Apple operating systems vulnerabilities
74 known CVE vulnerabilities in Apple operating systems, translated and rated.
- CVE-2023-40403Medium
The issue was addressed with improved memory handling. It is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may disclose sensitive information.
- CVE-2026-64774Critical
An integer overflow vulnerability was addressed with improved input validation. The issue affects iOS, iPadOS, macOS, tvOS, and visionOS. A remote attacker may cause unexpected application termination or heap corruption.
- CVE-2026-64772Critical
An out-of-bounds write issue was addressed with improved input validation. Affects iOS, iPadOS, macOS, tvOS, and visionOS. A remote attacker may cause unexpected application termination or heap corruption.
- CVE-2026-64771Critical
A buffer overflow vulnerability was addressed with improved bounds checking. The issue affects iOS, iPadOS, macOS, tvOS, and visionOS. A remote attacker may cause unexpected application termination or heap corruption.
- CVE-2026-64770Critical
An out-of-bounds write issue was addressed with improved bounds checking. The issue affects iOS, iPadOS, macOS, tvOS, and visionOS. A remote attacker may cause unexpected application termination or heap corruption.
- CVE-2026-64769Critical
An out-of-bounds write issue was addressed with improved bounds checking. The issue affects iOS, iPadOS, macOS, tvOS, and visionOS. A remote attacker may cause unexpected application termination or heap corruption.
- CVE-2026-64746Critical
An authorization issue was addressed with improved validation. Affects iOS, iPadOS, macOS, visionOS, and watchOS. An app may add contacts without user authorization.
- CVE-2026-64726Critical
The issue was addressed with improved memory handling. Affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. An attacker in physical proximity may corrupt process memory.
- CVE-2026-43812Critical
A use after free issue was addressed with improved memory management. Affects iOS, iPadOS, macOS, tvOS, and visionOS. An app may cause unexpected system termination.
- CVE-2026-43809Critical
An out-of-bounds read was addressed with improved bounds checking. Affects iOS, iPadOS, macOS. An app may cause unexpected system termination.
- CVE-2026-43802Critical
An out-of-bounds write issue was addressed with improved bounds checking. Affects iOS, iPadOS, macOS. An app may cause unexpected system termination.
- CVE-2021-31010HighActively exploited
A deserialization issue in Apple systems, fixed in Security Update 2021-005 Catalina, iOS 12.5.5, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, and watchOS 7.6.2, may allow a sandboxed process to circumvent sandbox restrictions. Apple is aware of active exploitation.
- CVE-2021-30983HighActively exploited
A buffer overflow issue in Apple systems, fixed in iOS 15.2 and iPadOS 15.2, may allow an application to execute arbitrary code with kernel privileges.
- CVE-2021-30900HighActively exploited
An out-of-bounds write issue in Apple systems, fixed in iOS 14.8.1 and iPadOS 14.8.1, and iOS 15.1 and iPadOS 15.1, may allow a malicious application to execute arbitrary code with kernel privileges.
- CVE-2021-30883HighActively exploited
A memory corruption issue in Apple systems, fixed in iOS 15.0.2 and iPadOS 15.0.2, macOS Monterey 12.0.1, iOS 14.8.1 and iPadOS 14.8.1, tvOS 15.1, watchOS 8.1, and macOS Big Sur 11.6.1, may allow an application to execute arbitrary code with kernel privileges. Apple is aware of active exploitation.
- CVE-2021-30869HighActively exploited
A type confusion issue in Apple systems, fixed in iOS 12.5.5, iOS 14.4 and iPadOS 14.4, macOS Big Sur 11.2, and security updates, may allow a malicious application to execute arbitrary code with kernel privileges. Apple is aware of exploits in the wild.
- CVE-2021-30860HighActively exploited
An integer overflow issue in Apple systems, fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, and watchOS 7.6.2, may lead to arbitrary code execution when processing a maliciously crafted PDF. Apple is aware of active exploitation.
- CVE-2026-84599High
A memory handling issue in Apple systems allows an app to cause unexpected system termination or corrupt kernel memory. The issue is fixed in iOS 26.7.2, iPadOS 26.7.2, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27.
- CVE-2026-84595Medium
An out-of-bounds write issue in Apple systems allows an app to cause unexpected system termination. The issue was addressed with improved bounds checking and is fixed in iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, and visionOS 27.
- CVE-2026-84495High
A use-after-free issue in Apple systems was addressed with improved memory management. An app may be able to cause unexpected system termination or write kernel memory.
- CVE-2026-84494High
An out-of-bounds write issue in Apple systems was addressed with improved bounds checking. An app may be able to cause unexpected system termination or write kernel memory.
- CVE-2026-84493Medium
An authentication issue in Apple systems was addressed with improved state management. A malicious app may be able to access Bluetooth without user consent.
