Apple
Monthly
Unauthenticated remote denial-of-service affecting Cisco IOS XE Software across a wide version range results from multiple improper input validation flaws (CWE-20) discovered during Cisco's internal security hardening review. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) indicates that network-adjacent or internet-facing IOS XE devices can be crashed or rendered unavailable without any credentials or user interaction, with the changed scope (S:C) suggesting impact can extend beyond the directly targeted device to dependent network services. No public exploit code has been identified and this is not listed in CISA KEV, consistent with the internally discovered origin.
Improper neutralization of special elements (CWE-74 injection class) in Cisco IOS XE Software allows remote, unauthenticated attackers to compromise the confidentiality, integrity, and availability of affected network devices, per Cisco's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.8 Critical). The flaw was found during an internal Cisco security review and fixed via software hardening releases; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because the disclosure is a bundled hardening advisory, the exact injection sink and affected feature/protocol are not specified, so the concrete attack surface is not confirmed from available data.
Unauthenticated remote denial-of-service in Cisco IOS XE Software allows network-accessible attackers to crash IOS processes or force full device reloads by exploiting insufficient control flow management flaws (CWE-691), with a scope-changing availability impact rated CVSS 8.6. The vulnerabilities were discovered internally by Cisco's own engineering team as part of a proactive security review and addressed through software hardening releases - no active exploitation or public proof-of-concept has been identified at time of analysis. The affected version range is exceptionally broad, spanning IOS XE 16.6.x through 26.1.x, meaning virtually every Cisco IOS XE device on networks that has not been recently patched is likely running a vulnerable version.
Denial-of-service conditions in Cisco IOS XE Software stem from multiple incorrect calculation flaws (CWE-682) discoverable over the network without authentication, capable of crashing the affected device and disrupting all traffic transiting it. The CVSS scope change (S:C) indicates impact extends beyond the vulnerable component itself, consistent with a network appliance crash affecting downstream routing and switching functions across an enterprise. Internally discovered and disclosed by Cisco as part of a proactive software hardening initiative, no public exploit identified at time of analysis and CISA KEV status is absent.
Unauthenticated remote attackers can cause high availability impact with scope change on Cisco IOS XE Software through improper control of resources across their lifetime (CWE-664), affecting an exceptionally broad version range from 16.6.x through 26.1.x. The vulnerabilities were discovered proactively by Cisco's internal security engineering team and grouped as a software hardening release, meaning patches were prepared before external threat actor awareness. No public exploit exists and the CVE is absent from CISA KEV, but the AV:N/AC:L/PR:N/UI:N CVSS profile means exploitation requires no authentication or special conditions against any network-accessible IOS XE device.
Remote unauthenticated exploitation of improper memory buffer boundary handling in Cisco IOS XE Software can cause a complete denial of service with Changed scope (S:C), potentially cascading disruption to downstream network segments that depend on the affected routing or switching infrastructure. Affecting an extremely broad range of IOS XE release trains from 16.6.x through 26.1.x across hundreds of specific builds, this vulnerability was discovered and self-reported by Cisco's own engineering team during a proactive internal security hardening review - not in response to observed attacks. No public exploit code or CISA KEV listing has been identified at time of analysis, which moderates near-term opportunistic exploitation risk despite the high CVSS score of 8.6.
Authentication bypass and improper access control in Cisco IOS XE Software allow a remote, unauthenticated attacker to gain unauthorized access with a scope-changing impact affecting confidentiality, integrity, and availability across affected components. The issue was discovered internally by Cisco's engineering team during a proactive security review and is grouped under CWE-284 with a CVSS base score of 9.0, though the high attack complexity (AC:H) indicates non-trivial preconditions. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Denial-of-service in Cisco IOS XE Software's Blocks Extensible Exchange Protocol (BEEP) feature allows an unauthenticated remote attacker to force an unexpected device reload by sending a specially crafted BEEP SOAP request. The CVSS 8.6 score with Changed scope (S:C) reflects that a device reload disrupts all network services downstream of the affected device, amplifying impact beyond the immediate target. No public exploit or CISA KEV listing has been identified at time of analysis, though the low-complexity, no-authentication attack vector makes this a credible automated threat against any internet- or network-exposed IOS XE device running the BEEP feature.
Denial of service in Cisco IOS XE Software's SNMP subsystem allows an authenticated remote attacker to force an affected device to reload by sending a malformed SNMP request, disrupting all traffic transiting the device. The vulnerability spans all three SNMP protocol versions (1, 2c, and 3) and affects an exceptionally broad version range across both the 3.x, 16.x, and 17.x release trains. No public exploit or CISA KEV listing has been identified at time of analysis, but the scope-change rating (S:C) reflects that a device reload cascades into a network outage for all downstream systems dependent on the affected device.
Authentication bypass in the WooCommerce - Social Login plugin for WordPress (all versions up to and including 2.8.7) lets unauthenticated attackers log in as any existing user, including administrators, by forging an Apple id_token containing the victim's email address. The Apple login handler base64-decodes the JWT payload but never verifies the token signature against Apple's public keys nor validates the issuer, audience, or expiry claims, and the nonce needed to trigger the flow is publicly leaked to anonymous visitors. Reported by Wordfence and rated CVSS 9.8; no public exploit identified at time of analysis.
Remote denial of service in Thumbor's convolution filter (versions <= 7.7.7) allows an attacker to crash the Thumbor worker process with a single crafted HTTP request by passing columns=0 to the filters:convolution() URL parameter. The Python-layer input validation accepts zero via an overly permissive regex (PositiveNumber matches '0'), which propagates to a C extension that performs integer division by zero, triggering SIGFPE and killing the process on x86_64 Linux and macOS Intel. No public exploit identified at time of analysis per KEV, but a fully functional proof-of-concept is documented in the vendor's own GHSA advisory, making exploitation trivially reproducible.
Heap corruption via a use-after-free in Google Chrome for iOS (versions prior to 151.0.7922.72) lets a remote attacker potentially corrupt memory when a victim opens a crafted HTML page, with the CVSS 8.8 vector modeling full confidentiality, integrity, and availability loss. Google reported it internally and Chromium rated the security severity as Low; there is no public exploit identified at time of analysis, EPSS is low at 0.21% (11th percentile), and SSVC records exploitation status as none.
Sandbox escape in Google Chrome for iOS before 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page, escalating a contained renderer foothold into broader control (CVSS 9.6, scope-changed). Reported internally by the Chrome team under CWE-20 insufficient input validation; no public exploit identified at time of analysis, and EPSS is low at 0.29% (21st percentile), consistent with a chained bug that is not yet weaponized. Vendor-released patch is available in stable channel 151.0.7922.72.
Sandbox escape in Google Chrome for iOS before version 151.0.7922.72 allows a remote attacker to break out of the browser's security boundary when a victim opens a crafted HTML page. Rated High by Chromium and carrying a 9.6 CVSS due to a scope-changing, high-impact outcome requiring only user interaction, though there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.29%, 21st percentile). A vendor-released patch is available and CISA SSVC currently records exploitation status as none.
Man-in-the-middle interception in Devolutions Password Manager (version 2026.2.1.0 and earlier on Android, iOS, and macOS) stems from improper TLS certificate validation when the mobile/desktop client connects to a Devolutions Server. An adjacent-network attacker presenting a forged certificate can silently intercept and modify the sensitive vault/session traffic between client and server. No public exploit is identified at time of analysis, and CISA SSVC scores exploitation as 'none,' though the technical impact is rated total.
Two-factor authentication bypass in TeamViewer Full Client and Host for macOS before 15.80 lets an already-authenticated, high-privileged attacker circumvent the configured 2FA 'Connections approval' control on the Unattended Access feature and establish a full remote session to the target Mac. The flaw is a business-logic error in the connection-approval flow (CWE-288) rather than a memory-safety issue, and successful exploitation yields interactive control of the host. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Out-of-bounds read in macOS allows a malicious app to trigger unexpected system termination. Patches are available in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public exploit code has been identified, and EPSS indicates low probability of widespread exploitation.
A sandbox escape in macOS allows a malicious application to break out of its sandbox due to an authorization flaw in state management. Fixed in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6, the vulnerability could enable a local app with user interaction to read and modify protected data. No active exploitation or public proof-of-concept code has been identified.
