Ios And Ipados
Monthly
An out-of-bounds read (CWE-125) in Apple's media-processing stack lets a maliciously crafted media file trigger memory corruption or unexpected app termination on iOS/iPadOS, macOS, tvOS and visionOS. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R, C:N/I:L/A:H, 7.1) shows remote, unauthenticated attackers can reach the flaw, but only if the victim processes or opens the crafted file, so a delivery-and-open step is mandatory and it is not a fully drive-by condition; confirmed impact in the available data is availability loss (crash) and low integrity (corrupt process memory) rather than code execution or data disclosure. Apple fixed the issue with improved bounds checking in iOS/iPadOS 26.7 and 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2 and visionOS 27.2; no public exploit code has been identified, EPSS is a low 0.22% (13th percentile), and there is no CISA KEV listing, which places this at a this_week remediation priority rather than an emergency.
Memory corruption in Apple's iOS, iPadOS and macOS file parsing code can lead to unexpected app termination or arbitrary code execution when a victim opens a maliciously crafted file. Affected are iOS/iPadOS releases before 26.7 and 27.2, macOS Sequoia before 15.8.2, macOS Tahoe before 26.7.2, and macOS Golden Gate before 27.2; the flaw is reachable by a remote unauthenticated attacker (AV:N/PR:N) but requires user interaction (UI:R) to open the file. No public exploit code and no confirmed active exploitation are known at time of analysis, and EPSS is low at 0.64% (50th percentile), though the potential impact of successful exploitation is total per SSVC.
Arbitrary code execution in Apple WebKit can be triggered when a user processes maliciously crafted web content on affected Apple platforms, with successful exploitation leading to memory corruption and potential full compromise of confidentiality, integrity, and availability (CVSS 8.8). The flaw affects Safari before 27.2, iOS/iPadOS before 26.7.2 and before 27.2, macOS Golden Gate before 27.2, and tvOS, visionOS, and watchOS before 27.2; it requires user interaction but no authentication. No confirmed active exploitation or public exploit code was identified at time of analysis, and EPSS is 0.57% (47th percentile).
Arbitrary code execution in Apple's WebKit rendering engine affects Safari, iOS and iPadOS, macOS Golden Gate, and visionOS users who process maliciously crafted web content. The flaw is a use-after-free (CWE-416) that Apple addressed with improved memory management, and the vendor's only complete fix is updating to the listed releases. No active exploitation is confirmed (CISA SSVC exploitation: none) and no public exploit code is confirmed; EPSS is 0.54% (45th percentile), so this is a serious but not emergency-level patching priority - patch within this week.
Kernel-level code execution is possible on Apple iOS/iPadOS and macOS because of a use-after-free in kernel memory handling, allowing an app that is already running on the device to execute arbitrary code with kernel privileges (CVSS 7.8, CWE-416). The flaw is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8 and macOS Tahoe 26.7.2, so unpatched devices across all those branches are exposed. Impact is total once triggered, but the attack path is local - the attacker must first get an app onto the device (AV:L, PR:L, UI:N) - and no public exploit has been identified at time of analysis; EPSS is 0.20% (10th percentile) and CISA SSVC records exploitation: none, automatable: no, which places this in a this-week rather than emergency remediation queue.
Authorization bypass in Apple iOS and iPadOS before 27 lets a malicious or compromised third-party app already installed on the device initiate calls or send messages despite intended network restrictions. Apple assigns CVSS 7.5, while the independent assessment treats the attack vector as local (AV:L) because the app must be present and running; there is no indication of network-only exploitation. No public exploit was identified at time of analysis, and EPSS is low at 0.14% (3rd percentile).
A sandbox escape in Apple iOS and iPadOS (versions prior to 27) and macOS (versions prior to 27) allows a malicious app already running inside the app sandbox to break out of that containment by winning a timing-sensitive race condition that Apple's added validation is designed to close. The CVSS 3.1 base score of 7.8 (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects that the attacker must have local code execution as an installed app and must reliably win a narrow, non-deterministic race, but success grants high-confidentiality, high-integrity and high-availability impact beyond the sandbox boundary (scope change). No public exploit code or confirmed active exploitation is identified at time of analysis; Apple has released fixes in iOS 27, iPadOS 27, and macOS Golden Gate 27, so this is a high-priority patch-soon issue rather than an emergency.
Arbitrary code execution in Apple Safari and WebKit-based components on iOS/iPadOS, macOS, and visionOS can occur when a user processes maliciously crafted web content, due to a type confusion flaw corrected with improved state management. Safari, iOS/iPadOS, macOS, and visionOS versions prior to 27 are affected, while Safari 27, iOS/iPadOS 27, macOS Golden Gate 27, and visionOS 27 contain the fix. The CVSS 3.1 score of 8.8 reflects a network-reachable, low-complexity, unauthenticated attack that requires user interaction (visiting hostile content); no public exploit was identified at time of analysis.
A stack-based buffer overflow in Apple's Bluetooth stack lets an attacker who controls a Bluetooth device already paired with the target run arbitrary code on the device, with high impact to confidentiality, integrity, and availability. Affected are default Bluetooth-enabled configurations of iOS/iPadOS before 26.7 and 27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, and visionOS before 27; Apple fixed the flaw through improved input validation in iOS 26.7/27, iPadOS 26.7/27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, and visionOS 27. Exploitation requires a pre-existing pairing and proximity within Bluetooth radio range (CVSS AV:A, PR:N, UI:N), which rules out untargeted internet-scale attacks; EPSS is 0.19% (8th percentile), CISA SSVC records Exploitation: none and Automatable: no, and no public exploit code has been identified at time of analysis.
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code execution when a victim opens a maliciously crafted file, scoring CVSS 8.8 (AV:N/AC:L/PR:N/UI:R, CWE-787). Apple fixed the flaw in iOS 26.7.1, iPadOS 26.7.1, macOS Sequoia 15.8.1, and macOS Tahoe 26.7.1, and states it is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records an exploitation value of 'none' with the attack assessed as non-automatable.
Apple iOS 18.7.10 and iPadOS 18.7.10 ship a fix for an input-validation flaw (CWE-20) that lets a remote attacker crash or otherwise deny service on unpatched devices, with Apple rating the impact as a full availability loss (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/A:H). Every iPhone or iPad still running a version below 18.7.10 is potentially affected. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is currently a patch-promptly issue rather than an emergency.
Kernel-level use-after-free in Apple's built-in NFS client allows memory corruption when a device connects to an attacker-operated NFS server, affecting iOS/iPadOS, macOS, tvOS, visionOS and watchOS. Exploitation requires the victim to mount or connect to a malicious NFS share (UI:R) but no credentials or privileges on the target device, making this a remote, unauthenticated-against-the-client attack that terminates in kernel memory corruption with high confidentiality, integrity and availability impact. No public exploit code and no CISA KEV listing were identified at time of analysis; EPSS is low at 0.18% (8th percentile), and CISA SSVC rates exploitation as none and automatable as no, though technical impact is total. Apple has released fixes in iOS 26.7/27, iPadOS 26.7/27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27.
Out-of-bounds write in Apple's file-parsing code affects iOS/iPadOS 27 and earlier, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27, allowing a maliciously crafted file to corrupt memory when processed. Apple addressed the flaw with improved bounds checking across all listed platforms, and CVSS 3.1 scores it 7.8 (AV:L/AC:L/PR:L/UI:N) with high confidentiality, integrity, and availability impact, even though the advisory text itself describes only unexpected app termination. No publicly available exploit code and no CISA KEV listing were identified at time of analysis, and EPSS is 0.18% (7th percentile), indicating low near-term exploitation likelihood.
Improper state management in Apple's operating systems (iOS/iPadOS, tvOS, visionOS, watchOS) allows a locally installed app to read a persistent account identifier that should have remained isolated, resulting in information disclosure. Affected platforms are all versions prior to the 27 release train on each OS. Vendor patches are available (iOS 27, iPadOS 27, tvOS 27, visionOS 27, watchOS 27), no public exploit code has been identified at time of analysis, and EPSS is very low (0.15%, 5th percentile). The supplied CVSS vector (AV:N/PR:N) does not match the description's local-app precondition, so treat the 7.5 score with caution.
An out-of-bounds write (CWE-787) in the Apple frameworks that parse 3D model files lets a maliciously crafted model corrupt memory when it is opened on an affected device, potentially giving the attacker code execution in the context of the processing application. The flaw affects iOS/iPadOS before 26.7 and 27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate 27, tvOS before 27, visionOS before 27 and watchOS before 27, and Apple has shipped fixes for all of them. Exploitation likelihood is low: EPSS is 0.17% (7th percentile), CISA SSVC records exploitation as 'none' and the vulnerability is not in KEV — no public exploit code has been identified, and the local attack vector with required user interaction makes mass exploitation unlikely.
Race condition in Apple's kernel state management lets a malicious sandboxed app escape its sandbox and execute arbitrary code with kernel privileges on iOS, iPadOS, macOS, tvOS, visionOS and watchOS. Exploitation requires a timing window to be won (CVSS AC:H) but no user interaction beyond launching the app, and success yields full control of the affected device. Apple shipped fixes in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27; no public exploit code or CISA KEV listing was present in the provided data, and no EPSS
Improper state management in Apple iOS, iPadOS, and watchOS allows an installed app to track a user across other apps and websites without the user's permission, effectively defeating the platform's cross-app tracking consent controls. The flaw affects iOS/iPadOS releases before 26.7 and before 27, plus watchOS before 27, and is remediated by the iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, and watchOS 27 updates. Exploitation requires a hostile app on the device rather than remote network access; EPSS is 0.15% (5th percentile), there is no CISA KEV listing or public exploit identified, and SSVC rates exploitation as 'none' with partial technical impact.
Improper handling of persistent identifiers in Apple's mobile and desktop operating systems allows an app installed on the device to recognize the same user across app reinstalls, defeating the identifier-reset behavior that users and administrators rely on for privacy. Apple states the issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, and visionOS 27, and the affected CPE set covers all earlier releases of iOS/iPadOS, macOS, and visionOS. No public exploit code or CISA KEV entry has been reported at time of analysis, and EPSS is only 0.16% (6th percentile), so this is a privacy-integrity hardening fix rather than an emergency remote-code-execution patch.
Apple iOS and iPadOS before version 27 leak cross-application information through the handling of user preferences, allowing a locally installed app to enumerate which other apps are present on the device. Apple addressed the privacy flaw in iOS 27 and iPadOS 27; EPSS is only 0.17% (7th percentile), there is no CISA KEV listing, and no public exploit code identified at time of analysis. The practical impact is user profiling and device fingerprinting rather than code execution or data theft.
An out-of-bounds read in Apple's kernel (CWE-125) lets an app already running on the device read past the end of a kernel buffer, potentially leaking kernel memory or crashing the system. Affected platforms span iOS/iPadOS before 26.6.1, macOS Sequoia before 15.8, macOS Tahoe before 26.6.2, and tvOS, visionOS and watchOS before 27, with a CVSS 3.1 base of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H). There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is 0.20% (10th percentile), so this is a local, app-mediated kernel hardening issue rather than a remotely exploitable emergency.
Race condition in Apple's kernel allows a local user on iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27 to cause unexpected system termination or read kernel memory. Apple fixed the flaw with additional validation, publishing advisories 149034-149038; there is no public exploit code and no confirmed active exploitation (EPSS 0.16%, SSVC exploitation: none).
An out-of-bounds memory access in the Apple kernel allows a locally installed app to crash the system or corrupt kernel memory on iOS/iPadOS, macOS, tvOS, visionOS, and watchOS releases prior to the 27-series. The flaw is reachable only by an attacker who already has code executing as an app on the device (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), for example a malicious, sideloaded, enterprise-provisioned, or trojanized application - there is no remote or unauthenticated network path, and no user interaction beyond launching the app is required. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS is 0.17% (7th percentile), and the realistic ceiling absent a follow-on kernel exploit chain is a device crash. Vendor patches are available in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.