- CVE-2026-65397Medium
An authorization issue in Apple systems was addressed with improved state management. An app may be able to access sensitive user data.
- CVE-2026-65385High
An out-of-bounds write issue in Apple systems was addressed with improved bounds checking. A buffer overflow may result in memory corruption and unexpected app termination.
- CVE-2026-112596Low risk· EPSS 14%
An integer overflow vulnerability in Apple operating systems was addressed with improved bounds checking. Processing a maliciously crafted video file may lead to unexpected system termination.
- CVE-2026-112595Low risk· EPSS 19%
An authentication vulnerability in Apple operating systems was addressed with improved authentication. An attacker in physical proximity may be able to craft malicious network traffic to gain access to a Thread network.
- CVE-2026-112576Low risk· EPSS 15%
A memory integrity vulnerability in Apple operating systems was addressed with improved handling of copy-on-write pages. An app may be able to cause unexpected changes to copy-on-write memory.
- CVE-2026-112571Low risk· EPSS 15%
A memory initialization vulnerability in Apple operating systems was addressed with improved memory handling. Processing a maliciously crafted image may result in disclosure of process memory.
- CVE-2026-112567Low risk· EPSS 16%
An issue in Apple systems was addressed with improved checks. A malicious application may be able to bypass Privacy preferences.
- CVE-2026-112566Low risk· EPSS 13%
A null pointer dereference was addressed with improved validation. An attacker in physical proximity may be able to cause a denial-of-service.
- CVE-2026-112565Low risk· EPSS 13%
An integer overflow was addressed with improved input validation. Processing a maliciously crafted 3D model may lead to memory corruption.
- CVE-2026-112563Low risk· EPSS 12%
An out-of-bounds write issue was addressed with improved bounds checking. Processing a maliciously crafted file may lead to unexpected app termination.
- CVE-2026-112561Low risk· EPSS 14%
An out-of-bounds read was addressed with improved bounds checking. Processing a maliciously crafted image may result in disclosure of process memory.
- CVE-2026-112560Low risk· EPSS 13%
An out-of-bounds read was addressed with improved bounds checking. Processing a maliciously crafted image may result in disclosure of process memory.
- CVE-2026-112432Low risk· EPSS 12%
A logging issue was addressed with improved data redaction. An app may be able to access sensitive user data.
- CVE-2026-112425Low risk· EPSS 13%
An out-of-bounds read was addressed with improved bounds checking. Processing a 3D model may result in disclosure of process memory.
- CVE-2026-84597Medium
An out-of-bounds read issue was fixed with improved input validation. Processing a maliciously crafted font may disclose process memory. The fix is included in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.
- CVE-2026-84596Medium
An out-of-bounds read was fixed with improved bounds checking. Processing a maliciously crafted font may disclose process memory. The fix is included in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.
- CVE-2026-84593Medium
A use after free issue was fixed with improved memory management. An app may cause unexpected system termination. The fix is included in iOS 27 and iPadOS 27.
- CVE-2026-84589Medium
A permissions issue was fixed with additional restrictions. An app may be able to modify Privacy preferences. The fix is included in macOS Golden Gate 27.
- CVE-2026-84588Medium
A memory corruption issue was fixed by removing the vulnerable code. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory. The fix is included in macOS Golden Gate 27.
- CVE-2026-84587Medium
A permissions issue was fixed with additional restrictions. An app may be able to access protected user data. The fix is included in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7.
- CVE-2026-84586Medium
An information disclosure issue was fixed with improved state management. A malicious application may leak sensitive user information. The fix is included in macOS Golden Gate 27 and watchOS 27.
- CVE-2026-84585Medium
A permissions issue was fixed with improved state management. An app may be able to access local network devices without user consent. The fix is included in macOS Golden Gate 27.
- CVE-2026-84584High
This issue was fixed with improved handling of symlinks. An app may be able to break out of its sandbox. The fix is included in macOS Golden Gate 27.
- CVE-2026-84583Medium
A permissions issue was fixed with additional restrictions. A local app may be able to read a persistent account identifier. The fix is included in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27.
- CVE-2026-43688High
A memory corruption issue was addressed with improved input validation in iOS 27, iPadOS 27, and macOS Golden Gate 27. Processing a maliciously crafted file may lead to unexpected app termination.
- CVE-2026-43687Medium
The issue was addressed with improved memory handling in multiple Apple systems. Connecting to a malicious NFS server may disclose kernel memory.
- CVE-2026-43686High
A use-after-free issue was addressed with improved memory management in Apple systems. Connecting to a malicious NFS server may lead to kernel memory corruption.
- CVE-2026-43684High
A use-after-free issue was addressed with improved memory management in iOS 26.7, iPadOS 26.7, macOS Golden Gate 27, and macOS Sequoia 15.8. An app may be able to cause unexpected system termination or corrupt kernel memory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS