Apple operating systems vulnerabilities

An integer overflow was fixed with improved input validation. The vulnerability affects Apple systems and was resolved in multiple versions. Processing an image may lead to arbitrary code execution.

A use-after-free vulnerability was fixed with improved memory management. The issue affects Apple systems and was resolved in iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. A remote attacker may cause unexpected system termination.

A reachable assertion was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5, watchOS 26.5. An attacker in a privileged network position may be able to cause a denial-of-service.

An out-of-bounds read vulnerability that could allow a remote attacker to cause unexpected app termination. The issue was addressed with improved input validation.

An authorization issue, fixed with improved state management. An app may be able to access sensitive user data.

A permissions issue in Apple systems. Additional restrictions were added. An app may be able to read a persistent device identifier.

An out-of-bounds write vulnerability that could allow an attacker to cause unexpected app termination. The issue was addressed with improved bounds checking.

An inconsistent user interface issue, fixed with improved state management. A remote attacker may be able to bypass network filters.

This issue was addressed through improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.7. An attacker with physical access may be able to access sensitive user data during iPhone Mirroring.

An integer overflow vulnerability when processing a maliciously crafted image could lead to arbitrary code execution. The issue was addressed with improved input validation.

An out-of-bounds write issue in Apple systems may cause unexpected system termination by an app. This affects iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6.

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to disclose kernel memory.

A memory handling issue was addressed. This issue affects Apple systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) and may allow an attacker to cause unexpected system termination or read kernel memory.

A vulnerability that could allow an app to cause unexpected system termination or write kernel memory. The issue was addressed with improved input sanitization.

A logic issue was addressed with improved restrictions. This issue affects Apple systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) and may allow a malicious app to break out of its sandbox.

A vulnerability in image processing that could corrupt process memory. The issue was addressed with improved memory handling.

A use-after-free vulnerability was fixed with improved memory management. The issue affects Apple systems and was resolved in multiple versions of iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. An app may cause unexpected system termination.

An out-of-bounds access issue was fixed with improved bounds checking. Affected are iOS 18.6, iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing a malicious media file may lead to unexpected app termination or memory corruption.

An issue existed in the handling of environment variables. This was addressed with improved validation. Fixed in iOS 26.3, iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3, visionOS 26.3, and watchOS 26.3. An app may be able to access sensitive user data.

A race condition was addressed with improved state handling. This issue affects Apple systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) and may allow an app to gain root privileges.

A path handling issue was addressed with improved validation. This issue affects iOS, iPadOS, macOS, visionOS and may allow an app to gain root privileges.

An inconsistent user interface issue was addressed with improved state management. An attacker may be able to spoof their FaceTime caller ID. Fixed in iOS 18.7.3, iPadOS 18.7.3, iOS 26.2, iPadOS 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2, visionOS 26.2, watchOS 26.2.

A memory corruption issue was addressed with improved bounds checking. This issue is fixed in various Apple operating systems. Processing malicious data may lead to unexpected app termination.

A logic issue was addressed with improved checks. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2, watchOS 26.2. An app may be able to inappropriately access files through the spellcheck API.