Memory corruption during 3D model parsing on unpatched Apple platforms (iOS/iPadOS before 26.7 and 27, macOS Sequoia before 15.8 / Tahoe before 26.7 / Golden Gate 27, and tvOS, visionOS, watchOS before 27) allows an attacker who can get a victim to open or preview a maliciously crafted 3D model file to corrupt memory, potentially leading to code execution in the context of the parsing process with high confidentiality, integrity, and availability impact. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.3), so the practical barrier is user interaction - the target must parse the crafted asset locally; there is no remote unauthenticated network path, and no public exploit code has been identified at time of analysis (EPSS 0.20%, 10th percentile). Apple has shipped fixes; this is a genuine but moderate-priority issue rather than a top-tier emergency, since exploitation depends on social engineering plus a locally delivered file.
Local kernel memory corruption in Apple's 26.x operating-system family (iOS and iPadOS, macOS Tahoe, tvOS, visionOS, watchOS) allows an installed, running application to write to kernel memory or trigger unexpected system termination, with the flaw fixed in the 26.6 releases. The bug requires the victim to install and run a malicious or compromised app - it is not reachable over the network and needs no user interaction beyond launching that app (CVSS 7.8, AV:L/PR:L/UI:N) - and Apple's sandbox, notarization and App Review keep the delivery bar high, though a successful kernel-write primitive carries high confidentiality, integrity and availability impact. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and EPSS sits at 0.16% (6th percentile), indicating low near-term exploitation likelihood relative to the severity of the primitive itself.
An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate), tvOS, visionOS, and watchOS - lets a remote attacker corrupt memory in an affected process, with the confirmed outcome being an application crash and the potential outcome being arbitrary code execution. Exploitation requires no authentication and no user interaction per the CVSS vector (AV:N/PR:N/UI:N), but the independent assessment rates attack complexity as High and the confirmed technical impact as limited to denial of service, because the specific component or content-processing surface that must be reached has not been documented and reliable code execution is unproven. Apple has released fixed builds for every affected platform, and no public exploit code or active exploitation has been identified at time of analysis; EPSS is a modest 0.99% (61st percentile), which is consistent with a patched, non-weaponized memory-safety defect rather than a top-tier emergency.
Sandbox escape in Apple iOS, iPadOS, and macOS allows a locally installed low-privileged malicious app to break out of its sandbox and gain elevated access to system resources, affecting iOS/iPadOS and macOS versions prior to 27 (macOS Golden Gate 27). Apple corrected the underlying permissions weakness (CWE-269, improper privilege management) by adding restrictions in the version 27 releases, so devices updated to iOS 27, iPadOS 27, or macOS Golden Gate 27 are remediated. The flaw is local-only with no remote or network trigger and requires the attacker to first get a malicious app onto the device; EPSS is 0.19% (8th percentile) and no public exploit identified at time of analysis, so risk is concentrated on devices that permit sideloaded, enterprise-provisioned, or otherwise untrusted applications.
Memory corruption in Apple's image-handling code across iOS 27, iPadOS 27, macOS Golden Gate 27 and visionOS 27 allows an attacker to achieve arbitrary code execution when a user processes a maliciously crafted image. Apple removed the vulnerable code entirely in the 27-generation releases, which are the only versions containing the fix; all earlier supported builds remain affected. The flaw is rated 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H), meaning exploitation needs local positioning plus some user interaction, and there is no public exploit code or CISA KEV entry identified at time of analysis.
Sign In With Apple state-management flaw in iOS, iPadOS, macOS, and visionOS lets a locally installed app hijack the authentication flow and obtain access to the victim's Apple Account. An attacker needs a malicious or compromised app already present on the device (AV:L) and the user must actively complete a Sign In With Apple prompt (UI:R), but no privileges or credentials are required by the app itself (PR:N), yielding high confidentiality and integrity impact on the linked Apple Account. Apple has shipped fixes in iOS/iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, and visionOS 27; EPSS is low at 0.24% (15th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis.
Device fingerprinting on Apple iOS and iPadOS before 26.7 (and before 27) lets a locally installed app defeat an authorization/state-management check and read a device-stable identifier it should not be able to obtain, weakening user privacy and enabling cross-app tracking or device re-identification. Exploitation requires an attacker to first get a malicious or privacy-invasive app onto the device (App Store distribution or sideloading), and the assessed impact is confidentiality-only - reading an identifier, with no code execution, data modification, or availability loss - so the vendor's CVSS 7.5 (AV:N/PR:N/I:H) overstates the practical risk relative to the assessed local, low-impact vector; this is a low real-world risk, confirmed patched by iOS/iPadOS 26.7 or 27, with no public exploit identified at time of analysis and a low EPSS score of 0.15% (5th percentile).
Kernel memory corruption in Apple's iOS, iPadOS, and macOS allows a local attacker who can already execute code on the device to cause unexpected system termination or corrupt kernel memory, as described by the vendor's improved memory handling fix. Affected builds are iOS and iPadOS before 26.7 (and before 27), plus macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27; all are remediated by the corresponding vendor updates. Exploitation requires a prior on-device foothold (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), so this realistically functions as a privilege-escalation or sandbox-escape stage rather than an initial-access vector - no public exploit has been identified at time of analysis, the issue is not confirmed actively exploited (no CISA KEV listing), and EPSS is low at 0.16% (6th percentile). It is a genuine but not top-tier priority: the impact is high if chained, but the barrier of local code execution limits reach.
An out-of-bounds read in Apple's operating system kernel lets a local user or a malicious/compromised app running on an affected device disclose kernel memory or crash the system, carrying a vendor CVSS 3.1 base score of 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H). The flaw affects iOS and iPadOS before 26.7/27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, and tvOS, visionOS and watchOS before 27; exploitation requires local code execution (AV:L, PR:L), there is no remote or network-triggerable path and no user-interaction requirement. Vendor-released patches addressing the issue are available in iOS 26.7/27, iPadOS 26.7/27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27; no public exploit code has been identified at time of analysis and EPSS is low at 0.20% (10th percentile), so this reads as a boundary/isolation bypass rather than an initial-access vector.
Local kernel memory corruption in Apple iOS and iPadOS (with parallel fixes in macOS, tvOS, visionOS and watchOS) lets an app already running on the device win a kernel race condition and either force an unexpected system termination or corrupt kernel memory, which can be leveraged toward full kernel read/write. Affected builds are iOS/iPadOS before 26.7 and before 27, macOS before 15.8, 26.7 (Tahoe) and 27 (Golden Gate), plus tvOS, visionOS and watchOS before 27; Apple has shipped fixes in every one of those branches. No public exploit code has been identified at time of analysis and EPSS is low at 0.18% (8th percentile), and because exploitation needs the attacker to already execute code as an app plus a timing-dependent race win, the vendor's own AV:L/PR:L vector (7.8 High) makes opportunistic mass exploitation impractical.
An out-of-bounds write in Apple's 3D model handling code causes memory corruption on unpatched iPhones, iPads, Macs, Apple TVs, Apple Vision Pro and Apple Watches when a maliciously crafted 3D model file is processed by the device. The flaw carries a CVSS 3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and was addressed by Apple with improved bounds checking in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7 and macOS Golden Gate 27, plus tvOS 27, visionOS 27 and watchOS 27; no public exploit code has been identified at time of analysis, and EPSS places the likelihood of exploitation in the near term at only 0.17% (7th percentile). Exploitation is not remote-service based: the attacker must first deliver the crafted model to the victim's device and have it parsed, so it is best treated as a genuine but not urgent patching priority rather than an imminent threat.
An out-of-bounds write in Apple's asset-catalog handling lets a maliciously crafted asset catalog trigger memory corruption that terminates the affected process on unpatched Apple operating systems - iOS and iPadOS before 27, macOS before 15.8, 26.7, and 27, and tvOS, visionOS, and watchOS before 27. Exploitation is local rather than network-based (CVSS:3.1/AV:L/AC:L/PR:N/UI:R) and requires the victim to load or open the crafted asset via a downloaded app, bundle, or file, so the realistic outcome is client-side denial of service rather than remote code execution, despite the vendor's 7.8 base score; no public exploit code was identified at time of analysis and EPSS is only 0.20% (10th percentile), indicating low observed exploitation likelihood. Apple has released fixed versions across all affected platforms.
Opening a maliciously crafted file on an unpatched Apple device can crash the component that parses it, because a buffer overflow in Apple's size-validation logic was only corrected in the latest OS releases. Affected platforms are iOS/iPadOS before 26.7 (and before 27), macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, tvOS before 27, and visionOS before 27; exploitation is local and requires the victim to actively open the attacker-supplied file, with no remote or network trigger available. The demonstrated outcome per Apple's advisory is unexpected process termination (denial of service) rather than code execution or data disclosure, and no public exploit code or confirmed active exploitation was identified at time of analysis, with EPSS at 0.22% (13th percentile).
Path traversal in Apple iOS and iPadOS lets an attacker who physically holds a trust-paired iPhone or iPad read and write files outside the intended directory, a high-confidentiality and high-integrity impact on the device's file store. Everything running earlier than iOS/iPadOS 26.7 or iOS/iPadOS 27 is affected, and the vendor-released fixes are iOS 26.7, iPadOS 26.7, iOS 27 and iPadOS 27 (Apple advisories 149034 and 149041). Exploitation hinges on prior physical possession and an already-accepted 'Trust This Computer' relationship, so the published 7.5 score (CVSS:3.1/AV:N/PR:N) is inflated relative to the required prerequisites - the same vector's PR:N confirms no additional authentication is needed once the pairing exists - and exploitation risk is further limited by a low EPSS of 0.15 percent (5th percentile) with no public exploit identified at time of analysis.
A locally installed app on Apple iOS/iPadOS (before 27), macOS (before Golden Gate 27, Tahoe 26.7, or Sequoia 15.8), tvOS 27, visionOS 27, and watchOS 27 can bypass insufficient path validation to modify files in protected system locations, corrupting system integrity. Exploitation requires the attacker to get a malicious or trojanized app running on the target device - there is no remote network path despite the vendor's published 9.8 network vector, and our independent assessment rates the issue CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N, with no authentication requirement and no user interaction beyond running the app. Vendor patches are available for all affected platforms, exploitation probability is low (EPSS 0.19%, 9th percentile), and no public exploit code has been identified at time of analysis.
A use-after-free flaw in Apple's kernel affects iOS and iPadOS before 26.7, macOS Sequoia before 15.8, and macOS Golden Gate before 27, allowing a locally running app to corrupt kernel memory or cause unexpected system termination. The issue is a local, low-privilege memory-safety defect (CWE-416) rated CVSS 7.8, and Apple has shipped fixes in iOS 26.7, iPadOS 26.7, macOS Golden Gate 27 and macOS Sequoia 15.8. There is no indication of active exploitation (no CISA KEV listing) and no public exploit code identified, with EPSS at 0.19% (9th percentile) suggesting low near-term exploitation likelihood at scale.
Kernel memory corruption in Apple's operating systems lets an app already running on a device trigger a double free (CWE-415) that can corrupt kernel memory or crash the system unexpectedly. Affected are iOS and iPadOS before 26.7 and before 27, macOS before Sequoia 15.8, before Tahoe 26.7, and before Golden Gate 27, plus tvOS, visionOS, and watchOS before 27; the issue is fixed in those newer releases. Apple's own CVSS of 9.8 (AV:N/PR:N/UI:N) is not supported by the description, which frames the vector as a locally installed and executed app rather than a remote or unauthenticated service, and our independent assessment scores it as a local (AV:L) double-free with high availability and integrity impact but no confidentiality impact. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and EPSS is only 0.21% (11th percentile), indicating low near-term exploitation likelihood.
