CVE Vulnerability Catalog

A use-after-free issue was addressed with improved memory management. The issue affects iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, and watchOS 27.2. An app may cause unexpected system termination or corrupt kernel memory.

A logic issue in macOS was addressed with improved checks. The issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2. A local attacker may be able to elevate their privileges.

An integer overflow was addressed with improved input validation. The vulnerability affects iOS, iPadOS, and macOS. Processing a maliciously crafted image may lead to arbitrary code execution.

In Seroval from 1.4.1 until 1.6.8, fromJSON and fromCrossJSON do not require an array node's element list to be an actual array. A small crafted payload can supply an attacker-controlled length that determines memory allocation and decoder iterations independently of payload size, allowing an unauthenticated request to exhaust the process or block its thread. The issue was fixed in version 1.6.8.

Seroval prior to 1.6.8 does not validate a sequence node's done index in fromJSON and fromCrossJSON. A crafted done index can create an iterator that never finishes when consumed to completion, allowing an unauthenticated request to block the event loop, exhaust memory, or make the service unavailable.

In Seroval prior to 1.6.8, fromJSON rebuilds an AsyncIteratorFactoryInstance by calling source.on(listener) without requiring source to be a genuine internal stream. With untrusted input and an application plugin returning a callable value or an object exposing an 'on' method, a crafted node can reuse an identifier so the deserializer invokes the plugin-produced value.

In systeminformation prior to 5.33.16, services() in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after sanitizeShellString(). On Windows the sanitizer removes ASCII quotes but permits Unicode quotation marks PowerShell accepts as delimiters, allowing crafted input to terminate the filter and inject a PowerShell expression executed by util.powerShell() with the Node.js process account's permissions.

A type confusion issue in Safari and Apple operating systems was addressed with improved state management. Processing maliciously crafted web content may lead to memory corruption.

This issue in macOS Golden Gate 27.2 was addressed with improved access restrictions. Unpacking a maliciously crafted archive may lead to unexpected app termination or arbitrary code execution.

An out-of-bounds write issue in macOS was addressed with improved bounds checking. An app may be able to cause unexpected system termination or corrupt kernel memory.

An out-of-bounds read in macOS was addressed with improved bounds checking. An app may be able to cause unexpected system termination or read kernel memory.

An out-of-bounds read in macOS was addressed with improved bounds checking. An app may be able to cause unexpected system termination or read kernel memory.

An out-of-bounds read in macOS was addressed with improved bounds checking. An app may be able to cause unexpected system termination or read kernel memory.

A memory handling issue in macOS was addressed with improved memory management. The vulnerability affects macOS Golden Gate 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.

An out-of-bounds access issue was addressed with improved bounds checking. The vulnerability affects iOS, iPadOS, macOS, tvOS, and visionOS in specific versions. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.

A memory corruption issue was addressed with improved input validation. The vulnerability affects iOS, iPadOS, macOS, and visionOS in specific versions. An attacker in physical proximity may be able to corrupt process memory.

A race condition in macOS was addressed with improved state handling. An app may be able to gain root privileges.

A use-after-free issue was addressed with improved memory management. The issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, and watchOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.

An out-of-bounds write issue in Apple systems was addressed with improved bounds checking. The issue affects iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, and visionOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.

An out-of-bounds write issue was addressed with improved input validation. The issue affects iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, and tvOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.