities

CVE-2026-28974 [HIGH] CWE-284 CVE-2026-28974: This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed i This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause a denial-of-service.

CVE-2026-84606 [HIGH] CWE-287 CVE-2026-84606: A privacy issue was addressed with improved handling of identifiers. This issue is fixed in iOS 27 a A privacy issue was addressed with improved handling of identifiers. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to identify a user across reinstalls.

CVE-2026-28962 [HIGH] CWE-200 CVE-2026-28962: This issue was addressed with improved access restrictions. This issue is fixed in Safari 26.5, iOS This issue was addressed with improved access restrictions. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5. Processing maliciously crafted web content may disclose sensitive user information.

CVE-2026-84611 [HIGH] CWE-787 CVE-2026-84611: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted 3D model may lead to memory corruption.

CVE-2024-9681 [MEDIUM] CVE-2024-9681: visionOS 2.4 Apple Security Update: About the security content of visionOS 2.4 Product: visionOS Version: 2.4 CVE: CVE-2024-9681 Component: CVE-2024-9681

CVE-2026-28972 [MEDIUM] CWE-787 CVE-2026-28972: An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iO An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination or write kernel memory.

CVE-2025-31208 [HIGH] CWE-20 CVE-2025-31208: The issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadO The issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, watchOS 11.5. Parsing a file may lead to an unexpected app termination.

CVE-2024-27832 [HIGH] CWE-703 CVE-2024-27832: The issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS The issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. An app may be able to elevate privileges.

CVE-2024-27811 [HIGH] CWE-269 CVE-2024-27811: The issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS The issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. An app may be able to elevate privileges.

CVE-2024-48958 [HIGH] CVE-2024-48958: visionOS 2.4 Apple Security Update: About the security content of visionOS 2.4 Product: visionOS Version: 2.4 CVE: CVE-2024-48958 Component: CVE-2024-48958 Impact: Processing maliciously crafted web content may result in the disclosure of process memory Description: A logic issue was addressed with improved checks.

CVE-2025-43372 [HIGH] CWE-20 CVE-2025-43372: The issue was addressed with improved input validation. This issue is fixed in iOS 26 and iPadOS 26, The issue was addressed with improved input validation. This issue is fixed in iOS 26 and iPadOS 26, macOS Sonoma 14.8.2, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.

CVE-2025-24855 [HIGH] CVE-2025-24855: visionOS 2.3 Apple Security Update: About the security content of visionOS 2.3 Product: visionOS Version: 2.3 CVE: CVE-2025-24855 Component: LaunchServices Impact: An app may be able to fingerprint the user Description: This issue was addressed with improved redaction of sensitive information.

CVE-2024-55549 [HIGH] CVE-2024-55549: visionOS 2.3 Apple Security Update: About the security content of visionOS 2.3 Product: visionOS Version: 2.3 CVE: CVE-2024-55549 Component: LaunchServices Impact: An app may be able to fingerprint the user Description: This issue was addressed with improved redaction of sensitive information.

CVE-2025-43277 [HIGH] CWE-119 CVE-2025-43277: The issue was addressed with improved memory handling. This issue is fixed in iOS 18.6 and iPadOS 18 The issue was addressed with improved memory handling. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, macOS Sonoma 14.8, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing a maliciously crafted audio file may lead to memory corruption.

CVE-2024-44126 [HIGH] CWE-787 CVE-2024-44126: The issue was addressed with improved checks. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 1 The issue was addressed with improved checks. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7.1, visionOS 2. Processing a maliciously crafted file may lead to heap corruption.

CVE-2024-23258 [HIGH] CWE-125 CVE-2024-23258: An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Son An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Sonoma 14.4, visionOS 1.1. Processing an image may lead to arbitrary code execution.

CVE-2024-54538 [HIGH] CWE-770 CVE-2024-54538: A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 1 A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1, tvOS 18.1, visionOS 2.1, watchOS 11.1. A remote attacker may be able to cause a denial-of-service.

CVE-2026-64758 [HIGH] CWE-119 CVE-2026-64758: The issue was addressed with improved bounds checks. This issue is fixed in iOS 26.6 and iPadOS 26.6 The issue was addressed with improved bounds checks. This issue is fixed in iOS 26.6 and iPadOS 26.6, iOS 26.7 and iPadOS 26.7, macOS Sequoia 15.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to unexpected app termination.

CVE-2025-24095 [HIGH] CWE-288 CVE-2025-24095: This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.4 and iPa This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, visionOS 2.4. An app may be able to bypass Privacy preferences.

CVE-2025-43462 [HIGH] CWE-400 CVE-2025-43462: The issue was addressed with improved memory handling. This issue is fixed in iOS 26.1 and iPadOS 26 The issue was addressed with improved memory handling. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. An app may be able to cause unexpected system termination or corrupt kernel memory.