Kernel memory corruption via race condition in Apple OS allows a malicious app to write arbitrary kernel memory or cause unexpected system termination. The issue affects iOS, iPadOS, macOS, and watchOS versions prior to the June 2026 security fixes, and has been patched by Apple. No public exploit or active exploitation is known, and EPSS indicates a low probability of widespread exploitation at this time.
Connecting to a malicious SMB server can cause unexpected system termination in macOS due to a memory handling vulnerability (CWE-119). The issue affects all macOS versions prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 and has been addressed with improved memory handling. No known active exploitation or public exploit code exists, and the EPSS probability of exploitation is very low (0.15%).
A code signing enforcement bypass in Apple operating systems allows a maliciously crafted app to execute with high confidentiality and integrity impact. No active exploitation is reported, and the EPSS score of 0.17% indicates a low probability of weaponization. Apple has released patches in version 26.6 for all affected platforms.
A sandbox escape vulnerability in Apple operating systems allows a malicious app to break out of its containment and gain full access to the device. Affected versions include iOS and iPadOS prior to 26.6, multiple macOS versions (Sonoma before 14.8.8, Sequoia before 15.7.8, Tahoe before 26.6), and tvOS before 26.6. No public exploit or active exploitation has been identified, and EPSS indicates a low probability of real-world attacks.
Buffer overflow in Apple macOS allows a malicious app to cause unexpected system termination. Affects macOS versions prior to 26.6 (Tahoe). No active exploitation or public exploit code is known, and EPSS indicates a low 0.15% probability of exploitation.
Memory corruption in Apple's audio processing framework affects iOS, iPadOS, macOS (Sonoma, Sequoia, Tahoe), tvOS, visionOS, and watchOS, where parsing a maliciously crafted audio file can corrupt process memory and potentially lead to arbitrary code execution. The flaw requires a victim to open or process the malicious file (local vector, user interaction) but no prior privileges. Apple has shipped fixes across all platforms; no public exploit identified at time of analysis and EPSS is low (0.16%).
Use-after-free vulnerability in Safari’s web content processing allows remote attackers to execute arbitrary code on affected Apple devices when a user visits a malicious website. Affected versions include Safari prior to 26.6, iOS and iPadOS prior to 26.6, macOS Tahoe prior to 26.6, visionOS prior to 26.6, and watchOS prior to 26.6. No public exploit or active exploitation has been identified, and EPSS indicates a low probability of exploitation (0.13%).
Unexpected system termination in macOS prior to Sequoia 15.7.8, Sonoma 14.8.8, or Tahoe 26.6 allows a local application to trigger a denial-of-service via an out-of-bounds read. No active exploitation or public exploit is known, and EPSS indicates a low exploitation probability. The high CVSS score likely overstates the risk, as only a crash is confirmed in the description.
Remote denial-of-service in Apple macOS versions prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 allows unauthenticated attackers to disrupt system availability through an input validation weakness. No active exploitation or public exploit code has been identified; EPSS indicates low probability of widespread attacks.
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Sequoia before 15.7.8, macOS Sonoma before 14.8.8, macOS Tahoe/tvOS/visionOS/watchOS before 26.6 - where a use-after-free (CWE-416) lets a locally installed app crash the system. There is no public exploit identified at time of analysis and the NVD CVSS 9.8 (C:H/I:H/A:H) conflicts with Apple's own description, which states only 'unexpected system termination' (availability impact), suggesting the true impact is a DoS crash rather than full compromise. EPSS is low (0.17%, 6th percentile) and the issue is not in CISA KEV.
Arbitrary code execution via buffer overflow in Apple iOS, iPadOS, and macOS. Processing a maliciously crafted file can
Privacy bypass in macOS before Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 allows a malicious application to circumvent Transparency, Consent, and Control (TCC) protections, granting unauthorized access to sensitive data and system resources. The vulnerability stems from an authorization flaw resolved via improved state management. No public exploit or active exploitation is known at this time, and EPSS estimates a very low (0.16%) chance of exploitation.
Information disclosure in Apple macOS (Sonoma before 14.8.8 and Tahoe before 26.6) allows an app to bypass access restrictions and reach user-sensitive data due to a CWE-284 improper access control flaw. Apple has shipped fixes and the CVSS 8.6 rating reflects high confidentiality impact, but EPSS is low (0.14%, 4th percentile) and CISA SSVC shows no observed exploitation. No public exploit is confirmed in the intelligence, though a referenced 'it's a pre-auth' writeup and 'Authentication Bypass' tag hint at a bypass primitive worth verifying.
Memory corruption in Apple's cross-platform image-processing stack allows a maliciously crafted image to corrupt process memory across iOS/iPadOS, macOS, tvOS, visionOS, and watchOS. Apple self-reported and patched the flaw (fixed in iOS/iPadOS 26.6, macOS Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.6, and the 26.6 releases of tvOS/visionOS/watchOS). No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and CISA SSVC records exploitation status as none, though the technical impact is rated total.
Unexpected system termination and kernel memory corruption in macOS allows remote attackers to fully compromise a machine. The race condition (CWE-362) is triggered without authentication or user interaction, and Apple has released fixes in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public exploit is confirmed, and EPSS indicates a low probability of real-world attacks.
Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected system termination. Affected versions include iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. While the NVD assigns CVSS 9.8, the actual impact is limited to availability; no active exploitation or public exploit code is identified, and EPSS indicates very low exploitation probability (0.17%).
Memory corruption in Apple Safari 26.x allows remote code execution via processing maliciously crafted web content. This buffer overflow (CWE-119) affects all Apple platforms—iOS, iPadOS, macOS, visionOS, and watchOS—requiring user interaction to visit a malicious webpage. While the CVSS score is critical (8.8), EPSS (0.13%) indicates low current exploitation probability and no KEV listing or public exploit exists.
A race condition in Apple operating systems (iOS, iPadOS, macOS, tvOS, watchOS) fixed in version 26.6 allows a local malicious app to cause unexpected system termination, resulting in a denial-of-service condition. No evidence of active exploitation or public exploit code exists, and EPSS indicates very low exploitation probability (0.16%). The NVD-assigned CVSS 9.8 appears inconsistent with the actual impact, which is limited to availability.
Unexpected system termination in iOS and iPadOS prior to 26.6, as well as in certain versions of macOS, tvOS, and visionOS, resulting from a use-after-free memory corruption. Apple's description indicates a local denial-of-service where a malicious app can crash the system, while the NVD-assigned CVSS 9.8 erroneously implies unauthenticated remote code execution. A patch is available, no active exploitation has been reported, and EPSS suggests a very low probability of wide exploitation.
Missing authorization in Apple's Contacts framework across iOS/iPadOS, macOS Tahoe, visionOS, and watchOS (all versions before 26.6) allows an installed app to add contact entries without triggering the user's authorization prompt. Apple fixed the flaw with improved validation in the 26.6 releases. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.16% (6th percentile), consistent with a low-severity local privacy-scope bypass despite the input's inflated 9.8 score.
Memory corruption in macOS prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 allows a local app to cause unexpected system termination or corrupt kernel memory. Despite a CVSS score of 9.8, the attack vector is local and no public exploit or active exploitation has been identified; EPSS estimates exploitation probability at 0.16%, and CISA SSVC confirms no current exploitation but notes the issue is automatable with total technical impact.
User fingerprinting in Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS allows a malicious app to collect device or user identifiers due to a permissions issue. All versions prior to the 26.6 updates are affected. No public exploit code or active exploitation has been identified, and EPSS indicates a low 0.15% probability of exploitation.
Memory corruption in macOS may allow a malicious app to corrupt the memory of a system process, potentially leading to arbitrary code execution. This issue is fixed in macOS Sonoma 14.8.8 and macOS Tah
Denial-of-service
Out-of-bounds read in macOS allows an attacker to crash applications and potentially access sensitive memory by tricking a user into opening a maliciously crafted file. Affecting macOS Son
Kernel memory corruption in Apple XNU kernel allows a remote attacker to potentially execute arbitrary code or crash the system when a victim connects to a malicious NFS server. Affected are all Apple operating systems—iOS, iPadOS, macOS, tvOS, and watchOS—before version 26.6. No active exploitation or public exploit code has been observed, and EPSS indicates a low probability of widespread attacks.
Kernel memory corruption in macOS allows remote code execution with high impact on confidentiality, integrity, and availability. A buffer overflow vulnerability allows network-based attackers to execute arbitrary code with kernel privileges, potentially compromising the system. Patches are available in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6, and while no active exploitation has been reported, the remotely exploitable nature without authentication makes patching critical.