Kernel memory corruption in Apple's operating systems (iOS/iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS, visionOS and watchOS 27 and earlier) lets an application already running on the device crash the system or corrupt kernel memory, per Apple's advisory the root cause was addressed through improved memory handling. The independent assessment rates this as a local, app-gated issue (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) rather than the vendor's network-reachable AV:N/PR:N vector of 7.5, meaning exploitation requires an attacker to first get code executing as an app on the target device; no elevated privileges or user interaction beyond launching the app are needed once that foothold exists. There is no public exploit identified at time of analysis, EPSS is low at 0.18% (7th percentile), and no CISA KEV listing applies; the practical outcome in most cases is a device crash or denial of service, with kernel memory corruption that would require additional work to turn into privilege escalation. Vendor-released patches are available across all affected platform lines.
On unpatched Apple platforms, opening a maliciously crafted video file can cause the affected app to terminate unexpectedly or leave process memory corrupted, because the underlying media parsing code fails to handle memory correctly. Affected are iOS/iPadOS before 26.6 or 26.7, macOS Sequoia before 15.8, macOS Tahoe before 26.6 or 26.7, tvOS before 26.6, and watchOS before 26.6; the vector is local (AV:L) with user interaction required (UI:R) and no authentication (PR:N), meaning an attacker must deliver the file and convince the user to open or preview it. There is no public exploit identified at time of analysis and EPSS is low (0.18%, 7th percentile), but the flaw is serious: the description substantiates only app crashes and in-process memory corruption, with no confirmed confidentiality disclosure or code-execution primitive, which is narrower than the vendor's 7.8 high-severity rating implies. Vendor patches are available.
Information disclosure in Apple iOS, iPadOS, macOS, visionOS, and watchOS before version 27 allows a malicious or privacy-abusing app already installed on the device to fingerprint the user by accessing identifiers that should be restricted by the sandbox. The vendor's CVSS 9.1 is drastically inflated and inconsistent with the description; our assessment is AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, with impact limited to privacy tracking rather than data theft, code execution, or system compromise. Apple fixed the issue in iOS 27, iPadOS 27, macOS Golden Gate 27, visionOS 27, and watchOS 27 by adding sandbox restrictions; no public exploit identified at time of analysis and EPSS is low at 0.16% (6th percentile).
Memory corruption during file parsing on Apple iOS/iPadOS (before version 27) and macOS (before Golden Gate 27) can cause the handling application to terminate unexpectedly when a user opens a maliciously crafted file; the flaw was addressed by strengthening input validation. Because the attack vector is local (the file must be delivered to and opened on the device) and user interaction is required, exploitation is not remote or unattended, and no special privileges are needed (PR:N, unauthenticated). The vendor rates this 7.8 High, but the independently assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) reflects availability-only impact, and combined with a very low EPSS of 0.19% (8th percentile) and no public exploit identified at time of analysis, real-world risk is LOW-to-MODERATE rather than critical.
An out-of-bounds write in Apple's media-handling code can corrupt memory and terminate the affected app when a user opens or previews a maliciously crafted video file on an unpatched Apple OS. The flaw affects iOS/iPadOS before 26.7 and before 27, macOS before Sequoia 15.8, before Tahoe 26.7, and before Golden Gate 27, plus tvOS before 27 and visionOS before 27, and Apple resolved it with improved bounds checking in those releases. Exploitation requires local delivery of the crafted file plus user interaction (CVSS AV:L/UI:R/PR:N), no public exploit code has been identified at time of analysis, and EPSS is low at 0.18% (7th percentile), so the practical risk is bounded by the demonstrated outcome of app termination rather than confirmed remote or zero-click compromise.
An out-of-bounds write in Apple's WebKit engine — reachable by processing maliciously crafted web content — can corrupt memory and potentially lead to arbitrary code execution on affected Apple platforms. The flaw stems from an integer-overflow class defect (CWE-190) where a size calculation overflows and the subsequent bounds check fails, allowing an OOB write. It is fixed in Safari 26.6.1, iOS/iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27 and watchOS 27; exploitation requires the victim to load attacker-controlled web content (UI:R), and no public exploit or active exploitation has been identified at time of analysis, with EPSS at just 0.17% (6th percentile).
Improper certificate validation in Apple's cross-platform certificate handling lets an attacker who controls a compromised intermediate certificate authority issue certificates with arbitrary extended key usages that unpatched devices will accept as valid, enabling spoofing or trust-bypass against TLS and other PKI-dependent services. Affected are iOS/iPadOS before 26.7 and before 27, macOS before 15.8, before 26.7 and before 27, plus tvOS before 27, watchOS before 27 and visionOS before 27; the vendor scores this CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) with unauthenticated remote attack, while our independent assessment keeps the same vector but raises attack complexity to High because the attack is only reachable after a trusted intermediate CA has already been compromised. No public exploit code has been identified at time of analysis (EPSS 0.14%, 4th percentile), and vendor patches are available offering the exact fixed versions listed below.
Missing entitlement checks in Apple's iOS and iPadOS, tvOS, watchOS, and visionOS (all versions before the 27 release train) allow a locally installed app to read device attributes it is not authorized to access and combine them into a persistent fingerprint of the user. Only devices running an affected platform with an attacker-supplied app already installed are exposed; the independent assessment re-scores the issue as local-access with confidentiality-only impact (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), which is materially lower than the supplied CVSS 3.1 vector (AV:N, 7.5) that treats the flaw as remotely reachable. There is no indication of active exploitation, KEV status is not set, and no public exploit code has been identified at time of analysis; EPSS is 0.19% (9th percentile), consistent with a low near-term exploit probability. Apple has released fixes in iOS 27, iPadOS 27, tvOS 27, visionOS 27, and watchOS 27.
Memory corruption in Apple Safari and the shared WebKit engine used across iOS, iPadOS, macOS Tahoe, tvOS, visionOS and watchOS can be triggered when a victim views maliciously crafted web content, rooted in an integer overflow (CWE-190) that was corrected through improved input validation. The CVSS 3.1 vector (8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates an unauthenticated network-delivered attack that requires user interaction but yields high confidentiality, integrity and availability impact, consistent with out-of-bounds memory effects rather than a confirmed code-execution chain. No public exploit code has been identified at time of analysis and CISA KEV does not list this CVE, while the EPSS score of 0.17% (6th percentile) signals a real but low-priority, non-urgent risk that is best addressed through routine patching. Patches are available from the vendor in Safari 26.6.1, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27 and watchOS 27.
Improper handling of unexpected runtime conditions in Apple's operating systems lets a locally installed malicious app trigger an uncaught exception that terminates the system - a denial-of-service/crash impact with no confidentiality or code-execution effect. Affected platforms are iOS and iPadOS before 26.7 and before 27, macOS Tahoe before 26.7 and macOS Golden Gate before 27, plus tvOS 27, visionOS 27 and watchOS 27; the attacker must first get an app onto the device and execute it, and the payoff is only a transient system termination. There is no public exploit code and no confirmed active exploitation, EPSS is 0.18% (7th percentile), and Apple has shipped fixed versions, so this should be treated as a genuine but low-priority issue requiring routine patch cadence rather than emergency response.
User fingerprinting on Apple iOS and iPadOS devices running versions earlier than 26.6 allows an installed application to identify and track the device owner through sensitive data that Apple has now relocated as part of version 26.6. Per the authoritative assessment, this is an on-device, local-execution privacy flaw (CWE-359) with no additional privileges or user interaction required beyond the app running, and its impact is limited to tracking/fingerprinting rather than data theft, code execution, or system compromise; the supplied AV:N/high-confidentiality vector is not borne out by analysis. Exploitation requires getting a malicious or privacy-abusing app onto the device via the App Store, sideloading, MDM/enterprise provisioning, or TestFlight, and devices already updated to iOS/iPadOS 26.6 are not affected. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.14% (4th percentile).
A local privilege-escalation flaw in Apple's operating system family lets a malicious app already running on the device obtain root privileges by exploiting a missing authorization check. Apple addressed the issue with 'additional restrictions' in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, and visionOS 27, and the CVSS 3.1 score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not confirmed: the issue is not in CISA KEV, no public exploit code is identified, and CISA's SSVC assessment lists exploitation as 'none' and automatable as 'no', though technical impact is rated 'total' once root is achieved.
Memory corruption in Apple's 3D model parsing pipeline allows a local attacker with low privileges to trigger a classic buffer overflow (CWE-120) on iOS/iPadOS, macOS, tvOS, visionOS and watchOS when a victim opens a maliciously crafted 3D model file. Apple addressed the flaw with improved memory handling in iOS 26.7/27, iPadOS 26.7/27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27 and watchOS 27. Exploitation requires local access and user interaction, no public exploit code has been identified at time of analysis, and the EPSS score is very low at 0.17% (7th percentile), so this is a credible patching priority for Apple fleets rather than a mass-exploitation emergency.
Content Security Policy enforcement failure in Safari's AudioWorklet contexts allows remote attackers to bypass CSP restrictions when a user processes maliciously crafted web content. Affected platforms include Safari before 26.5, iOS and iPadOS before 18.7.9/26.5, and macOS Tahoe before 26.5. Apple has released patches across all affected platforms; no public exploit or CISA KEV listing is identified at time of analysis.
Memory corruption in Apple's web content rendering engine affects iOS, iPadOS, and macOS Tahoe, enabling high-impact device compromise when a user processes maliciously crafted web content. All iOS and iPadOS versions prior to 18.7.10 and 26.6.1, and macOS Tahoe versions prior to 26.6.2, are confirmed affected per Apple security advisories and EUVD-2026-60510. Apple has released patched builds across all affected branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Integer overflow in Apple's image processing subsystem across iOS, iPadOS, and macOS Tahoe allows arbitrary code execution when a user processes a maliciously crafted image. Affected platforms include iOS and iPadOS prior to 26.6.1 and macOS Tahoe prior to 26.6.2, with Apple releasing out-of-band point releases indicating urgency. No public exploit has been identified at time of analysis, but the CVSS 8.8 score and SSVC total technical impact rating place this among high-priority patching targets given Apple's massive consumer and enterprise device footprint.
Remote denial-of-service in Apple iOS, iPadOS, and macOS Tahoe exploits a use-after-free memory corruption flaw, allowing an unauthenticated remote attacker to trigger unexpected system termination without user interaction. Affected platforms include iOS and iPadOS prior to 26.6.1 and macOS Tahoe prior to 26.6.2, as confirmed by Apple security advisories. No public exploit code or active exploitation has been identified at time of analysis, but the network-accessible, zero-interaction attack surface presents a meaningful availability risk for all unpatched Apple devices.
Kernel memory corruption via race condition in Apple OS allows a malicious app to write arbitrary kernel memory or cause unexpected system termination. The issue affects iOS, iPadOS, macOS, and watchOS versions prior to the June 2026 security fixes, and has been patched by Apple. No public exploit or active exploitation is known, and EPSS indicates a low probability of widespread exploitation at this time.
A code signing enforcement bypass in Apple operating systems allows a maliciously crafted app to execute with high confidentiality and integrity impact. No active exploitation is reported, and the EPSS score of 0.17% indicates a low probability of weaponization. Apple has released patches in version 26.6 for all affected platforms.
A sandbox escape vulnerability in Apple operating systems allows a malicious app to break out of its containment and gain full access to the device. Affected versions include iOS and iPadOS prior to 26.6, multiple macOS versions (Sonoma before 14.8.8, Sequoia before 15.7.8, Tahoe before 26.6), and tvOS before 26.6. No public exploit or active exploitation has been identified, and EPSS indicates a low probability of real-world attacks.
Memory corruption in Apple's audio processing framework affects iOS, iPadOS, macOS (Sonoma, Sequoia, Tahoe), tvOS, visionOS, and watchOS, where parsing a maliciously crafted audio file can corrupt process memory and potentially lead to arbitrary code execution. The flaw requires a victim to open or process the malicious file (local vector, user interaction) but no prior privileges. Apple has shipped fixes across all platforms; no public exploit identified at time of analysis and EPSS is low (0.16%).
Use-after-free vulnerability in Safari’s web content processing allows remote attackers to execute arbitrary code on affected Apple devices when a user visits a malicious website. Affected versions include Safari prior to 26.6, iOS and iPadOS prior to 26.6, macOS Tahoe prior to 26.6, visionOS prior to 26.6, and watchOS prior to 26.6. No public exploit or active exploitation has been identified, and EPSS indicates a low probability of exploitation (0.13%).
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Sequoia before 15.7.8, macOS Sonoma before 14.8.8, macOS Tahoe/tvOS/visionOS/watchOS before 26.6 - where a use-after-free (CWE-416) lets a locally installed app crash the system. There is no public exploit identified at time of analysis and the NVD CVSS 9.8 (C:H/I:H/A:H) conflicts with Apple's own description, which states only 'unexpected system termination' (availability impact), suggesting the true impact is a DoS crash rather than full compromise. EPSS is low (0.17%, 6th percentile) and the issue is not in CISA KEV.
Arbitrary code execution via buffer overflow in Apple iOS, iPadOS, and macOS. Processing a maliciously crafted file can
Memory corruption in Apple's cross-platform image-processing stack allows a maliciously crafted image to corrupt process memory across iOS/iPadOS, macOS, tvOS, visionOS, and watchOS. Apple self-reported and patched the flaw (fixed in iOS/iPadOS 26.6, macOS Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.6, and the 26.6 releases of tvOS/visionOS/watchOS). No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and CISA SSVC records exploitation status as none, though the technical impact is rated total.
Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected system termination. Affected versions include iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. While the NVD assigns CVSS 9.8, the actual impact is limited to availability; no active exploitation or public exploit code is identified, and EPSS indicates very low exploitation probability (0.17%).
Memory corruption in Apple Safari 26.x allows remote code execution via processing maliciously crafted web content. This buffer overflow (CWE-119) affects all Apple platforms—iOS, iPadOS, macOS, visionOS, and watchOS—requiring user interaction to visit a malicious webpage. While the CVSS score is critical (8.8), EPSS (0.13%) indicates low current exploitation probability and no KEV listing or public exploit exists.
A race condition in Apple operating systems (iOS, iPadOS, macOS, tvOS, watchOS) fixed in version 26.6 allows a local malicious app to cause unexpected system termination, resulting in a denial-of-service condition. No evidence of active exploitation or public exploit code exists, and EPSS indicates very low exploitation probability (0.16%). The NVD-assigned CVSS 9.8 appears inconsistent with the actual impact, which is limited to availability.
Unexpected system termination in iOS and iPadOS prior to 26.6, as well as in certain versions of macOS, tvOS, and visionOS, resulting from a use-after-free memory corruption. Apple's description indicates a local denial-of-service where a malicious app can crash the system, while the NVD-assigned CVSS 9.8 erroneously implies unauthenticated remote code execution. A patch is available, no active exploitation has been reported, and EPSS suggests a very low probability of wide exploitation.
Missing authorization in Apple's Contacts framework across iOS/iPadOS, macOS Tahoe, visionOS, and watchOS (all versions before 26.6) allows an installed app to add contact entries without triggering the user's authorization prompt. Apple fixed the flaw with improved validation in the 26.6 releases. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.16% (6th percentile), consistent with a low-severity local privacy-scope bypass despite the input's inflated 9.8 score.
User fingerprinting in Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS allows a malicious app to collect device or user identifiers due to a permissions issue. All versions prior to the 26.6 updates are affected. No public exploit code or active exploitation has been identified, and EPSS indicates a low 0.15% probability of exploitation.
Kernel memory corruption in Apple XNU kernel allows a remote attacker to potentially execute arbitrary code or crash the system when a victim connects to a malicious NFS server. Affected are all Apple operating systems—iOS, iPadOS, macOS, tvOS, and watchOS—before version 26.6. No active exploitation or public exploit code has been observed, and EPSS indicates a low probability of widespread attacks.
Processing a maliciously crafted file on unpatched Apple operating systems (iOS, iPadOS, macOS, tvOS, watchOS, visionOS) may allow arbitrary code execution due to an integer overflow in file handling. The vulnerability affects all versions prior to the latest OS updates and requires user interaction (opening a file) to trigger. No active exploitation or public exploit code has been identified, and patches are available in the vendor-released updates.
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be triggered by a remote attacker via an out-of-bounds write. The issue, patched in the latest OS updates, carries a CVSS base score of 9.8 but is not known to be actively exploited. EPSS estimates a low 0.25% probability of exploitation, and no public exploit code has been identified.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, and visionOS 26.6 allows unauthenticated network attackers to corrupt heap memory via an out-of-bounds write. This can lead to arbitrary code execution or unexpected application termination, compromising the affected device
Physical-proximity memory corruption in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, watchOS, visionOS) allows a nearby attacker to corrupt process memory, potentially leading to arbitrary code execution or denial of service. No active exploitation is known, and vendor-released patches are available. EPSS score is low (0.16%), and the CVSS vector supplied (AV:N) conflicts with the required physical proximity.
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause application termination or arbitrary code execution. Affected products include iOS and iPadOS prior to version 26.6, macOS before Sequoia 15.7.8 and Tahoe 26.6, tvOS before 26.6, and visionOS before 26.6; no active exploitation or public proof-of-concept has been reported.
Use-after-free memory corruption in Apple's core operating-system platforms - iOS/iPadOS, macOS Tahoe, tvOS, and watchOS before version 26.6 - allows a locally installed and executed application to crash or unexpectedly terminate the system. Exploitation requires the victim to run attacker-supplied code as an app on an unpatched device; there is no remote attack surface, and the demonstrable impact is availability only (system termination/reboot), with no data disclosure, modification, or code execution established - meaning the publicly circulated CVSS 9.8 network vector materially overstates the real reachability and impact of this bug. No public exploit identified at time of analysis, EPSS is low at 0.16% (6th percentile), CISA SSVC records Exploitation: none with total technical impact if reached, and Apple has shipped fixes in 26.6 across all four platforms.
Processing a maliciously crafted video file may lead to memory corruption enabling possible arbitrary code execution on multiple Apple operating systems. Affected platforms include iOS, iPadOS, macOS, tvOS, watchOS, and visionOS; fixes are available in the latest updates (iOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6). User interaction is required to open the malicious video, and no public exploit or active exploitation is known at this time.
Arbitrary code execution in Apple iOS, iPadOS, and macOS arises when the OS image-processing pipeline handles a maliciously crafted image, triggering an integer overflow (CWE-190) that can be leveraged to run attacker-controlled code. The flaw affects iOS/iPadOS before 26.6 and multiple macOS trains (Sonoma before 14.8.8, Sequoia before 15.7.8, Tahoe before 26.6) and requires the victim to open or process the malicious image (UI:R). No public exploit has been identified at time of analysis, EPSS is low (0.18%, 7th percentile), and it is not listed in CISA KEV.
Use-after-free memory corruption in Apple's iOS 26.6-era platform family lets an already-installed app crash the operating system kernel or a system service, producing an unexpected system termination (denial of service). Affected software spans iOS/iPadOS before 26.6, macOS Sequoia before 15.7.8, macOS Sonoma before 14.8.8, macOS Tahoe before 26.6, and tvOS, visionOS and watchOS before 26.6; exploitation requires the attacker's app to run locally on the device, since the flaw is only reachable from within an executing process. The headline input score of CVSS 9.8 (AV:N) overstates the issue - Apple's own advisory describes impact limited to a crashing app, EPSS is a low 0.17% (6th percentile), CISA SSVC records no exploitation and no public exploit code exists, and no KEV listing or POC is associated with CVE-2026-43822.
We are tasked with producing a JSON analysis for CVE-2026-64747. We must use all provided data, including EPSS, SSVC, patch availability, CPE, and tags. The vulnerability is a buffer overflow in Apple products, with an app potentially executing arbitrary code with kernel privileges. CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). CWE-120. Patch available from vendor. EPSS 0.19% (low). SSVC: Exploitation none, Automatable no, Technical impact total. KEV status? Not in input, so not KEV. POC? Not mentioned. Tags include RCE, Apple, Buffer Overflow, etc. Affected products: iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. CPEs confirm. References are Apple support pages. We must produce fields: - product_name: 1-3 words, specific product. Since it spans many OSes, the "primary one"? The CVE description mentions iOS and iPadOS, macOS, tvOS, visionOS, watchOS. The common underlying component is likely the kernel or something. But the product is Apple's operating systems. Could say "Apple OS Family" or "Apple Kernel". The description says "An app may be able to execute arbitrary code with kernel privileges." So the vulnerability is in the kernel, accessible via an app. So product could be "Apple Kernel" or "Apple Operating Systems". But the instruction says "The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel'." So maybe "Apple Kernel". However, it's not explicitly named. The CPEs list specific products: ios_and_ipados, macos, tvos, visionos, watchos. So I'll use "Apple OS Family" but that is 3 words. "Apple Kernel" is 2 words. I'll go with "Apple Kernel" as the vulnerable component. The description isn't clear if it's the kernel itself or a system library, but "kernel privileges" suggests kernel execution. So "Apple Kernel" is appropriate. - summary: 2-3 sentences, original synthesis, avoid starting with "A vulnerability". Start with impact verb a
A use-after-free vulnerability in Apple operating systems allows a malicious app to cause unexpected system termination or write to kernel memory. The issue affects iOS
Denial of service in Apple iOS, macOS, and related operating systems due to a use-after-free flaw could allow a malicious app to crash the device. Apple's advisory only confirms unexpected system termination, but an independent CVSS score of 9.8 suggests potential for full system compromise; however, the CVSS vector appears inconsistent with the vendor description. The vulnerability is patched in versions 26.6 for all affected OSes, and no active exploitation or public exploit code is known.
Remote attackers can cause unexpected application termination and potentially read sensitive memory on affected Apple devices. This out-of-bounds read vulnerability, tracked as CVE-2026-64768, affects iOS, iPadOS, macOS, tvOS, and visionOS due to insufficient input validation. No active exploitation or public proof-of-concept code has been identified.
Information disclosure in Apple Safari and OS-integrated WebKit allows websites to detect if a user has visited specific URLs. Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS prior to version 26.6 are affected. No public exploit code or active attacks have been reported, and the probability of exploitation is very low (EPSS 0.17%).
Denial-of-service vulnerability in Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS due to an out-of-bounds write in a shared component. A malicious app executed locally can cause a system crash; the CVSS vector also suggests potential high confidentiality impact (memory disclosure), though the advisory only mentions denial-of-service. Fixed in updates; no active exploitation or public exploit code reported, and EPSS probability is very low (0.17%).
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an out-of-bounds write bug. An unauthenticated attacker can trigger heap corruption by sending a malicious payload over the network, leading to unexpected application termination or potential arbitrary code execution with no user interaction required. Apple has released platform patches fixing this critical vulnerability, and while no active exploitation or public exploit is known, the EPSS score indicates low near-term exploitation
Arbitrary code execution via malicious file processing affects multiple Apple operating systems due to an out-of-bounds write. Fixed in iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No active exploitation or public exploit is known, and EPSS predicts a very low probability of real-world attacks.
Denial of service in Apple operating systems (iOS/iPadOS 26.6, macOS Sonoma 14.8.8, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS/visionOS/watchOS 26.6) allows a locally installed app to trigger an integer overflow that causes unexpected system termination. The flaw was reported and patched by Apple, and CISA's SSVC framework rates exploitation as 'none' with EPSS at just 0.17% (6th percentile), indicating no public exploit identified at time of analysis. Note a significant signal conflict: the NVD CVSS vector of 9.8 (AV:N, full C/I/A impact) is inconsistent with the description, which describes only an app-triggered crash.
A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An attacker can use this information disclosure vulnerability to track the user’s identity across different contexts, violating privacy. The issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6, and no active exploitation or public exploit code has been observed.
