Apple watchOS vulnerabilities

CVE-2023-32361 [MEDIUM] CVE-2023-32361: The issue was addressed with improved handling of caches. This issue is fixed in tvOS 17, iOS 17 and The issue was addressed with improved handling of caches. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. An app may be able to access user-sensitive data.

CVE-2025-30454 [MEDIUM] CWE-200 CVE-2025-30454: A path handling issue was addressed with improved validation. This issue is fixed in iOS 18.4 and iP A path handling issue was addressed with improved validation. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5, tvOS 18.4, watchOS 11.4. A malicious app may be able to access private information.

CVE-2021-1786 [MEDIUM] CVE-2021-1786: A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11. A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A local user may be able to create or modify system files.

CVE-2024-40824 [MEDIUM] CWE-281 CVE-2024-40824: This issue was addressed through improved state management. This issue is fixed in iOS 17.6 and iPad This issue was addressed through improved state management. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, watchOS 10.6. An app may be able to bypass Privacy preferences.

CVE-2024-44273 [MEDIUM] CWE-59 CVE-2024-44273: This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 18.1 and iPa This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, macOS Sonoma 14.7.1, tvOS 18.1, visionOS 2.1, watchOS 11.1. A malicious app may be able to access private information.

CVE-2022-42825 [MEDIUM] CWE-266 CVE-2022-42825: This issue was addressed by removing additional entitlements. This issue is fixed in tvOS 16.1, macO This issue was addressed by removing additional entitlements. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, iOS 16.1 and iPadOS 16, macOS Monterey 12.6.1, macOS Big Sur 11.7.1. An app may be able to modify protected parts of the file system.

CVE-2022-42811 [MEDIUM] CWE-284 CVE-2022-42811: An access issue was addressed with additional sandbox restrictions. This issue is fixed in tvOS 16.1 An access issue was addressed with additional sandbox restrictions. This issue is fixed in tvOS 16.1, iOS 16.1 and iPadOS 16, macOS Ventura 13, watchOS 9.1. An app may be able to access user-sensitive data.

CVE-2025-24214 [MEDIUM] CWE-284 CVE-2025-24214: A privacy issue was addressed by not logging contents of text fields. This issue is fixed in iOS 18. A privacy issue was addressed by not logging contents of text fields. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, tvOS 18.4, visionOS 2.4, watchOS 11.4. An app may be able to access sensitive user data.

CVE-2025-24117 [MEDIUM] CWE-922 CVE-2025-24117: This issue was addressed with improved redaction of sensitive information. This issue is fixed in iO This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, visionOS 2.3, watchOS 11.3. An app may be able to fingerprint the user.

CVE-2025-24283 [MEDIUM] CWE-200 CVE-2025-24283: A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.4 and iPad A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4, watchOS 11.4. An app may be able to access sensitive user data.

CVE-2023-32368 [MEDIUM] CWE-125 CVE-2023-32368: An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9 An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, macOS Monterey 12.6.6, iOS 16.5 and iPadOS 16.5. Processing a 3D model may result in disclosure of process memory.

CVE-2023-32408 [MEDIUM] CVE-2023-32408: The issue was addressed with improved handling of caches. This issue is fixed in watchOS 9.5, tvOS 1 The issue was addressed with improved handling of caches. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, macOS Monterey 12.6.6, iOS 16.5 and iPadOS 16.5. An app may be able to read sensitive location information.

CVE-2023-32392 [MEDIUM] CWE-532 CVE-2023-32392: A privacy issue was addressed with improved private data redaction for log entries. This issue is fi A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, macOS Big Sur 11.7.7, macOS Monterey 12.6.6, iOS 16.5 and iPadOS 16.5. An app may be able to read sensitive location information.

CVE-2023-27942 [MEDIUM] CWE-922 CVE-2023-27942: The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, iOS 16.4 an The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, macOS Big Sur 11.7.5, macOS Monterey 12.6.4, tvOS 16.4, watchOS 9.4. An app may be able to access user-sensitive data.

CVE-2023-32372 [MEDIUM] CWE-125 CVE-2023-32372: An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 16.5 An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 16.5 and iPadOS 16.5, watchOS 9.5, tvOS 16.5, macOS Ventura 13.4. Processing an image may result in disclosure of process memory.

CVE-2023-40528 [MEDIUM] CWE-284 CVE-2023-40528: This issue was addressed by removing the vulnerable code. This issue is fixed in tvOS 17, watchOS 10 This issue was addressed by removing the vulnerable code. This issue is fixed in tvOS 17, watchOS 10, macOS Sonoma 14, iOS 17 and iPadOS 17, macOS Ventura 13.6.4. An app may be able to bypass Privacy preferences.

CVE-2023-32388 [MEDIUM] CWE-281 CVE-2023-32388: A privacy issue was addressed with improved private data redaction for log entries. This issue is fi A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in watchOS 9.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, macOS Big Sur 11.7.7, macOS Monterey 12.6.6, iOS 16.5 and iPadOS 16.5. An app may be able to bypass Privacy preferences.

CVE-2023-27961 [MEDIUM] CWE-20 CVE-2023-27961: Multiple validation issues were addressed with improved input sanitization. This issue is fixed in m Multiple validation issues were addressed with improved input sanitization. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, macOS Monterey 12.6.4, watchOS 9.4, macOS Big Sur 11.7.5. Importing a maliciously crafted calendar invitation may exfiltrate user information.

CVE-2023-27931 [MEDIUM] CWE-203 CVE-2023-27931: This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Ventura 13.3, This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.3, iOS 16.4 and iPadOS 16.4, macOS Big Sur 11.7.3, tvOS 16.4, watchOS 9.4. An app may be able to access user-sensitive data.

CVE-2025-43455 [MEDIUM] CWE-200 CVE-2025-43455: A privacy issue was addressed with improved checks. This issue is fixed in iOS 26.1 and iPadOS 26.1, A privacy issue was addressed with improved checks. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. A malicious app may be able to take a screenshot of sensitive information in embedded views.