Sandbox escape in macOS Sequoia and Tahoe allows a malicious app to break out of its sandbox via a path traversal flaw (CWE-22). Patched in Sequoia 15.7.8 and Tahoe 26.6, the vulnerability enables unauthorized file access from a sandboxed application. No public exploit code is known, and EPSS predicts low exploitation probability (0.16%).
Processing a maliciously crafted file on unpatched Apple operating systems (iOS, iPadOS, macOS, tvOS, watchOS, visionOS) may allow arbitrary code execution due to an integer overflow in file handling. The vulnerability affects all versions prior to the latest OS updates and requires user interaction (opening a file) to trigger. No active exploitation or public exploit code has been identified, and patches are available in the vendor-released updates.
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be triggered by a remote attacker via an out-of-bounds write. The issue, patched in the latest OS updates, carries a CVSS base score of 9.8 but is not known to be actively exploited. EPSS estimates a low 0.25% probability of exploitation, and no public exploit code has been identified.
A local privilege escalation vulnerability in macOS allows a malicious app to gain root privileges by exploiting incorrect default permissions. Affected macOS versions are prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public exploit code has been reported, though the high CVSS score reflects potential for complete system compromise.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, and visionOS 26.6 allows unauthenticated network attackers to corrupt heap memory via an out-of-bounds write. This can lead to arbitrary code execution or unexpected application termination, compromising the affected device
Type confusion in macOS and tvOS may allow a malicious app to trigger unexpected system termination and potentially achieve arbitrary code execution with kernel-level privileges. The issue is addressed in macOS Tahoe 26.6 and tvOS 26.6; no active exploitation or public proof-of-concept is known at the time of analysis.
Improper validation of environment variables in macOS enables a local application to trigger unexpected system termination, causing a denial-of-service condition. The vulnerability affects macOS versions prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public exploit has been identified, and the EPSS score is very low at 0.16%.
Physical-proximity memory corruption in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, watchOS, visionOS) allows a nearby attacker to corrupt process memory, potentially leading to arbitrary code execution or denial of service. No active exploitation is known, and vendor-released patches are available. EPSS score is low (0.16%), and the CVSS vector supplied (AV:N) conflicts with the required physical proximity.
Local kernel memory read in macOS via a buffer overflow, fixed in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. A local user with low privileges can trigger the overflow to read sensitive kernel data, potentially leaking encryption keys or credentials. No active exploitation or public exploit code is known.
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause application termination or arbitrary code execution. Affected products include iOS and iPadOS prior to version 26.6, macOS before Sequoia 15.7.8 and Tahoe 26.6, tvOS before 26.6, and visionOS before 26.6; no active exploitation or public proof-of-concept has been reported.
Use-after-free memory corruption in Apple's core operating-system platforms - iOS/iPadOS, macOS Tahoe, tvOS, and watchOS before version 26.6 - allows a locally installed and executed application to crash or unexpectedly terminate the system. Exploitation requires the victim to run attacker-supplied code as an app on an unpatched device; there is no remote attack surface, and the demonstrable impact is availability only (system termination/reboot), with no data disclosure, modification, or code execution established - meaning the publicly circulated CVSS 9.8 network vector materially overstates the real reachability and impact of this bug. No public exploit identified at time of analysis, EPSS is low at 0.16% (6th percentile), CISA SSVC records Exploitation: none with total technical impact if reached, and Apple has shipped fixes in 26.6 across all four platforms.
Local privilege escalation in Apple macOS due to incorrect default permissions (C
Kernel memory corruption in Apple macOS allows a remote, unauthenticated attacker to crash the system or corrupt kernel memory on hosts running versions prior to Sequoia 15.7.8, Sonoma 14.8.8, or Tahoe 26.6. Apple's advisory attributes the flaw to insufficient bounds checking (CWE-120), and although the vendor rates it 9.8 with full confidentiality, integrity, and availability impact, our independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - the demonstrated outcome is denial of service through kernel termination or memory corruption, with code execution not proven and the triggering service, protocol, or listener undisclosed. No public exploit has been identified at time of analysis, EPSS is low (0.26%, 18th percentile), and CISA's SSVC records exploitation as 'none'; vendor-released patches are available, so remediation should be prioritized on network-exposed macOS hosts rather than treated as an emergency active-exploitation event.
An out-of-bounds write vulnerability in macOS allows a malicious application to cause unexpected system termination. Apple addressed this in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public exploit is known, and EPSS indicates very low exploitation probability.
Processing a maliciously crafted video file may lead to memory corruption enabling possible arbitrary code execution on multiple Apple operating systems. Affected platforms include iOS, iPadOS, macOS, tvOS, watchOS, and visionOS; fixes are available in the latest updates (iOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6). User interaction is required to open the malicious video, and no public exploit or active exploitation is known at this time.
Buffer overflow in macOS versions prior to 15.7.8, 14.8.8, and 26.6 allows a malicious app to escape its
Local privilege escalation in macOS Sonoma 14.x before 14.8.8 and Sequoia 15.x before 15.7.8 allows a malicious app to gain elevated system privileges via a race condition. Apple has released patches, and no active exploitation or public proof-of-concept has been identified at this time.
Arbitrary code execution in Apple iOS, iPadOS, and macOS arises when the OS image-processing pipeline handles a maliciously crafted image, triggering an integer overflow (CWE-190) that can be leveraged to run attacker-controlled code. The flaw affects iOS/iPadOS before 26.6 and multiple macOS trains (Sonoma before 14.8.8, Sequoia before 15.7.8, Tahoe before 26.6) and requires the victim to open or process the malicious image (UI:R). No public exploit has been identified at time of analysis, EPSS is low (0.18%, 7th percentile), and it is not listed in CISA KEV.
Kernel memory corruption vulnerability in Apple macOS allows a remote unauthenticated attacker to cause unexpected system termination or potentially execute arbitrary code with kernel privileges. Affected versions include macOS Sequoia prior to 15.7.8, macOS Sonoma prior to 14.8.8, and macOS Tahoe prior to 26.6. Although EPSS indicates low exploitation likelihood and no active exploitation or public exploit is reported, the critical CVSS score and network attack vector make patching a priority.
Local kernel memory disclosure and denial-of-service vulnerability in macOS 14.x and 15.x prior to patches. An unauthenticated attacker with local access can trigger a memory handling flaw to read kernel memory or cause unexpected system termination. No active exploitation or public exploit code is known; EPSS score is very low (0.14%).
Use-after-free memory corruption in Apple's iOS 26.6-era platform family lets an already-installed app crash the operating system kernel or a system service, producing an unexpected system termination (denial of service). Affected software spans iOS/iPadOS before 26.6, macOS Sequoia before 15.7.8, macOS Sonoma before 14.8.8, macOS Tahoe before 26.6, and tvOS, visionOS and watchOS before 26.6; exploitation requires the attacker's app to run locally on the device, since the flaw is only reachable from within an executing process. The headline input score of CVSS 9.8 (AV:N) overstates the issue - Apple's own advisory describes impact limited to a crashing app, EPSS is a low 0.17% (6th percentile), CISA SSVC records no exploitation and no public exploit code exists, and no KEV listing or POC is associated with CVE-2026-43822.
We are tasked with producing a JSON analysis for CVE-2026-64747. We must use all provided data, including EPSS, SSVC, patch availability, CPE, and tags. The vulnerability is a buffer overflow in Apple products, with an app potentially executing arbitrary code with kernel privileges. CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). CWE-120. Patch available from vendor. EPSS 0.19% (low). SSVC: Exploitation none, Automatable no, Technical impact total. KEV status? Not in input, so not KEV. POC? Not mentioned. Tags include RCE, Apple, Buffer Overflow, etc. Affected products: iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. CPEs confirm. References are Apple support pages. We must produce fields: - product_name: 1-3 words, specific product. Since it spans many OSes, the "primary one"? The CVE description mentions iOS and iPadOS, macOS, tvOS, visionOS, watchOS. The common underlying component is likely the kernel or something. But the product is Apple's operating systems. Could say "Apple OS Family" or "Apple Kernel". The description says "An app may be able to execute arbitrary code with kernel privileges." So the vulnerability is in the kernel, accessible via an app. So product could be "Apple Kernel" or "Apple Operating Systems". But the instruction says "The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel'." So maybe "Apple Kernel". However, it's not explicitly named. The CPEs list specific products: ios_and_ipados, macos, tvos, visionos, watchos. So I'll use "Apple OS Family" but that is 3 words. "Apple Kernel" is 2 words. I'll go with "Apple Kernel" as the vulnerable component. The description isn't clear if it's the kernel itself or a system library, but "kernel privileges" suggests kernel execution. So "Apple Kernel" is appropriate. - summary: 2-3 sentences, original synthesis, avoid starting with "A vulnerability". Start with impact verb a
A use-after-free vulnerability in Apple operating systems allows a malicious app to cause unexpected system termination or write to kernel memory. The issue affects iOS
Denial of service in Apple iOS, macOS, and related operating systems due to a use-after-free flaw could allow a malicious app to crash the device. Apple's advisory only confirms unexpected system termination, but an independent CVSS score of 9.8 suggests potential for full system compromise; however, the CVSS vector appears inconsistent with the vendor description. The vulnerability is patched in versions 26.6 for all affected OSes, and no active exploitation or public exploit code is known.
Mounting a maliciously crafted disk image on macOS may cause unexpected system termination or corrupt kernel memory. Affected versions include macOS Sequoia prior to 15.7.8, macOS Sonoma prior to 14.8.8, and macOS Tahoe prior to 26.6. The vulnerability is an out-of-bounds read in the kernel's disk image handling, exploitable by a locally authenticated user with no privileges beyond the ability to mount a disk image.
Remote attackers can cause unexpected application termination and potentially read sensitive memory on affected Apple devices. This out-of-bounds read vulnerability, tracked as CVE-2026-64768, affects iOS, iPadOS, macOS, tvOS, and visionOS due to insufficient input validation. No active exploitation or public proof-of-concept code has been identified.
Local privilege escalation in macOS before Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 allows an app to gain root privileges via an argument injection flaw. Apple has addressed the issue with improved validation, and no public exploit or active exploitation has been reported. The low attack complexity and full system compromise warrant immediate patching.
Remote exploitation of a buffer overflow in the macOS kernel allows unauthenticated attackers to corrupt kernel memory or unexpectedly terminate the system, potentially leading to
Information disclosure in Apple Safari and OS-integrated WebKit allows websites to detect if a user has visited specific URLs. Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS prior to version 26.6 are affected. No public exploit code or active attacks have been reported, and the probability of exploitation is very low (EPSS 0.17%).
Local privilege escalation in macOS allows a malicious app to gain root privileges through a path traversal vulnerability in directory path handling. Affected versions include macOS Sonoma prior to 14.
Denial-of-service vulnerability in Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS due to an out-of-bounds write in a shared component. A malicious app executed locally can cause a system crash; the CVSS vector also suggests potential high confidentiality impact (memory disclosure), though the advisory only mentions denial-of-service. Fixed in updates; no active exploitation or public exploit code reported, and EPSS probability is very low (0.17%).
Integrity modification in macOS Keychain allows remote unauthenticated attackers to modify Keychain state via a race condition. This vulnerability (CVE-2026-43728) is fixed in macOS Tahoe 26.6, with no known active exploitation but automatable according to SSVC. While CVSS rates it high severity, EPSS indicates very low likelihood of near-term exploitation.
Kernel memory-handling faults in Apple macOS can let a remote attacker cause unexpected system termination or corrupt kernel memory on unpatched systems - macOS Tahoe before 26.6, Sonoma before 14.8.8, and Sequoia before 15.7.8. Apple addressed the flaw with improved memory handling in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6, so fully updated builds are remediated; there is no public exploit identified at time of analysis and no confirmed active exploitation, and the EPSS score remains low at 0.24% (15th percentile). Apple's own wording that 'a remote user' may trigger the issue, combined with the published CVSS vector (PR:N) versus our assessed vector (PR:L, AC:H), leaves the authentication prerequisite ambiguous, but the realistically demonstrated outcome is denial of service via kernel panic, with memory-corruption-driven code execution or data disclosure possible in principle but unconfirmed.
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an out-of-bounds write bug. An unauthenticated attacker can trigger heap corruption by sending a malicious payload over the network, leading to unexpected application termination or potential arbitrary code execution with no user interaction required. Apple has released platform patches fixing this critical vulnerability, and while no active exploitation or public exploit is known, the EPSS score indicates low near-term exploitation
Memory corruption in macOS allows a malicious app to write kernel memory or cause unexpected system termination. Affected versions include macOS Sequoia prior to 15.7.8, macOS Sonoma prior to 14.8.8, and macOS Tahoe prior to 26.6. Successful exploitation could lead to complete system compromise with kernel-level privileges, though no active exploitation or public exploit code has been identified and EPSS indicates a low probability (0.16%) of widespread attacks.
Memory corruption in the macOS kernel allows a local app to disclose kernel memory, potentially enabling further exploitation. Fixed in macOS Sequoia 15.7.8 and Sonoma 14.8.8, the vulnerability requires user interaction but no elevated privileges. No public exploit code or active exploitation has been identified, and the EPSS probability is very low (0.15%).
Arbitrary code execution via malicious file processing affects multiple Apple operating systems due to an out-of-bounds write. Fixed in iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No active exploitation or public exploit is known, and EPSS predicts a very low probability of real-world attacks.
Denial of service in Apple operating systems (iOS/iPadOS 26.6, macOS Sonoma 14.8.8, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS/visionOS/watchOS 26.6) allows a locally installed app to trigger an integer overflow that causes unexpected system termination. The flaw was reported and patched by Apple, and CISA's SSVC framework rates exploitation as 'none' with EPSS at just 0.17% (6th percentile), indicating no public exploit identified at time of analysis. Note a significant signal conflict: the NVD CVSS vector of 9.8 (AV:N, full C/I/A impact) is inconsistent with the description, which describes only an app-triggered crash.
A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An attacker can use this information disclosure vulnerability to track the user’s identity across different contexts, violating privacy. The issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6, and no active exploitation or public exploit code has been observed.
Sandbox escape in Apple iOS/iPadOS, macOS, and watchOS lets a malicious application break out of its sandbox by triggering an integer overflow (CWE-190) in shared OS code, potentially gaining access beyond its permitted boundaries. Apple discovered and reported the issue and shipped fixes across its platform lineup; there is no public exploit identified at time of analysis, and CISA SSVC rates exploitation as none, though the total technical impact and scope change make it a meaningful local sandbox-escape risk. EPSS is low (0.16%, 6th percentile), consistent with no observed exploitation.
Memory corruption vulnerability in Apple operating system kernels (iOS, iPadOS, macOS, visionOS) arises from improper memory handling (CWE-119) and can be triggered by a locally installed application. Successful exploitation may allow an attacker to cause unexpected
A memory handling vulnerability in macOS kernel allows a local malicious application to read kernel memory or trigger an unexpected system termination, without requiring elevated privileges. Fixed versions are macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No public exploit code is known, and the extremely low EPSS likelihood (0.16%) indicates no active exploitation attempts.
Processing a maliciously crafted file on Apple operating systems can lead to arbitrary code execution due to an integer overflow vulnerability (CWE-190). Affected products include iOS, iPadOS, macOS, tvOS, visionOS, and watchOS, all prior to their respective fixed versions. No public exploit code has been identified, and the EPSS score of 0.17% indicates a very low probability of near-term exploitation, though the impact could be severe.
Memory corruption vulnerability in Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS) allows an attacker with a maliciously crafted image to corrupt process memory, potentially leading to arbitrary code execution. The issue is fixed in iOS/iPadOS 26.6, macOS Sequoia 15.7.8/macOS Tahoe 26.6, tvOS 26.6, and visionOS 26.6. No active exploitation has been reported (CISA KEV not listed), and the EPSS score of 0.16% indicates low exploitation likelihood.
A use-after-free memory-corruption flaw in Apple's mobile and desktop operating systems lets an app already running on the device trigger an unexpected system termination - a denial-of-service condition affecting availability only. The issue is fixed in iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, and watchOS 26.6, meaning every device running an earlier build of those platforms is exposed. There is no evidence of active exploitation (not in CISA KEV, SSVC exploitation: none) and no public exploit code has been identified; EPSS is just 0.16% (6th percentile), and the widely circulated CVSS 9.8 AV:N/PR:N vector is grossly inflated relative to the assessed AV:L/AC:L/PR:N/UI:N impact of C:N/I:N/A:H.