An out-of-bounds read (CWE-125) in Apple's media-processing stack lets a maliciously crafted media file trigger memory corruption or unexpected app termination on iOS/iPadOS, macOS, tvOS and visionOS. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R, C:N/I:L/A:H, 7.1) shows remote, unauthenticated attackers can reach the flaw, but only if the victim processes or opens the crafted file, so a delivery-and-open step is mandatory and it is not a fully drive-by condition; confirmed impact in the available data is availability loss (crash) and low integrity (corrupt process memory) rather than code execution or data disclosure. Apple fixed the issue with improved bounds checking in iOS/iPadOS 26.7 and 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2 and visionOS 27.2; no public exploit code has been identified, EPSS is a low 0.22% (13th percentile), and there is no CISA KEV listing, which places this at a this_week remediation priority rather than an emergency.
Memory corruption in Apple's iOS, iPadOS and macOS file parsing code can lead to unexpected app termination or arbitrary code execution when a victim opens a maliciously crafted file. Affected are iOS/iPadOS releases before 26.7 and 27.2, macOS Sequoia before 15.8.2, macOS Tahoe before 26.7.2, and macOS Golden Gate before 27.2; the flaw is reachable by a remote unauthenticated attacker (AV:N/PR:N) but requires user interaction (UI:R) to open the file. No public exploit code and no confirmed active exploitation are known at time of analysis, and EPSS is low at 0.64% (50th percentile), though the potential impact of successful exploitation is total per SSVC.
Arbitrary code execution in Apple WebKit can be triggered when a user processes maliciously crafted web content on affected Apple platforms, with successful exploitation leading to memory corruption and potential full compromise of confidentiality, integrity, and availability (CVSS 8.8). The flaw affects Safari before 27.2, iOS/iPadOS before 26.7.2 and before 27.2, macOS Golden Gate before 27.2, and tvOS, visionOS, and watchOS before 27.2; it requires user interaction but no authentication. No confirmed active exploitation or public exploit code was identified at time of analysis, and EPSS is 0.57% (47th percentile).
Arbitrary code execution in Apple's WebKit rendering engine affects Safari, iOS and iPadOS, macOS Golden Gate, and visionOS users who process maliciously crafted web content. The flaw is a use-after-free (CWE-416) that Apple addressed with improved memory management, and the vendor's only complete fix is updating to the listed releases. No active exploitation is confirmed (CISA SSVC exploitation: none) and no public exploit code is confirmed; EPSS is 0.54% (45th percentile), so this is a serious but not emergency-level patching priority - patch within this week.
Kernel-level code execution is possible on Apple iOS/iPadOS and macOS because of a use-after-free in kernel memory handling, allowing an app that is already running on the device to execute arbitrary code with kernel privileges (CVSS 7.8, CWE-416). The flaw is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8 and macOS Tahoe 26.7.2, so unpatched devices across all those branches are exposed. Impact is total once triggered, but the attack path is local - the attacker must first get an app onto the device (AV:L, PR:L, UI:N) - and no public exploit has been identified at time of analysis; EPSS is 0.20% (10th percentile) and CISA SSVC records exploitation: none, automatable: no, which places this in a this-week rather than emergency remediation queue.
Authorization bypass in Apple iOS and iPadOS before 27 lets a malicious or compromised third-party app already installed on the device initiate calls or send messages despite intended network restrictions. Apple assigns CVSS 7.5, while the independent assessment treats the attack vector as local (AV:L) because the app must be present and running; there is no indication of network-only exploitation. No public exploit was identified at time of analysis, and EPSS is low at 0.14% (3rd percentile).
A sandbox escape in Apple iOS and iPadOS (versions prior to 27) and macOS (versions prior to 27) allows a malicious app already running inside the app sandbox to break out of that containment by winning a timing-sensitive race condition that Apple's added validation is designed to close. The CVSS 3.1 base score of 7.8 (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects that the attacker must have local code execution as an installed app and must reliably win a narrow, non-deterministic race, but success grants high-confidentiality, high-integrity and high-availability impact beyond the sandbox boundary (scope change). No public exploit code or confirmed active exploitation is identified at time of analysis; Apple has released fixes in iOS 27, iPadOS 27, and macOS Golden Gate 27, so this is a high-priority patch-soon issue rather than an emergency.
Arbitrary code execution in Apple Safari and WebKit-based components on iOS/iPadOS, macOS, and visionOS can occur when a user processes maliciously crafted web content, due to a type confusion flaw corrected with improved state management. Safari, iOS/iPadOS, macOS, and visionOS versions prior to 27 are affected, while Safari 27, iOS/iPadOS 27, macOS Golden Gate 27, and visionOS 27 contain the fix. The CVSS 3.1 score of 8.8 reflects a network-reachable, low-complexity, unauthenticated attack that requires user interaction (visiting hostile content); no public exploit was identified at time of analysis.
A stack-based buffer overflow in Apple's Bluetooth stack lets an attacker who controls a Bluetooth device already paired with the target run arbitrary code on the device, with high impact to confidentiality, integrity, and availability. Affected are default Bluetooth-enabled configurations of iOS/iPadOS before 26.7 and 27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, and visionOS before 27; Apple fixed the flaw through improved input validation in iOS 26.7/27, iPadOS 26.7/27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, and visionOS 27. Exploitation requires a pre-existing pairing and proximity within Bluetooth radio range (CVSS AV:A, PR:N, UI:N), which rules out untargeted internet-scale attacks; EPSS is 0.19% (8th percentile), CISA SSVC records Exploitation: none and Automatable: no, and no public exploit code has been identified at time of analysis.
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code execution when a victim opens a maliciously crafted file, scoring CVSS 8.8 (AV:N/AC:L/PR:N/UI:R, CWE-787). Apple fixed the flaw in iOS 26.7.1, iPadOS 26.7.1, macOS Sequoia 15.8.1, and macOS Tahoe 26.7.1, and states it is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records an exploitation value of 'none' with the attack assessed as non-automatable.
Apple iOS 18.7.10 and iPadOS 18.7.10 ship a fix for an input-validation flaw (CWE-20) that lets a remote attacker crash or otherwise deny service on unpatched devices, with Apple rating the impact as a full availability loss (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/A:H). Every iPhone or iPad still running a version below 18.7.10 is potentially affected. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is currently a patch-promptly issue rather than an emergency.
Kernel-level use-after-free in Apple's built-in NFS client allows memory corruption when a device connects to an attacker-operated NFS server, affecting iOS/iPadOS, macOS, tvOS, visionOS and watchOS. Exploitation requires the victim to mount or connect to a malicious NFS share (UI:R) but no credentials or privileges on the target device, making this a remote, unauthenticated-against-the-client attack that terminates in kernel memory corruption with high confidentiality, integrity and availability impact. No public exploit code and no CISA KEV listing were identified at time of analysis; EPSS is low at 0.18% (8th percentile), and CISA SSVC rates exploitation as none and automatable as no, though technical impact is total. Apple has released fixes in iOS 26.7/27, iPadOS 26.7/27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27.
Out-of-bounds write in Apple's file-parsing code affects iOS/iPadOS 27 and earlier, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27, allowing a maliciously crafted file to corrupt memory when processed. Apple addressed the flaw with improved bounds checking across all listed platforms, and CVSS 3.1 scores it 7.8 (AV:L/AC:L/PR:L/UI:N) with high confidentiality, integrity, and availability impact, even though the advisory text itself describes only unexpected app termination. No publicly available exploit code and no CISA KEV listing were identified at time of analysis, and EPSS is 0.18% (7th percentile), indicating low near-term exploitation likelihood.
Improper state management in Apple's operating systems (iOS/iPadOS, tvOS, visionOS, watchOS) allows a locally installed app to read a persistent account identifier that should have remained isolated, resulting in information disclosure. Affected platforms are all versions prior to the 27 release train on each OS. Vendor patches are available (iOS 27, iPadOS 27, tvOS 27, visionOS 27, watchOS 27), no public exploit code has been identified at time of analysis, and EPSS is very low (0.15%, 5th percentile). The supplied CVSS vector (AV:N/PR:N) does not match the description's local-app precondition, so treat the 7.5 score with caution.
An out-of-bounds write (CWE-787) in the Apple frameworks that parse 3D model files lets a maliciously crafted model corrupt memory when it is opened on an affected device, potentially giving the attacker code execution in the context of the processing application. The flaw affects iOS/iPadOS before 26.7 and 27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate 27, tvOS before 27, visionOS before 27 and watchOS before 27, and Apple has shipped fixes for all of them. Exploitation likelihood is low: EPSS is 0.17% (7th percentile), CISA SSVC records exploitation as 'none' and the vulnerability is not in KEV — no public exploit code has been identified, and the local attack vector with required user interaction makes mass exploitation unlikely.
Race condition in Apple's kernel state management lets a malicious sandboxed app escape its sandbox and execute arbitrary code with kernel privileges on iOS, iPadOS, macOS, tvOS, visionOS and watchOS. Exploitation requires a timing window to be won (CVSS AC:H) but no user interaction beyond launching the app, and success yields full control of the affected device. Apple shipped fixes in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27; no public exploit code or CISA KEV listing was present in the provided data, and no EPSS
Improper state management in Apple iOS, iPadOS, and watchOS allows an installed app to track a user across other apps and websites without the user's permission, effectively defeating the platform's cross-app tracking consent controls. The flaw affects iOS/iPadOS releases before 26.7 and before 27, plus watchOS before 27, and is remediated by the iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, and watchOS 27 updates. Exploitation requires a hostile app on the device rather than remote network access; EPSS is 0.15% (5th percentile), there is no CISA KEV listing or public exploit identified, and SSVC rates exploitation as 'none' with partial technical impact.
Improper handling of persistent identifiers in Apple's mobile and desktop operating systems allows an app installed on the device to recognize the same user across app reinstalls, defeating the identifier-reset behavior that users and administrators rely on for privacy. Apple states the issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, and visionOS 27, and the affected CPE set covers all earlier releases of iOS/iPadOS, macOS, and visionOS. No public exploit code or CISA KEV entry has been reported at time of analysis, and EPSS is only 0.16% (6th percentile), so this is a privacy-integrity hardening fix rather than an emergency remote-code-execution patch.
Apple iOS and iPadOS before version 27 leak cross-application information through the handling of user preferences, allowing a locally installed app to enumerate which other apps are present on the device. Apple addressed the privacy flaw in iOS 27 and iPadOS 27; EPSS is only 0.17% (7th percentile), there is no CISA KEV listing, and no public exploit code identified at time of analysis. The practical impact is user profiling and device fingerprinting rather than code execution or data theft.
An out-of-bounds read in Apple's kernel (CWE-125) lets an app already running on the device read past the end of a kernel buffer, potentially leaking kernel memory or crashing the system. Affected platforms span iOS/iPadOS before 26.6.1, macOS Sequoia before 15.8, macOS Tahoe before 26.6.2, and tvOS, visionOS and watchOS before 27, with a CVSS 3.1 base of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H). There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is 0.20% (10th percentile), so this is a local, app-mediated kernel hardening issue rather than a remotely exploitable emergency.
Race condition in Apple's kernel allows a local user on iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27 to cause unexpected system termination or read kernel memory. Apple fixed the flaw with additional validation, publishing advisories 149034-149038; there is no public exploit code and no confirmed active exploitation (EPSS 0.16%, SSVC exploitation: none).
An out-of-bounds memory access in the Apple kernel allows a locally installed app to crash the system or corrupt kernel memory on iOS/iPadOS, macOS, tvOS, visionOS, and watchOS releases prior to the 27-series. The flaw is reachable only by an attacker who already has code executing as an app on the device (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), for example a malicious, sideloaded, enterprise-provisioned, or trojanized application - there is no remote or unauthenticated network path, and no user interaction beyond launching the app is required. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS is 0.17% (7th percentile), and the realistic ceiling absent a follow-on kernel exploit chain is a device crash. Vendor patches are available in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.
Memory corruption during 3D model parsing on unpatched Apple platforms (iOS/iPadOS before 26.7 and 27, macOS Sequoia before 15.8 / Tahoe before 26.7 / Golden Gate 27, and tvOS, visionOS, watchOS before 27) allows an attacker who can get a victim to open or preview a maliciously crafted 3D model file to corrupt memory, potentially leading to code execution in the context of the parsing process with high confidentiality, integrity, and availability impact. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.3), so the practical barrier is user interaction - the target must parse the crafted asset locally; there is no remote unauthenticated network path, and no public exploit code has been identified at time of analysis (EPSS 0.20%, 10th percentile). Apple has shipped fixes; this is a genuine but moderate-priority issue rather than a top-tier emergency, since exploitation depends on social engineering plus a locally delivered file.
Local kernel memory corruption in Apple's 26.x operating-system family (iOS and iPadOS, macOS Tahoe, tvOS, visionOS, watchOS) allows an installed, running application to write to kernel memory or trigger unexpected system termination, with the flaw fixed in the 26.6 releases. The bug requires the victim to install and run a malicious or compromised app - it is not reachable over the network and needs no user interaction beyond launching that app (CVSS 7.8, AV:L/PR:L/UI:N) - and Apple's sandbox, notarization and App Review keep the delivery bar high, though a successful kernel-write primitive carries high confidentiality, integrity and availability impact. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and EPSS sits at 0.16% (6th percentile), indicating low near-term exploitation likelihood relative to the severity of the primitive itself.
An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate), tvOS, visionOS, and watchOS - lets a remote attacker corrupt memory in an affected process, with the confirmed outcome being an application crash and the potential outcome being arbitrary code execution. Exploitation requires no authentication and no user interaction per the CVSS vector (AV:N/PR:N/UI:N), but the independent assessment rates attack complexity as High and the confirmed technical impact as limited to denial of service, because the specific component or content-processing surface that must be reached has not been documented and reliable code execution is unproven. Apple has released fixed builds for every affected platform, and no public exploit code or active exploitation has been identified at time of analysis; EPSS is a modest 0.99% (61st percentile), which is consistent with a patched, non-weaponized memory-safety defect rather than a top-tier emergency.
Sandbox escape in Apple iOS, iPadOS, and macOS allows a locally installed low-privileged malicious app to break out of its sandbox and gain elevated access to system resources, affecting iOS/iPadOS and macOS versions prior to 27 (macOS Golden Gate 27). Apple corrected the underlying permissions weakness (CWE-269, improper privilege management) by adding restrictions in the version 27 releases, so devices updated to iOS 27, iPadOS 27, or macOS Golden Gate 27 are remediated. The flaw is local-only with no remote or network trigger and requires the attacker to first get a malicious app onto the device; EPSS is 0.19% (8th percentile) and no public exploit identified at time of analysis, so risk is concentrated on devices that permit sideloaded, enterprise-provisioned, or otherwise untrusted applications.
Memory corruption in Apple's image-handling code across iOS 27, iPadOS 27, macOS Golden Gate 27 and visionOS 27 allows an attacker to achieve arbitrary code execution when a user processes a maliciously crafted image. Apple removed the vulnerable code entirely in the 27-generation releases, which are the only versions containing the fix; all earlier supported builds remain affected. The flaw is rated 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H), meaning exploitation needs local positioning plus some user interaction, and there is no public exploit code or CISA KEV entry identified at time of analysis.
Sign In With Apple state-management flaw in iOS, iPadOS, macOS, and visionOS lets a locally installed app hijack the authentication flow and obtain access to the victim's Apple Account. An attacker needs a malicious or compromised app already present on the device (AV:L) and the user must actively complete a Sign In With Apple prompt (UI:R), but no privileges or credentials are required by the app itself (PR:N), yielding high confidentiality and integrity impact on the linked Apple Account. Apple has shipped fixes in iOS/iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, and visionOS 27; EPSS is low at 0.24% (15th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis.
Device fingerprinting on Apple iOS and iPadOS before 26.7 (and before 27) lets a locally installed app defeat an authorization/state-management check and read a device-stable identifier it should not be able to obtain, weakening user privacy and enabling cross-app tracking or device re-identification. Exploitation requires an attacker to first get a malicious or privacy-invasive app onto the device (App Store distribution or sideloading), and the assessed impact is confidentiality-only - reading an identifier, with no code execution, data modification, or availability loss - so the vendor's CVSS 7.5 (AV:N/PR:N/I:H) overstates the practical risk relative to the assessed local, low-impact vector; this is a low real-world risk, confirmed patched by iOS/iPadOS 26.7 or 27, with no public exploit identified at time of analysis and a low EPSS score of 0.15% (5th percentile).
Kernel memory corruption in Apple's iOS, iPadOS, and macOS allows a local attacker who can already execute code on the device to cause unexpected system termination or corrupt kernel memory, as described by the vendor's improved memory handling fix. Affected builds are iOS and iPadOS before 26.7 (and before 27), plus macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27; all are remediated by the corresponding vendor updates. Exploitation requires a prior on-device foothold (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), so this realistically functions as a privilege-escalation or sandbox-escape stage rather than an initial-access vector - no public exploit has been identified at time of analysis, the issue is not confirmed actively exploited (no CISA KEV listing), and EPSS is low at 0.16% (6th percentile). It is a genuine but not top-tier priority: the impact is high if chained, but the barrier of local code execution limits reach.
An out-of-bounds read in Apple's operating system kernel lets a local user or a malicious/compromised app running on an affected device disclose kernel memory or crash the system, carrying a vendor CVSS 3.1 base score of 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H). The flaw affects iOS and iPadOS before 26.7/27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, and tvOS, visionOS and watchOS before 27; exploitation requires local code execution (AV:L, PR:L), there is no remote or network-triggerable path and no user-interaction requirement. Vendor-released patches addressing the issue are available in iOS 26.7/27, iPadOS 26.7/27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27; no public exploit code has been identified at time of analysis and EPSS is low at 0.20% (10th percentile), so this reads as a boundary/isolation bypass rather than an initial-access vector.
Local kernel memory corruption in Apple iOS and iPadOS (with parallel fixes in macOS, tvOS, visionOS and watchOS) lets an app already running on the device win a kernel race condition and either force an unexpected system termination or corrupt kernel memory, which can be leveraged toward full kernel read/write. Affected builds are iOS/iPadOS before 26.7 and before 27, macOS before 15.8, 26.7 (Tahoe) and 27 (Golden Gate), plus tvOS, visionOS and watchOS before 27; Apple has shipped fixes in every one of those branches. No public exploit code has been identified at time of analysis and EPSS is low at 0.18% (8th percentile), and because exploitation needs the attacker to already execute code as an app plus a timing-dependent race win, the vendor's own AV:L/PR:L vector (7.8 High) makes opportunistic mass exploitation impractical.
An out-of-bounds write in Apple's 3D model handling code causes memory corruption on unpatched iPhones, iPads, Macs, Apple TVs, Apple Vision Pro and Apple Watches when a maliciously crafted 3D model file is processed by the device. The flaw carries a CVSS 3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and was addressed by Apple with improved bounds checking in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7 and macOS Golden Gate 27, plus tvOS 27, visionOS 27 and watchOS 27; no public exploit code has been identified at time of analysis, and EPSS places the likelihood of exploitation in the near term at only 0.17% (7th percentile). Exploitation is not remote-service based: the attacker must first deliver the crafted model to the victim's device and have it parsed, so it is best treated as a genuine but not urgent patching priority rather than an imminent threat.
An out-of-bounds write in Apple's asset-catalog handling lets a maliciously crafted asset catalog trigger memory corruption that terminates the affected process on unpatched Apple operating systems - iOS and iPadOS before 27, macOS before 15.8, 26.7, and 27, and tvOS, visionOS, and watchOS before 27. Exploitation is local rather than network-based (CVSS:3.1/AV:L/AC:L/PR:N/UI:R) and requires the victim to load or open the crafted asset via a downloaded app, bundle, or file, so the realistic outcome is client-side denial of service rather than remote code execution, despite the vendor's 7.8 base score; no public exploit code was identified at time of analysis and EPSS is only 0.20% (10th percentile), indicating low observed exploitation likelihood. Apple has released fixed versions across all affected platforms.
Opening a maliciously crafted file on an unpatched Apple device can crash the component that parses it, because a buffer overflow in Apple's size-validation logic was only corrected in the latest OS releases. Affected platforms are iOS/iPadOS before 26.7 (and before 27), macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, tvOS before 27, and visionOS before 27; exploitation is local and requires the victim to actively open the attacker-supplied file, with no remote or network trigger available. The demonstrated outcome per Apple's advisory is unexpected process termination (denial of service) rather than code execution or data disclosure, and no public exploit code or confirmed active exploitation was identified at time of analysis, with EPSS at 0.22% (13th percentile).
Path traversal in Apple iOS and iPadOS lets an attacker who physically holds a trust-paired iPhone or iPad read and write files outside the intended directory, a high-confidentiality and high-integrity impact on the device's file store. Everything running earlier than iOS/iPadOS 26.7 or iOS/iPadOS 27 is affected, and the vendor-released fixes are iOS 26.7, iPadOS 26.7, iOS 27 and iPadOS 27 (Apple advisories 149034 and 149041). Exploitation hinges on prior physical possession and an already-accepted 'Trust This Computer' relationship, so the published 7.5 score (CVSS:3.1/AV:N/PR:N) is inflated relative to the required prerequisites - the same vector's PR:N confirms no additional authentication is needed once the pairing exists - and exploitation risk is further limited by a low EPSS of 0.15 percent (5th percentile) with no public exploit identified at time of analysis.
A locally installed app on Apple iOS/iPadOS (before 27), macOS (before Golden Gate 27, Tahoe 26.7, or Sequoia 15.8), tvOS 27, visionOS 27, and watchOS 27 can bypass insufficient path validation to modify files in protected system locations, corrupting system integrity. Exploitation requires the attacker to get a malicious or trojanized app running on the target device - there is no remote network path despite the vendor's published 9.8 network vector, and our independent assessment rates the issue CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N, with no authentication requirement and no user interaction beyond running the app. Vendor patches are available for all affected platforms, exploitation probability is low (EPSS 0.19%, 9th percentile), and no public exploit code has been identified at time of analysis.
A use-after-free flaw in Apple's kernel affects iOS and iPadOS before 26.7, macOS Sequoia before 15.8, and macOS Golden Gate before 27, allowing a locally running app to corrupt kernel memory or cause unexpected system termination. The issue is a local, low-privilege memory-safety defect (CWE-416) rated CVSS 7.8, and Apple has shipped fixes in iOS 26.7, iPadOS 26.7, macOS Golden Gate 27 and macOS Sequoia 15.8. There is no indication of active exploitation (no CISA KEV listing) and no public exploit code identified, with EPSS at 0.19% (9th percentile) suggesting low near-term exploitation likelihood at scale.
Kernel memory corruption in Apple's operating systems lets an app already running on a device trigger a double free (CWE-415) that can corrupt kernel memory or crash the system unexpectedly. Affected are iOS and iPadOS before 26.7 and before 27, macOS before Sequoia 15.8, before Tahoe 26.7, and before Golden Gate 27, plus tvOS, visionOS, and watchOS before 27; the issue is fixed in those newer releases. Apple's own CVSS of 9.8 (AV:N/PR:N/UI:N) is not supported by the description, which frames the vector as a locally installed and executed app rather than a remote or unauthenticated service, and our independent assessment scores it as a local (AV:L) double-free with high availability and integrity impact but no confidentiality impact. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and EPSS is only 0.21% (11th percentile), indicating low near-term exploitation likelihood.
Kernel memory corruption in Apple's operating systems (iOS/iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS, visionOS and watchOS 27 and earlier) lets an application already running on the device crash the system or corrupt kernel memory, per Apple's advisory the root cause was addressed through improved memory handling. The independent assessment rates this as a local, app-gated issue (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) rather than the vendor's network-reachable AV:N/PR:N vector of 7.5, meaning exploitation requires an attacker to first get code executing as an app on the target device; no elevated privileges or user interaction beyond launching the app are needed once that foothold exists. There is no public exploit identified at time of analysis, EPSS is low at 0.18% (7th percentile), and no CISA KEV listing applies; the practical outcome in most cases is a device crash or denial of service, with kernel memory corruption that would require additional work to turn into privilege escalation. Vendor-released patches are available across all affected platform lines.
On unpatched Apple platforms, opening a maliciously crafted video file can cause the affected app to terminate unexpectedly or leave process memory corrupted, because the underlying media parsing code fails to handle memory correctly. Affected are iOS/iPadOS before 26.6 or 26.7, macOS Sequoia before 15.8, macOS Tahoe before 26.6 or 26.7, tvOS before 26.6, and watchOS before 26.6; the vector is local (AV:L) with user interaction required (UI:R) and no authentication (PR:N), meaning an attacker must deliver the file and convince the user to open or preview it. There is no public exploit identified at time of analysis and EPSS is low (0.18%, 7th percentile), but the flaw is serious: the description substantiates only app crashes and in-process memory corruption, with no confirmed confidentiality disclosure or code-execution primitive, which is narrower than the vendor's 7.8 high-severity rating implies. Vendor patches are available.
Information disclosure in Apple iOS, iPadOS, macOS, visionOS, and watchOS before version 27 allows a malicious or privacy-abusing app already installed on the device to fingerprint the user by accessing identifiers that should be restricted by the sandbox. The vendor's CVSS 9.1 is drastically inflated and inconsistent with the description; our assessment is AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, with impact limited to privacy tracking rather than data theft, code execution, or system compromise. Apple fixed the issue in iOS 27, iPadOS 27, macOS Golden Gate 27, visionOS 27, and watchOS 27 by adding sandbox restrictions; no public exploit identified at time of analysis and EPSS is low at 0.16% (6th percentile).
Memory corruption during file parsing on Apple iOS/iPadOS (before version 27) and macOS (before Golden Gate 27) can cause the handling application to terminate unexpectedly when a user opens a maliciously crafted file; the flaw was addressed by strengthening input validation. Because the attack vector is local (the file must be delivered to and opened on the device) and user interaction is required, exploitation is not remote or unattended, and no special privileges are needed (PR:N, unauthenticated). The vendor rates this 7.8 High, but the independently assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) reflects availability-only impact, and combined with a very low EPSS of 0.19% (8th percentile) and no public exploit identified at time of analysis, real-world risk is LOW-to-MODERATE rather than critical.
An out-of-bounds write in Apple's media-handling code can corrupt memory and terminate the affected app when a user opens or previews a maliciously crafted video file on an unpatched Apple OS. The flaw affects iOS/iPadOS before 26.7 and before 27, macOS before Sequoia 15.8, before Tahoe 26.7, and before Golden Gate 27, plus tvOS before 27 and visionOS before 27, and Apple resolved it with improved bounds checking in those releases. Exploitation requires local delivery of the crafted file plus user interaction (CVSS AV:L/UI:R/PR:N), no public exploit code has been identified at time of analysis, and EPSS is low at 0.18% (7th percentile), so the practical risk is bounded by the demonstrated outcome of app termination rather than confirmed remote or zero-click compromise.
An out-of-bounds write in Apple's WebKit engine — reachable by processing maliciously crafted web content — can corrupt memory and potentially lead to arbitrary code execution on affected Apple platforms. The flaw stems from an integer-overflow class defect (CWE-190) where a size calculation overflows and the subsequent bounds check fails, allowing an OOB write. It is fixed in Safari 26.6.1, iOS/iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27 and watchOS 27; exploitation requires the victim to load attacker-controlled web content (UI:R), and no public exploit or active exploitation has been identified at time of analysis, with EPSS at just 0.17% (6th percentile).
Improper certificate validation in Apple's cross-platform certificate handling lets an attacker who controls a compromised intermediate certificate authority issue certificates with arbitrary extended key usages that unpatched devices will accept as valid, enabling spoofing or trust-bypass against TLS and other PKI-dependent services. Affected are iOS/iPadOS before 26.7 and before 27, macOS before 15.8, before 26.7 and before 27, plus tvOS before 27, watchOS before 27 and visionOS before 27; the vendor scores this CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) with unauthenticated remote attack, while our independent assessment keeps the same vector but raises attack complexity to High because the attack is only reachable after a trusted intermediate CA has already been compromised. No public exploit code has been identified at time of analysis (EPSS 0.14%, 4th percentile), and vendor patches are available offering the exact fixed versions listed below.
Missing entitlement checks in Apple's iOS and iPadOS, tvOS, watchOS, and visionOS (all versions before the 27 release train) allow a locally installed app to read device attributes it is not authorized to access and combine them into a persistent fingerprint of the user. Only devices running an affected platform with an attacker-supplied app already installed are exposed; the independent assessment re-scores the issue as local-access with confidentiality-only impact (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), which is materially lower than the supplied CVSS 3.1 vector (AV:N, 7.5) that treats the flaw as remotely reachable. There is no indication of active exploitation, KEV status is not set, and no public exploit code has been identified at time of analysis; EPSS is 0.19% (9th percentile), consistent with a low near-term exploit probability. Apple has released fixes in iOS 27, iPadOS 27, tvOS 27, visionOS 27, and watchOS 27.
Memory corruption in Apple Safari and the shared WebKit engine used across iOS, iPadOS, macOS Tahoe, tvOS, visionOS and watchOS can be triggered when a victim views maliciously crafted web content, rooted in an integer overflow (CWE-190) that was corrected through improved input validation. The CVSS 3.1 vector (8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates an unauthenticated network-delivered attack that requires user interaction but yields high confidentiality, integrity and availability impact, consistent with out-of-bounds memory effects rather than a confirmed code-execution chain. No public exploit code has been identified at time of analysis and CISA KEV does not list this CVE, while the EPSS score of 0.17% (6th percentile) signals a real but low-priority, non-urgent risk that is best addressed through routine patching. Patches are available from the vendor in Safari 26.6.1, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27 and watchOS 27.
Improper handling of unexpected runtime conditions in Apple's operating systems lets a locally installed malicious app trigger an uncaught exception that terminates the system - a denial-of-service/crash impact with no confidentiality or code-execution effect. Affected platforms are iOS and iPadOS before 26.7 and before 27, macOS Tahoe before 26.7 and macOS Golden Gate before 27, plus tvOS 27, visionOS 27 and watchOS 27; the attacker must first get an app onto the device and execute it, and the payoff is only a transient system termination. There is no public exploit code and no confirmed active exploitation, EPSS is 0.18% (7th percentile), and Apple has shipped fixed versions, so this should be treated as a genuine but low-priority issue requiring routine patch cadence rather than emergency response.
User fingerprinting on Apple iOS and iPadOS devices running versions earlier than 26.6 allows an installed application to identify and track the device owner through sensitive data that Apple has now relocated as part of version 26.6. Per the authoritative assessment, this is an on-device, local-execution privacy flaw (CWE-359) with no additional privileges or user interaction required beyond the app running, and its impact is limited to tracking/fingerprinting rather than data theft, code execution, or system compromise; the supplied AV:N/high-confidentiality vector is not borne out by analysis. Exploitation requires getting a malicious or privacy-abusing app onto the device via the App Store, sideloading, MDM/enterprise provisioning, or TestFlight, and devices already updated to iOS/iPadOS 26.6 are not affected. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.14% (4th percentile).
A local privilege-escalation flaw in Apple's operating system family lets a malicious app already running on the device obtain root privileges by exploiting a missing authorization check. Apple addressed the issue with 'additional restrictions' in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, and visionOS 27, and the CVSS 3.1 score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not confirmed: the issue is not in CISA KEV, no public exploit code is identified, and CISA's SSVC assessment lists exploitation as 'none' and automatable as 'no', though technical impact is rated 'total' once root is achieved.
Memory corruption in Apple's 3D model parsing pipeline allows a local attacker with low privileges to trigger a classic buffer overflow (CWE-120) on iOS/iPadOS, macOS, tvOS, visionOS and watchOS when a victim opens a maliciously crafted 3D model file. Apple addressed the flaw with improved memory handling in iOS 26.7/27, iPadOS 26.7/27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27 and watchOS 27. Exploitation requires local access and user interaction, no public exploit code has been identified at time of analysis, and the EPSS score is very low at 0.17% (7th percentile), so this is a credible patching priority for Apple fleets rather than a mass-exploitation emergency.
Content Security Policy enforcement failure in Safari's AudioWorklet contexts allows remote attackers to bypass CSP restrictions when a user processes maliciously crafted web content. Affected platforms include Safari before 26.5, iOS and iPadOS before 18.7.9/26.5, and macOS Tahoe before 26.5. Apple has released patches across all affected platforms; no public exploit or CISA KEV listing is identified at time of analysis.
Memory corruption in Apple's web content rendering engine affects iOS, iPadOS, and macOS Tahoe, enabling high-impact device compromise when a user processes maliciously crafted web content. All iOS and iPadOS versions prior to 18.7.10 and 26.6.1, and macOS Tahoe versions prior to 26.6.2, are confirmed affected per Apple security advisories and EUVD-2026-60510. Apple has released patched builds across all affected branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Integer overflow in Apple's image processing subsystem across iOS, iPadOS, and macOS Tahoe allows arbitrary code execution when a user processes a maliciously crafted image. Affected platforms include iOS and iPadOS prior to 26.6.1 and macOS Tahoe prior to 26.6.2, with Apple releasing out-of-band point releases indicating urgency. No public exploit has been identified at time of analysis, but the CVSS 8.8 score and SSVC total technical impact rating place this among high-priority patching targets given Apple's massive consumer and enterprise device footprint.
Remote denial-of-service in Apple iOS, iPadOS, and macOS Tahoe exploits a use-after-free memory corruption flaw, allowing an unauthenticated remote attacker to trigger unexpected system termination without user interaction. Affected platforms include iOS and iPadOS prior to 26.6.1 and macOS Tahoe prior to 26.6.2, as confirmed by Apple security advisories. No public exploit code or active exploitation has been identified at time of analysis, but the network-accessible, zero-interaction attack surface presents a meaningful availability risk for all unpatched Apple devices.
Kernel memory corruption via race condition in Apple OS allows a malicious app to write arbitrary kernel memory or cause unexpected system termination. The issue affects iOS, iPadOS, macOS, and watchOS versions prior to the June 2026 security fixes, and has been patched by Apple. No public exploit or active exploitation is known, and EPSS indicates a low probability of widespread exploitation at this time.
A code signing enforcement bypass in Apple operating systems allows a maliciously crafted app to execute with high confidentiality and integrity impact. No active exploitation is reported, and the EPSS score of 0.17% indicates a low probability of weaponization. Apple has released patches in version 26.6 for all affected platforms.
A sandbox escape vulnerability in Apple operating systems allows a malicious app to break out of its containment and gain full access to the device. Affected versions include iOS and iPadOS prior to 26.6, multiple macOS versions (Sonoma before 14.8.8, Sequoia before 15.7.8, Tahoe before 26.6), and tvOS before 26.6. No public exploit or active exploitation has been identified, and EPSS indicates a low probability of real-world attacks.
Memory corruption in Apple's audio processing framework affects iOS, iPadOS, macOS (Sonoma, Sequoia, Tahoe), tvOS, visionOS, and watchOS, where parsing a maliciously crafted audio file can corrupt process memory and potentially lead to arbitrary code execution. The flaw requires a victim to open or process the malicious file (local vector, user interaction) but no prior privileges. Apple has shipped fixes across all platforms; no public exploit identified at time of analysis and EPSS is low (0.16%).
Use-after-free vulnerability in Safari’s web content processing allows remote attackers to execute arbitrary code on affected Apple devices when a user visits a malicious website. Affected versions include Safari prior to 26.6, iOS and iPadOS prior to 26.6, macOS Tahoe prior to 26.6, visionOS prior to 26.6, and watchOS prior to 26.6. No public exploit or active exploitation has been identified, and EPSS indicates a low probability of exploitation (0.13%).
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Sequoia before 15.7.8, macOS Sonoma before 14.8.8, macOS Tahoe/tvOS/visionOS/watchOS before 26.6 - where a use-after-free (CWE-416) lets a locally installed app crash the system. There is no public exploit identified at time of analysis and the NVD CVSS 9.8 (C:H/I:H/A:H) conflicts with Apple's own description, which states only 'unexpected system termination' (availability impact), suggesting the true impact is a DoS crash rather than full compromise. EPSS is low (0.17%, 6th percentile) and the issue is not in CISA KEV.
Arbitrary code execution via buffer overflow in Apple iOS, iPadOS, and macOS. Processing a maliciously crafted file can
Memory corruption in Apple's cross-platform image-processing stack allows a maliciously crafted image to corrupt process memory across iOS/iPadOS, macOS, tvOS, visionOS, and watchOS. Apple self-reported and patched the flaw (fixed in iOS/iPadOS 26.6, macOS Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.6, and the 26.6 releases of tvOS/visionOS/watchOS). No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and CISA SSVC records exploitation status as none, though the technical impact is rated total.
Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected system termination. Affected versions include iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. While the NVD assigns CVSS 9.8, the actual impact is limited to availability; no active exploitation or public exploit code is identified, and EPSS indicates very low exploitation probability (0.17%).
Memory corruption in Apple Safari 26.x allows remote code execution via processing maliciously crafted web content. This buffer overflow (CWE-119) affects all Apple platforms—iOS, iPadOS, macOS, visionOS, and watchOS—requiring user interaction to visit a malicious webpage. While the CVSS score is critical (8.8), EPSS (0.13%) indicates low current exploitation probability and no KEV listing or public exploit exists.
A race condition in Apple operating systems (iOS, iPadOS, macOS, tvOS, watchOS) fixed in version 26.6 allows a local malicious app to cause unexpected system termination, resulting in a denial-of-service condition. No evidence of active exploitation or public exploit code exists, and EPSS indicates very low exploitation probability (0.16%). The NVD-assigned CVSS 9.8 appears inconsistent with the actual impact, which is limited to availability.
Unexpected system termination in iOS and iPadOS prior to 26.6, as well as in certain versions of macOS, tvOS, and visionOS, resulting from a use-after-free memory corruption. Apple's description indicates a local denial-of-service where a malicious app can crash the system, while the NVD-assigned CVSS 9.8 erroneously implies unauthenticated remote code execution. A patch is available, no active exploitation has been reported, and EPSS suggests a very low probability of wide exploitation.
Missing authorization in Apple's Contacts framework across iOS/iPadOS, macOS Tahoe, visionOS, and watchOS (all versions before 26.6) allows an installed app to add contact entries without triggering the user's authorization prompt. Apple fixed the flaw with improved validation in the 26.6 releases. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.16% (6th percentile), consistent with a low-severity local privacy-scope bypass despite the input's inflated 9.8 score.
User fingerprinting in Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS allows a malicious app to collect device or user identifiers due to a permissions issue. All versions prior to the 26.6 updates are affected. No public exploit code or active exploitation has been identified, and EPSS indicates a low 0.15% probability of exploitation.
Kernel memory corruption in Apple XNU kernel allows a remote attacker to potentially execute arbitrary code or crash the system when a victim connects to a malicious NFS server. Affected are all Apple operating systems—iOS, iPadOS, macOS, tvOS, and watchOS—before version 26.6. No active exploitation or public exploit code has been observed, and EPSS indicates a low probability of widespread attacks.
Processing a maliciously crafted file on unpatched Apple operating systems (iOS, iPadOS, macOS, tvOS, watchOS, visionOS) may allow arbitrary code execution due to an integer overflow in file handling. The vulnerability affects all versions prior to the latest OS updates and requires user interaction (opening a file) to trigger. No active exploitation or public exploit code has been identified, and patches are available in the vendor-released updates.
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be triggered by a remote attacker via an out-of-bounds write. The issue, patched in the latest OS updates, carries a CVSS base score of 9.8 but is not known to be actively exploited. EPSS estimates a low 0.25% probability of exploitation, and no public exploit code has been identified.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, and visionOS 26.6 allows unauthenticated network attackers to corrupt heap memory via an out-of-bounds write. This can lead to arbitrary code execution or unexpected application termination, compromising the affected device
Physical-proximity memory corruption in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, watchOS, visionOS) allows a nearby attacker to corrupt process memory, potentially leading to arbitrary code execution or denial of service. No active exploitation is known, and vendor-released patches are available. EPSS score is low (0.16%), and the CVSS vector supplied (AV:N) conflicts with the required physical proximity.
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause application termination or arbitrary code execution. Affected products include iOS and iPadOS prior to version 26.6, macOS before Sequoia 15.7.8 and Tahoe 26.6, tvOS before 26.6, and visionOS before 26.6; no active exploitation or public proof-of-concept has been reported.
Use-after-free memory corruption in Apple's core operating-system platforms - iOS/iPadOS, macOS Tahoe, tvOS, and watchOS before version 26.6 - allows a locally installed and executed application to crash or unexpectedly terminate the system. Exploitation requires the victim to run attacker-supplied code as an app on an unpatched device; there is no remote attack surface, and the demonstrable impact is availability only (system termination/reboot), with no data disclosure, modification, or code execution established - meaning the publicly circulated CVSS 9.8 network vector materially overstates the real reachability and impact of this bug. No public exploit identified at time of analysis, EPSS is low at 0.16% (6th percentile), CISA SSVC records Exploitation: none with total technical impact if reached, and Apple has shipped fixes in 26.6 across all four platforms.
Processing a maliciously crafted video file may lead to memory corruption enabling possible arbitrary code execution on multiple Apple operating systems. Affected platforms include iOS, iPadOS, macOS, tvOS, watchOS, and visionOS; fixes are available in the latest updates (iOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6). User interaction is required to open the malicious video, and no public exploit or active exploitation is known at this time.
Arbitrary code execution in Apple iOS, iPadOS, and macOS arises when the OS image-processing pipeline handles a maliciously crafted image, triggering an integer overflow (CWE-190) that can be leveraged to run attacker-controlled code. The flaw affects iOS/iPadOS before 26.6 and multiple macOS trains (Sonoma before 14.8.8, Sequoia before 15.7.8, Tahoe before 26.6) and requires the victim to open or process the malicious image (UI:R). No public exploit has been identified at time of analysis, EPSS is low (0.18%, 7th percentile), and it is not listed in CISA KEV.
Use-after-free memory corruption in Apple's iOS 26.6-era platform family lets an already-installed app crash the operating system kernel or a system service, producing an unexpected system termination (denial of service). Affected software spans iOS/iPadOS before 26.6, macOS Sequoia before 15.7.8, macOS Sonoma before 14.8.8, macOS Tahoe before 26.6, and tvOS, visionOS and watchOS before 26.6; exploitation requires the attacker's app to run locally on the device, since the flaw is only reachable from within an executing process. The headline input score of CVSS 9.8 (AV:N) overstates the issue - Apple's own advisory describes impact limited to a crashing app, EPSS is a low 0.17% (6th percentile), CISA SSVC records no exploitation and no public exploit code exists, and no KEV listing or POC is associated with CVE-2026-43822.
We are tasked with producing a JSON analysis for CVE-2026-64747. We must use all provided data, including EPSS, SSVC, patch availability, CPE, and tags. The vulnerability is a buffer overflow in Apple products, with an app potentially executing arbitrary code with kernel privileges. CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). CWE-120. Patch available from vendor. EPSS 0.19% (low). SSVC: Exploitation none, Automatable no, Technical impact total. KEV status? Not in input, so not KEV. POC? Not mentioned. Tags include RCE, Apple, Buffer Overflow, etc. Affected products: iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. CPEs confirm. References are Apple support pages. We must produce fields: - product_name: 1-3 words, specific product. Since it spans many OSes, the "primary one"? The CVE description mentions iOS and iPadOS, macOS, tvOS, visionOS, watchOS. The common underlying component is likely the kernel or something. But the product is Apple's operating systems. Could say "Apple OS Family" or "Apple Kernel". The description says "An app may be able to execute arbitrary code with kernel privileges." So the vulnerability is in the kernel, accessible via an app. So product could be "Apple Kernel" or "Apple Operating Systems". But the instruction says "The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel'." So maybe "Apple Kernel". However, it's not explicitly named. The CPEs list specific products: ios_and_ipados, macos, tvos, visionos, watchos. So I'll use "Apple OS Family" but that is 3 words. "Apple Kernel" is 2 words. I'll go with "Apple Kernel" as the vulnerable component. The description isn't clear if it's the kernel itself or a system library, but "kernel privileges" suggests kernel execution. So "Apple Kernel" is appropriate. - summary: 2-3 sentences, original synthesis, avoid starting with "A vulnerability". Start with impact verb a
A use-after-free vulnerability in Apple operating systems allows a malicious app to cause unexpected system termination or write to kernel memory. The issue affects iOS
Denial of service in Apple iOS, macOS, and related operating systems due to a use-after-free flaw could allow a malicious app to crash the device. Apple's advisory only confirms unexpected system termination, but an independent CVSS score of 9.8 suggests potential for full system compromise; however, the CVSS vector appears inconsistent with the vendor description. The vulnerability is patched in versions 26.6 for all affected OSes, and no active exploitation or public exploit code is known.
Remote attackers can cause unexpected application termination and potentially read sensitive memory on affected Apple devices. This out-of-bounds read vulnerability, tracked as CVE-2026-64768, affects iOS, iPadOS, macOS, tvOS, and visionOS due to insufficient input validation. No active exploitation or public proof-of-concept code has been identified.
Information disclosure in Apple Safari and OS-integrated WebKit allows websites to detect if a user has visited specific URLs. Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS prior to version 26.6 are affected. No public exploit code or active attacks have been reported, and the probability of exploitation is very low (EPSS 0.17%).
Denial-of-service vulnerability in Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS due to an out-of-bounds write in a shared component. A malicious app executed locally can cause a system crash; the CVSS vector also suggests potential high confidentiality impact (memory disclosure), though the advisory only mentions denial-of-service. Fixed in updates; no active exploitation or public exploit code reported, and EPSS probability is very low (0.17%).
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an out-of-bounds write bug. An unauthenticated attacker can trigger heap corruption by sending a malicious payload over the network, leading to unexpected application termination or potential arbitrary code execution with no user interaction required. Apple has released platform patches fixing this critical vulnerability, and while no active exploitation or public exploit is known, the EPSS score indicates low near-term exploitation
Arbitrary code execution via malicious file processing affects multiple Apple operating systems due to an out-of-bounds write. Fixed in iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No active exploitation or public exploit is known, and EPSS predicts a very low probability of real-world attacks.
Denial of service in Apple operating systems (iOS/iPadOS 26.6, macOS Sonoma 14.8.8, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS/visionOS/watchOS 26.6) allows a locally installed app to trigger an integer overflow that causes unexpected system termination. The flaw was reported and patched by Apple, and CISA's SSVC framework rates exploitation as 'none' with EPSS at just 0.17% (6th percentile), indicating no public exploit identified at time of analysis. Note a significant signal conflict: the NVD CVSS vector of 9.8 (AV:N, full C/I/A impact) is inconsistent with the description, which describes only an app-triggered crash.
A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An attacker can use this information disclosure vulnerability to track the user’s identity across different contexts, violating privacy. The issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6, and no active exploitation or public exploit code has been observed.