Unauthenticated remote denial-of-service affecting Cisco IOS XE Software across a wide version range results from multiple improper input validation flaws (CWE-20) discovered during Cisco's internal security hardening review. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) indicates that network-adjacent or internet-facing IOS XE devices can be crashed or rendered unavailable without any credentials or user interaction, with the changed scope (S:C) suggesting impact can extend beyond the directly targeted device to dependent network services. No public exploit code has been identified and this is not listed in CISA KEV, consistent with the internally discovered origin.
Improper neutralization of special elements (CWE-74 injection class) in Cisco IOS XE Software allows remote, unauthenticated attackers to compromise the confidentiality, integrity, and availability of affected network devices, per Cisco's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.8 Critical). The flaw was found during an internal Cisco security review and fixed via software hardening releases; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because the disclosure is a bundled hardening advisory, the exact injection sink and affected feature/protocol are not specified, so the concrete attack surface is not confirmed from available data.
Unauthenticated remote denial-of-service in Cisco IOS XE Software allows network-accessible attackers to crash IOS processes or force full device reloads by exploiting insufficient control flow management flaws (CWE-691), with a scope-changing availability impact rated CVSS 8.6. The vulnerabilities were discovered internally by Cisco's own engineering team as part of a proactive security review and addressed through software hardening releases - no active exploitation or public proof-of-concept has been identified at time of analysis. The affected version range is exceptionally broad, spanning IOS XE 16.6.x through 26.1.x, meaning virtually every Cisco IOS XE device on networks that has not been recently patched is likely running a vulnerable version.
Denial-of-service conditions in Cisco IOS XE Software stem from multiple incorrect calculation flaws (CWE-682) discoverable over the network without authentication, capable of crashing the affected device and disrupting all traffic transiting it. The CVSS scope change (S:C) indicates impact extends beyond the vulnerable component itself, consistent with a network appliance crash affecting downstream routing and switching functions across an enterprise. Internally discovered and disclosed by Cisco as part of a proactive software hardening initiative, no public exploit identified at time of analysis and CISA KEV status is absent.
Unauthenticated remote attackers can cause high availability impact with scope change on Cisco IOS XE Software through improper control of resources across their lifetime (CWE-664), affecting an exceptionally broad version range from 16.6.x through 26.1.x. The vulnerabilities were discovered proactively by Cisco's internal security engineering team and grouped as a software hardening release, meaning patches were prepared before external threat actor awareness. No public exploit exists and the CVE is absent from CISA KEV, but the AV:N/AC:L/PR:N/UI:N CVSS profile means exploitation requires no authentication or special conditions against any network-accessible IOS XE device.
Remote unauthenticated exploitation of improper memory buffer boundary handling in Cisco IOS XE Software can cause a complete denial of service with Changed scope (S:C), potentially cascading disruption to downstream network segments that depend on the affected routing or switching infrastructure. Affecting an extremely broad range of IOS XE release trains from 16.6.x through 26.1.x across hundreds of specific builds, this vulnerability was discovered and self-reported by Cisco's own engineering team during a proactive internal security hardening review - not in response to observed attacks. No public exploit code or CISA KEV listing has been identified at time of analysis, which moderates near-term opportunistic exploitation risk despite the high CVSS score of 8.6.
Authentication bypass and improper access control in Cisco IOS XE Software allow a remote, unauthenticated attacker to gain unauthorized access with a scope-changing impact affecting confidentiality, integrity, and availability across affected components. The issue was discovered internally by Cisco's engineering team during a proactive security review and is grouped under CWE-284 with a CVSS base score of 9.0, though the high attack complexity (AC:H) indicates non-trivial preconditions. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Denial-of-service in Cisco IOS XE Software's Blocks Extensible Exchange Protocol (BEEP) feature allows an unauthenticated remote attacker to force an unexpected device reload by sending a specially crafted BEEP SOAP request. The CVSS 8.6 score with Changed scope (S:C) reflects that a device reload disrupts all network services downstream of the affected device, amplifying impact beyond the immediate target. No public exploit or CISA KEV listing has been identified at time of analysis, though the low-complexity, no-authentication attack vector makes this a credible automated threat against any internet- or network-exposed IOS XE device running the BEEP feature.
Denial of service in Cisco IOS XE Software's SNMP subsystem allows an authenticated remote attacker to force an affected device to reload by sending a malformed SNMP request, disrupting all traffic transiting the device. The vulnerability spans all three SNMP protocol versions (1, 2c, and 3) and affects an exceptionally broad version range across both the 3.x, 16.x, and 17.x release trains. No public exploit or CISA KEV listing has been identified at time of analysis, but the scope-change rating (S:C) reflects that a device reload cascades into a network outage for all downstream systems dependent on the affected device.
Authentication bypass in the WooCommerce - Social Login plugin for WordPress (all versions up to and including 2.8.7) lets unauthenticated attackers log in as any existing user, including administrators, by forging an Apple id_token containing the victim's email address. The Apple login handler base64-decodes the JWT payload but never verifies the token signature against Apple's public keys nor validates the issuer, audience, or expiry claims, and the nonce needed to trigger the flow is publicly leaked to anonymous visitors. Reported by Wordfence and rated CVSS 9.8; no public exploit identified at time of analysis.
Remote denial of service in Thumbor's convolution filter (versions <= 7.7.7) allows an attacker to crash the Thumbor worker process with a single crafted HTTP request by passing columns=0 to the filters:convolution() URL parameter. The Python-layer input validation accepts zero via an overly permissive regex (PositiveNumber matches '0'), which propagates to a C extension that performs integer division by zero, triggering SIGFPE and killing the process on x86_64 Linux and macOS Intel. No public exploit identified at time of analysis per KEV, but a fully functional proof-of-concept is documented in the vendor's own GHSA advisory, making exploitation trivially reproducible.
Heap corruption via a use-after-free in Google Chrome for iOS (versions prior to 151.0.7922.72) lets a remote attacker potentially corrupt memory when a victim opens a crafted HTML page, with the CVSS 8.8 vector modeling full confidentiality, integrity, and availability loss. Google reported it internally and Chromium rated the security severity as Low; there is no public exploit identified at time of analysis, EPSS is low at 0.21% (11th percentile), and SSVC records exploitation status as none.
Sandbox escape in Google Chrome for iOS before 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page, escalating a contained renderer foothold into broader control (CVSS 9.6, scope-changed). Reported internally by the Chrome team under CWE-20 insufficient input validation; no public exploit identified at time of analysis, and EPSS is low at 0.29% (21st percentile), consistent with a chained bug that is not yet weaponized. Vendor-released patch is available in stable channel 151.0.7922.72.
Sandbox escape in Google Chrome for iOS before version 151.0.7922.72 allows a remote attacker to break out of the browser's security boundary when a victim opens a crafted HTML page. Rated High by Chromium and carrying a 9.6 CVSS due to a scope-changing, high-impact outcome requiring only user interaction, though there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.29%, 21st percentile). A vendor-released patch is available and CISA SSVC currently records exploitation status as none.
Man-in-the-middle interception in Devolutions Password Manager (version 2026.2.1.0 and earlier on Android, iOS, and macOS) stems from improper TLS certificate validation when the mobile/desktop client connects to a Devolutions Server. An adjacent-network attacker presenting a forged certificate can silently intercept and modify the sensitive vault/session traffic between client and server. No public exploit is identified at time of analysis, and CISA SSVC scores exploitation as 'none,' though the technical impact is rated total.
Two-factor authentication bypass in TeamViewer Full Client and Host for macOS before 15.80 lets an already-authenticated, high-privileged attacker circumvent the configured 2FA 'Connections approval' control on the Unattended Access feature and establish a full remote session to the target Mac. The flaw is a business-logic error in the connection-approval flow (CWE-288) rather than a memory-safety issue, and successful exploitation yields interactive control of the host. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Out-of-bounds read in macOS allows a malicious app to trigger unexpected system termination. Patches are available in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public exploit code has been identified, and EPSS indicates low probability of widespread exploitation.
A sandbox escape in macOS allows a malicious application to break out of its sandbox due to an authorization flaw in state management. Fixed in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6, the vulnerability could enable a local app with user interaction to read and modify protected data. No active exploitation or public proof-of-concept code has been identified.
Kernel memory corruption via race condition in Apple OS allows a malicious app to write arbitrary kernel memory or cause unexpected system termination. The issue affects iOS, iPadOS, macOS, and watchOS versions prior to the June 2026 security fixes, and has been patched by Apple. No public exploit or active exploitation is known, and EPSS indicates a low probability of widespread exploitation at this time.
Connecting to a malicious SMB server can cause unexpected system termination in macOS due to a memory handling vulnerability (CWE-119). The issue affects all macOS versions prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 and has been addressed with improved memory handling. No known active exploitation or public exploit code exists, and the EPSS probability of exploitation is very low (0.15%).
A code signing enforcement bypass in Apple operating systems allows a maliciously crafted app to execute with high confidentiality and integrity impact. No active exploitation is reported, and the EPSS score of 0.17% indicates a low probability of weaponization. Apple has released patches in version 26.6 for all affected platforms.
A sandbox escape vulnerability in Apple operating systems allows a malicious app to break out of its containment and gain full access to the device. Affected versions include iOS and iPadOS prior to 26.6, multiple macOS versions (Sonoma before 14.8.8, Sequoia before 15.7.8, Tahoe before 26.6), and tvOS before 26.6. No public exploit or active exploitation has been identified, and EPSS indicates a low probability of real-world attacks.
Buffer overflow in Apple macOS allows a malicious app to cause unexpected system termination. Affects macOS versions prior to 26.6 (Tahoe). No active exploitation or public exploit code is known, and EPSS indicates a low 0.15% probability of exploitation.
Memory corruption in Apple's audio processing framework affects iOS, iPadOS, macOS (Sonoma, Sequoia, Tahoe), tvOS, visionOS, and watchOS, where parsing a maliciously crafted audio file can corrupt process memory and potentially lead to arbitrary code execution. The flaw requires a victim to open or process the malicious file (local vector, user interaction) but no prior privileges. Apple has shipped fixes across all platforms; no public exploit identified at time of analysis and EPSS is low (0.16%).
Use-after-free vulnerability in Safari’s web content processing allows remote attackers to execute arbitrary code on affected Apple devices when a user visits a malicious website. Affected versions include Safari prior to 26.6, iOS and iPadOS prior to 26.6, macOS Tahoe prior to 26.6, visionOS prior to 26.6, and watchOS prior to 26.6. No public exploit or active exploitation has been identified, and EPSS indicates a low probability of exploitation (0.13%).
Unexpected system termination in macOS prior to Sequoia 15.7.8, Sonoma 14.8.8, or Tahoe 26.6 allows a local application to trigger a denial-of-service via an out-of-bounds read. No active exploitation or public exploit is known, and EPSS indicates a low exploitation probability. The high CVSS score likely overstates the risk, as only a crash is confirmed in the description.
Remote denial-of-service in Apple macOS versions prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 allows unauthenticated attackers to disrupt system availability through an input validation weakness. No active exploitation or public exploit code has been identified; EPSS indicates low probability of widespread attacks.
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Sequoia before 15.7.8, macOS Sonoma before 14.8.8, macOS Tahoe/tvOS/visionOS/watchOS before 26.6 - where a use-after-free (CWE-416) lets a locally installed app crash the system. There is no public exploit identified at time of analysis and the NVD CVSS 9.8 (C:H/I:H/A:H) conflicts with Apple's own description, which states only 'unexpected system termination' (availability impact), suggesting the true impact is a DoS crash rather than full compromise. EPSS is low (0.17%, 6th percentile) and the issue is not in CISA KEV.
Arbitrary code execution via buffer overflow in Apple iOS, iPadOS, and macOS. Processing a maliciously crafted file can
Privacy bypass in macOS before Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 allows a malicious application to circumvent Transparency, Consent, and Control (TCC) protections, granting unauthorized access to sensitive data and system resources. The vulnerability stems from an authorization flaw resolved via improved state management. No public exploit or active exploitation is known at this time, and EPSS estimates a very low (0.16%) chance of exploitation.
Information disclosure in Apple macOS (Sonoma before 14.8.8 and Tahoe before 26.6) allows an app to bypass access restrictions and reach user-sensitive data due to a CWE-284 improper access control flaw. Apple has shipped fixes and the CVSS 8.6 rating reflects high confidentiality impact, but EPSS is low (0.14%, 4th percentile) and CISA SSVC shows no observed exploitation. No public exploit is confirmed in the intelligence, though a referenced 'it's a pre-auth' writeup and 'Authentication Bypass' tag hint at a bypass primitive worth verifying.
Memory corruption in Apple's cross-platform image-processing stack allows a maliciously crafted image to corrupt process memory across iOS/iPadOS, macOS, tvOS, visionOS, and watchOS. Apple self-reported and patched the flaw (fixed in iOS/iPadOS 26.6, macOS Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.6, and the 26.6 releases of tvOS/visionOS/watchOS). No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and CISA SSVC records exploitation status as none, though the technical impact is rated total.
Unexpected system termination and kernel memory corruption in macOS allows remote attackers to fully compromise a machine. The race condition (CWE-362) is triggered without authentication or user interaction, and Apple has released fixes in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public exploit is confirmed, and EPSS indicates a low probability of real-world attacks.
Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected system termination. Affected versions include iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. While the NVD assigns CVSS 9.8, the actual impact is limited to availability; no active exploitation or public exploit code is identified, and EPSS indicates very low exploitation probability (0.17%).
Memory corruption in Apple Safari 26.x allows remote code execution via processing maliciously crafted web content. This buffer overflow (CWE-119) affects all Apple platforms—iOS, iPadOS, macOS, visionOS, and watchOS—requiring user interaction to visit a malicious webpage. While the CVSS score is critical (8.8), EPSS (0.13%) indicates low current exploitation probability and no KEV listing or public exploit exists.
A race condition in Apple operating systems (iOS, iPadOS, macOS, tvOS, watchOS) fixed in version 26.6 allows a local malicious app to cause unexpected system termination, resulting in a denial-of-service condition. No evidence of active exploitation or public exploit code exists, and EPSS indicates very low exploitation probability (0.16%). The NVD-assigned CVSS 9.8 appears inconsistent with the actual impact, which is limited to availability.
Unexpected system termination in iOS and iPadOS prior to 26.6, as well as in certain versions of macOS, tvOS, and visionOS, resulting from a use-after-free memory corruption. Apple's description indicates a local denial-of-service where a malicious app can crash the system, while the NVD-assigned CVSS 9.8 erroneously implies unauthenticated remote code execution. A patch is available, no active exploitation has been reported, and EPSS suggests a very low probability of wide exploitation.
Missing authorization in Apple's Contacts framework across iOS/iPadOS, macOS Tahoe, visionOS, and watchOS (all versions before 26.6) allows an installed app to add contact entries without triggering the user's authorization prompt. Apple fixed the flaw with improved validation in the 26.6 releases. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.16% (6th percentile), consistent with a low-severity local privacy-scope bypass despite the input's inflated 9.8 score.
Memory corruption in macOS prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 allows a local app to cause unexpected system termination or corrupt kernel memory. Despite a CVSS score of 9.8, the attack vector is local and no public exploit or active exploitation has been identified; EPSS estimates exploitation probability at 0.16%, and CISA SSVC confirms no current exploitation but notes the issue is automatable with total technical impact.
User fingerprinting in Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS allows a malicious app to collect device or user identifiers due to a permissions issue. All versions prior to the 26.6 updates are affected. No public exploit code or active exploitation has been identified, and EPSS indicates a low 0.15% probability of exploitation.
Memory corruption in macOS may allow a malicious app to corrupt the memory of a system process, potentially leading to arbitrary code execution. This issue is fixed in macOS Sonoma 14.8.8 and macOS Tah
Denial-of-service
Out-of-bounds read in macOS allows an attacker to crash applications and potentially access sensitive memory by tricking a user into opening a maliciously crafted file. Affecting macOS Son
Kernel memory corruption in Apple XNU kernel allows a remote attacker to potentially execute arbitrary code or crash the system when a victim connects to a malicious NFS server. Affected are all Apple operating systems—iOS, iPadOS, macOS, tvOS, and watchOS—before version 26.6. No active exploitation or public exploit code has been observed, and EPSS indicates a low probability of widespread attacks.
Kernel memory corruption in macOS allows remote code execution with high impact on confidentiality, integrity, and availability. A buffer overflow vulnerability allows network-based attackers to execute arbitrary code with kernel privileges, potentially compromising the system. Patches are available in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6, and while no active exploitation has been reported, the remotely exploitable nature without authentication makes patching critical.
Sandbox escape in macOS Sequoia and Tahoe allows a malicious app to break out of its sandbox via a path traversal flaw (CWE-22). Patched in Sequoia 15.7.8 and Tahoe 26.6, the vulnerability enables unauthorized file access from a sandboxed application. No public exploit code is known, and EPSS predicts low exploitation probability (0.16%).
Processing a maliciously crafted file on unpatched Apple operating systems (iOS, iPadOS, macOS, tvOS, watchOS, visionOS) may allow arbitrary code execution due to an integer overflow in file handling. The vulnerability affects all versions prior to the latest OS updates and requires user interaction (opening a file) to trigger. No active exploitation or public exploit code has been identified, and patches are available in the vendor-released updates.
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be triggered by a remote attacker via an out-of-bounds write. The issue, patched in the latest OS updates, carries a CVSS base score of 9.8 but is not known to be actively exploited. EPSS estimates a low 0.25% probability of exploitation, and no public exploit code has been identified.
A local privilege escalation vulnerability in macOS allows a malicious app to gain root privileges by exploiting incorrect default permissions. Affected macOS versions are prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public exploit code has been reported, though the high CVSS score reflects potential for complete system compromise.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, and visionOS 26.6 allows unauthenticated network attackers to corrupt heap memory via an out-of-bounds write. This can lead to arbitrary code execution or unexpected application termination, compromising the affected device
Type confusion in macOS and tvOS may allow a malicious app to trigger unexpected system termination and potentially achieve arbitrary code execution with kernel-level privileges. The issue is addressed in macOS Tahoe 26.6 and tvOS 26.6; no active exploitation or public proof-of-concept is known at the time of analysis.
Improper validation of environment variables in macOS enables a local application to trigger unexpected system termination, causing a denial-of-service condition. The vulnerability affects macOS versions prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public exploit has been identified, and the EPSS score is very low at 0.16%.
Physical-proximity memory corruption in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, watchOS, visionOS) allows a nearby attacker to corrupt process memory, potentially leading to arbitrary code execution or denial of service. No active exploitation is known, and vendor-released patches are available. EPSS score is low (0.16%), and the CVSS vector supplied (AV:N) conflicts with the required physical proximity.
Local kernel memory read in macOS via a buffer overflow, fixed in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. A local user with low privileges can trigger the overflow to read sensitive kernel data, potentially leaking encryption keys or credentials. No active exploitation or public exploit code is known.
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause application termination or arbitrary code execution. Affected products include iOS and iPadOS prior to version 26.6, macOS before Sequoia 15.7.8 and Tahoe 26.6, tvOS before 26.6, and visionOS before 26.6; no active exploitation or public proof-of-concept has been reported.
Use-after-free memory corruption in Apple's core operating-system platforms - iOS/iPadOS, macOS Tahoe, tvOS, and watchOS before version 26.6 - allows a locally installed and executed application to crash or unexpectedly terminate the system. Exploitation requires the victim to run attacker-supplied code as an app on an unpatched device; there is no remote attack surface, and the demonstrable impact is availability only (system termination/reboot), with no data disclosure, modification, or code execution established - meaning the publicly circulated CVSS 9.8 network vector materially overstates the real reachability and impact of this bug. No public exploit identified at time of analysis, EPSS is low at 0.16% (6th percentile), CISA SSVC records Exploitation: none with total technical impact if reached, and Apple has shipped fixes in 26.6 across all four platforms.
Local privilege escalation in Apple macOS due to incorrect default permissions (C
Kernel memory corruption in Apple macOS allows a remote, unauthenticated attacker to crash the system or corrupt kernel memory on hosts running versions prior to Sequoia 15.7.8, Sonoma 14.8.8, or Tahoe 26.6. Apple's advisory attributes the flaw to insufficient bounds checking (CWE-120), and although the vendor rates it 9.8 with full confidentiality, integrity, and availability impact, our independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - the demonstrated outcome is denial of service through kernel termination or memory corruption, with code execution not proven and the triggering service, protocol, or listener undisclosed. No public exploit has been identified at time of analysis, EPSS is low (0.26%, 18th percentile), and CISA's SSVC records exploitation as 'none'; vendor-released patches are available, so remediation should be prioritized on network-exposed macOS hosts rather than treated as an emergency active-exploitation event.
An out-of-bounds write vulnerability in macOS allows a malicious application to cause unexpected system termination. Apple addressed this in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public exploit is known, and EPSS indicates very low exploitation probability.
Processing a maliciously crafted video file may lead to memory corruption enabling possible arbitrary code execution on multiple Apple operating systems. Affected platforms include iOS, iPadOS, macOS, tvOS, watchOS, and visionOS; fixes are available in the latest updates (iOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6). User interaction is required to open the malicious video, and no public exploit or active exploitation is known at this time.
Buffer overflow in macOS versions prior to 15.7.8, 14.8.8, and 26.6 allows a malicious app to escape its
Local privilege escalation in macOS Sonoma 14.x before 14.8.8 and Sequoia 15.x before 15.7.8 allows a malicious app to gain elevated system privileges via a race condition. Apple has released patches, and no active exploitation or public proof-of-concept has been identified at this time.
Arbitrary code execution in Apple iOS, iPadOS, and macOS arises when the OS image-processing pipeline handles a maliciously crafted image, triggering an integer overflow (CWE-190) that can be leveraged to run attacker-controlled code. The flaw affects iOS/iPadOS before 26.6 and multiple macOS trains (Sonoma before 14.8.8, Sequoia before 15.7.8, Tahoe before 26.6) and requires the victim to open or process the malicious image (UI:R). No public exploit has been identified at time of analysis, EPSS is low (0.18%, 7th percentile), and it is not listed in CISA KEV.
Kernel memory corruption vulnerability in Apple macOS allows a remote unauthenticated attacker to cause unexpected system termination or potentially execute arbitrary code with kernel privileges. Affected versions include macOS Sequoia prior to 15.7.8, macOS Sonoma prior to 14.8.8, and macOS Tahoe prior to 26.6. Although EPSS indicates low exploitation likelihood and no active exploitation or public exploit is reported, the critical CVSS score and network attack vector make patching a priority.
Local kernel memory disclosure and denial-of-service vulnerability in macOS 14.x and 15.x prior to patches. An unauthenticated attacker with local access can trigger a memory handling flaw to read kernel memory or cause unexpected system termination. No active exploitation or public exploit code is known; EPSS score is very low (0.14%).
Use-after-free memory corruption in Apple's iOS 26.6-era platform family lets an already-installed app crash the operating system kernel or a system service, producing an unexpected system termination (denial of service). Affected software spans iOS/iPadOS before 26.6, macOS Sequoia before 15.7.8, macOS Sonoma before 14.8.8, macOS Tahoe before 26.6, and tvOS, visionOS and watchOS before 26.6; exploitation requires the attacker's app to run locally on the device, since the flaw is only reachable from within an executing process. The headline input score of CVSS 9.8 (AV:N) overstates the issue - Apple's own advisory describes impact limited to a crashing app, EPSS is a low 0.17% (6th percentile), CISA SSVC records no exploitation and no public exploit code exists, and no KEV listing or POC is associated with CVE-2026-43822.
We are tasked with producing a JSON analysis for CVE-2026-64747. We must use all provided data, including EPSS, SSVC, patch availability, CPE, and tags. The vulnerability is a buffer overflow in Apple products, with an app potentially executing arbitrary code with kernel privileges. CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). CWE-120. Patch available from vendor. EPSS 0.19% (low). SSVC: Exploitation none, Automatable no, Technical impact total. KEV status? Not in input, so not KEV. POC? Not mentioned. Tags include RCE, Apple, Buffer Overflow, etc. Affected products: iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. CPEs confirm. References are Apple support pages. We must produce fields: - product_name: 1-3 words, specific product. Since it spans many OSes, the "primary one"? The CVE description mentions iOS and iPadOS, macOS, tvOS, visionOS, watchOS. The common underlying component is likely the kernel or something. But the product is Apple's operating systems. Could say "Apple OS Family" or "Apple Kernel". The description says "An app may be able to execute arbitrary code with kernel privileges." So the vulnerability is in the kernel, accessible via an app. So product could be "Apple Kernel" or "Apple Operating Systems". But the instruction says "The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel'." So maybe "Apple Kernel". However, it's not explicitly named. The CPEs list specific products: ios_and_ipados, macos, tvos, visionos, watchos. So I'll use "Apple OS Family" but that is 3 words. "Apple Kernel" is 2 words. I'll go with "Apple Kernel" as the vulnerable component. The description isn't clear if it's the kernel itself or a system library, but "kernel privileges" suggests kernel execution. So "Apple Kernel" is appropriate. - summary: 2-3 sentences, original synthesis, avoid starting with "A vulnerability". Start with impact verb a
A use-after-free vulnerability in Apple operating systems allows a malicious app to cause unexpected system termination or write to kernel memory. The issue affects iOS
Denial of service in Apple iOS, macOS, and related operating systems due to a use-after-free flaw could allow a malicious app to crash the device. Apple's advisory only confirms unexpected system termination, but an independent CVSS score of 9.8 suggests potential for full system compromise; however, the CVSS vector appears inconsistent with the vendor description. The vulnerability is patched in versions 26.6 for all affected OSes, and no active exploitation or public exploit code is known.
Mounting a maliciously crafted disk image on macOS may cause unexpected system termination or corrupt kernel memory. Affected versions include macOS Sequoia prior to 15.7.8, macOS Sonoma prior to 14.8.8, and macOS Tahoe prior to 26.6. The vulnerability is an out-of-bounds read in the kernel's disk image handling, exploitable by a locally authenticated user with no privileges beyond the ability to mount a disk image.
Remote attackers can cause unexpected application termination and potentially read sensitive memory on affected Apple devices. This out-of-bounds read vulnerability, tracked as CVE-2026-64768, affects iOS, iPadOS, macOS, tvOS, and visionOS due to insufficient input validation. No active exploitation or public proof-of-concept code has been identified.
Local privilege escalation in macOS before Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 allows an app to gain root privileges via an argument injection flaw. Apple has addressed the issue with improved validation, and no public exploit or active exploitation has been reported. The low attack complexity and full system compromise warrant immediate patching.
Remote exploitation of a buffer overflow in the macOS kernel allows unauthenticated attackers to corrupt kernel memory or unexpectedly terminate the system, potentially leading to
Information disclosure in Apple Safari and OS-integrated WebKit allows websites to detect if a user has visited specific URLs. Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS prior to version 26.6 are affected. No public exploit code or active attacks have been reported, and the probability of exploitation is very low (EPSS 0.17%).
Local privilege escalation in macOS allows a malicious app to gain root privileges through a path traversal vulnerability in directory path handling. Affected versions include macOS Sonoma prior to 14.
Denial-of-service vulnerability in Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS due to an out-of-bounds write in a shared component. A malicious app executed locally can cause a system crash; the CVSS vector also suggests potential high confidentiality impact (memory disclosure), though the advisory only mentions denial-of-service. Fixed in updates; no active exploitation or public exploit code reported, and EPSS probability is very low (0.17%).
Integrity modification in macOS Keychain allows remote unauthenticated attackers to modify Keychain state via a race condition. This vulnerability (CVE-2026-43728) is fixed in macOS Tahoe 26.6, with no known active exploitation but automatable according to SSVC. While CVSS rates it high severity, EPSS indicates very low likelihood of near-term exploitation.
Kernel memory-handling faults in Apple macOS can let a remote attacker cause unexpected system termination or corrupt kernel memory on unpatched systems - macOS Tahoe before 26.6, Sonoma before 14.8.8, and Sequoia before 15.7.8. Apple addressed the flaw with improved memory handling in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6, so fully updated builds are remediated; there is no public exploit identified at time of analysis and no confirmed active exploitation, and the EPSS score remains low at 0.24% (15th percentile). Apple's own wording that 'a remote user' may trigger the issue, combined with the published CVSS vector (PR:N) versus our assessed vector (PR:L, AC:H), leaves the authentication prerequisite ambiguous, but the realistically demonstrated outcome is denial of service via kernel panic, with memory-corruption-driven code execution or data disclosure possible in principle but unconfirmed.
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an out-of-bounds write bug. An unauthenticated attacker can trigger heap corruption by sending a malicious payload over the network, leading to unexpected application termination or potential arbitrary code execution with no user interaction required. Apple has released platform patches fixing this critical vulnerability, and while no active exploitation or public exploit is known, the EPSS score indicates low near-term exploitation
Memory corruption in macOS allows a malicious app to write kernel memory or cause unexpected system termination. Affected versions include macOS Sequoia prior to 15.7.8, macOS Sonoma prior to 14.8.8, and macOS Tahoe prior to 26.6. Successful exploitation could lead to complete system compromise with kernel-level privileges, though no active exploitation or public exploit code has been identified and EPSS indicates a low probability (0.16%) of widespread attacks.
Memory corruption in the macOS kernel allows a local app to disclose kernel memory, potentially enabling further exploitation. Fixed in macOS Sequoia 15.7.8 and Sonoma 14.8.8, the vulnerability requires user interaction but no elevated privileges. No public exploit code or active exploitation has been identified, and the EPSS probability is very low (0.15%).
Arbitrary code execution via malicious file processing affects multiple Apple operating systems due to an out-of-bounds write. Fixed in iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No active exploitation or public exploit is known, and EPSS predicts a very low probability of real-world attacks.
Denial of service in Apple operating systems (iOS/iPadOS 26.6, macOS Sonoma 14.8.8, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS/visionOS/watchOS 26.6) allows a locally installed app to trigger an integer overflow that causes unexpected system termination. The flaw was reported and patched by Apple, and CISA's SSVC framework rates exploitation as 'none' with EPSS at just 0.17% (6th percentile), indicating no public exploit identified at time of analysis. Note a significant signal conflict: the NVD CVSS vector of 9.8 (AV:N, full C/I/A impact) is inconsistent with the description, which describes only an app-triggered crash.
A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An attacker can use this information disclosure vulnerability to track the user’s identity across different contexts, violating privacy. The issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6, and no active exploitation or public exploit code has been observed.
Sandbox escape in Apple iOS/iPadOS, macOS, and watchOS lets a malicious application break out of its sandbox by triggering an integer overflow (CWE-190) in shared OS code, potentially gaining access beyond its permitted boundaries. Apple discovered and reported the issue and shipped fixes across its platform lineup; there is no public exploit identified at time of analysis, and CISA SSVC rates exploitation as none, though the total technical impact and scope change make it a meaningful local sandbox-escape risk. EPSS is low (0.16%, 6th percentile), consistent with no observed exploitation.
Memory corruption vulnerability in Apple operating system kernels (iOS, iPadOS, macOS, visionOS) arises from improper memory handling (CWE-119) and can be triggered by a locally installed application. Successful exploitation may allow an attacker to cause unexpected
A memory handling vulnerability in macOS kernel allows a local malicious application to read kernel memory or trigger an unexpected system termination, without requiring elevated privileges. Fixed versions are macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No public exploit code is known, and the extremely low EPSS likelihood (0.16%) indicates no active exploitation attempts.
Processing a maliciously crafted file on Apple operating systems can lead to arbitrary code execution due to an integer overflow vulnerability (CWE-190). Affected products include iOS, iPadOS, macOS, tvOS, visionOS, and watchOS, all prior to their respective fixed versions. No public exploit code has been identified, and the EPSS score of 0.17% indicates a very low probability of near-term exploitation, though the impact could be severe.
Memory corruption vulnerability in Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS) allows an attacker with a maliciously crafted image to corrupt process memory, potentially leading to arbitrary code execution. The issue is fixed in iOS/iPadOS 26.6, macOS Sequoia 15.7.8/macOS Tahoe 26.6, tvOS 26.6, and visionOS 26.6. No active exploitation has been reported (CISA KEV not listed), and the EPSS score of 0.16% indicates low exploitation likelihood.
A use-after-free memory-corruption flaw in Apple's mobile and desktop operating systems lets an app already running on the device trigger an unexpected system termination - a denial-of-service condition affecting availability only. The issue is fixed in iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, and watchOS 26.6, meaning every device running an earlier build of those platforms is exposed. There is no evidence of active exploitation (not in CISA KEV, SSVC exploitation: none) and no public exploit code has been identified; EPSS is just 0.16% (6th percentile), and the widely circulated CVSS 9.8 AV:N/PR:N vector is grossly inflated relative to the assessed AV:L/AC:L/PR:N/UI:N impact of C:N/I:N/A:H.