Ios And Ipados
Monthly
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. The user's original email address may be leaked when using the Hide My Email feature.
An out-of-bounds read in Apple's image-handling code lets a maliciously crafted image terminate the affected application when a user opens or renders it, affecting iOS and iPadOS, macOS and visionOS. Impact is confined to availability (C:N/I:N/A:H) and requires the victim to process the file (UI:R) with no authentication needed (PR:N); exploitation is limited to builds older than iOS/iPadOS 26.7.2 and 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, macOS Golden Gate 27.2 and visionOS 27.2. No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and EPSS is 0.60% (49th percentile); the realistic ceiling is denial of service, not data exposure or code execution.
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to access sensitive user data.
A local authorization-check flaw in Apple iOS and iPadOS before 27.2 lets an already-installed app reach sensitive user data it should not be able to read. Devices running versions prior to 27.2 are affected; the vendor addressed the issue with improved checks and released 27.2 as the fix. Exploitation requires a malicious or compromised app to be installed and running on the device, with no user interaction needed beyond that app executing. Severity is moderate (CVSS 5.5, local vector, high confidentiality impact only), EPSS is low at 0.18% (8th percentile), and no public exploit code or active exploitation is identified in the available data.
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted image may result in disclosure of process memory.
An out-of-bounds write in Apple's image-processing path causes affected iOS, iPadOS and macOS systems to terminate an application when a maliciously crafted image is processed, giving an attacker a denial-of-service effect against a targeted app. The flaw affects iOS and iPadOS before 26.7.2 and before 27.2, plus macOS Sequoia before 15.8.2, macOS Tahoe before 26.7.2 and macOS Golden Gate before 27.2; no authentication or prior privilege is needed, but a victim must be induced to open the crafted image (UI:R), and the confirmed impact is availability only, with no disclosed code execution or data exposure. EPSS is low at 0.55% (46th percentile), SSVC records no known exploitation and no automatable path, and no public exploit identified at time of analysis; Apple has released fixed versions for every affected branch.
A logic issue was addressed with improved checks. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27. An attacker with physical access may be able to access contacts from the lock screen.
An integer underflow was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciously crafted image may result in memory corruption.
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted 3D model may lead to memory corruption.
A race condition in Apple's operating system stack allows an app already running on the device to read sensitive user data that it should not be able to reach; Apple addressed it by adding validation, shipping fixes in iOS/iPadOS 26.7.2 and 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, and visionOS 27.2. The issue is scored CVSS 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning the attacker needs local code execution and must win a timing-dependent race, with impact limited to confidentiality. No public exploit has been identified at time of analysis, EPSS is 0.21% (11th percentile), and the CVE is not listed in CISA KEV, so this is a genuine but low-urgency issue rather than a drop-everything emergency.
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2. An app may be able to cause unexpected system termination or write kernel memory.
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.
An out-of-bounds write (CWE-787) in Apple's operating systems - iOS and iPadOS, macOS Sequoia, macOS Tahoe, macOS Golden Gate, and visionOS - allows a crafted or malicious app, or attacker-supplied content that a user interacts with, to trigger memory corruption and unexpected system termination. The impact is availability-focused: the supplied vector (PR:N/UI:R, C:N/I:N/A:H) and the independent assessment agree that confidentiality and integrity are not confirmed as affected, while system stability and process memory are. There is no KEV listing and no public exploit code identified at time of analysis, EPSS is low at 0.55% (46th percentile), and CISA SSVC rates exploitation as none and automatable as no, so this is routine patch-cycle work rather than an emergency; Apple fixed it with improved input validation across all current branches.
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may result in the disclosure of process memory.
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted file may lead to unexpected app termination.
A heap buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An attacker in radio range may be able to cause unexpected system termination.
The issue was addressed with improved memory handling. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory.
Missing authorization checks in Apple's operating systems let a locally installed app reach sensitive user data that should be walled off behind a permission boundary, affecting iOS and iPadOS before 26.7.2 (and the 27.x branch before 27.2), plus tvOS, visionOS and watchOS before 27.2. The exposure is confidentiality-only (C:H, no integrity or availability impact), scoped to devices where a malicious or abused app is already running locally, and Apple states the flaw was fixed by adding additional restrictions to the permission logic. Scoring is medium (CVSS 5.5) with a low EPSS of 0.21% (10th percentile), and no public exploit has been identified at time of analysis, so this is a real-but-not-urgent issue that fits a routine monthly update cadence.
An out-of-bounds write (CWE-787) in Apple's image-processing code affects iOS and iPadOS before 26.7.2 and 27.2 and macOS Golden Gate before 27.2 and macOS Tahoe before 26.7.2; opening or otherwise causing a maliciously crafted image to be processed can crash the affected app, yielding a denial of service scored CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Exploitation requires user interaction - the victim must cause the image to be processed - so this is not a zero-click remote attack on default configurations, and the assessed impact is limited to unexpected app termination with no confidentiality or integrity loss. No public exploit is identified at time of analysis: SSVC records Exploitation: none and there is no KEV entry, though EPSS sits at 0.50% (42nd percentile); Apple has released fixed builds and the vendor cites improved bounds checking.
A null pointer dereference was addressed with improved validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An attacker in physical proximity may be able to cause a denial-of-service.
An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An app may be able to fingerprint the user.
This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27. An app may be able to modify protected parts of the file system.
A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to disclose kernel memory.
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted font may result in the disclosure of process memory.
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.
A logic issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27. An app may be able to access sensitive user data.
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2. An attacker in radio range may be able to cause unexpected system termination.
An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An app may be able to read the device's name.
Processing a maliciously crafted image on unpatched Apple devices can terminate the affected application, giving a denial-of-service condition on iOS/iPadOS, macOS, and visionOS. The flaw is an out-of-bounds read (CWE-125) that Apple addressed with improved bounds checking in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, and visionOS 27.2. The vector (AV:N/AC:L/PR:N/UI:R, C:N/I:N/A:H) means a remote attacker needs the victim to open or render the image, with no authentication; impact is limited to app termination and there is no public exploit identified at time of analysis, with EPSS at 0.58% (48th percentile) and CISA SSVC recording no exploitation and no automatable path.
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents.
A null pointer dereference was addressed with improved validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An attacker in physical proximity may be able to cause a denial-of-service.
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or write kernel memory.
This issue was addressed with improved input validation. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2. Processing maliciously crafted web content may lead to an unexpected process crash.
Local apps on Apple iOS and iPadOS and on visionOS can reach sensitive user data that should be outside their access boundary, because access restrictions were insufficient in versions prior to 27.2. The flaw is a moderate-severity local access-control weakness: an attacker must already have a malicious or compromised app installed and running on the device, and the resulting impact is limited to confidentiality (data disclosure) with no modification or availability effect. Apple addressed it in iOS 27.2, iPadOS 27.2 and visionOS 27.2; EPSS is 0.20% (10th percentile), there is no CISA KEV entry, and no public exploit has been identified at the time of analysis.
A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.
Local apps on Apple iOS, iPadOS, and macOS before 27.2 can leverage insufficient input validation to access sensitive user data that should not be available to them. The issue requires a malicious or malformed app already installed and executing on the device (CVSS AV:L/PR:L, no user interaction) and does not provide a remote or network attack path. Apple fixed it in iOS 27.2, iPadOS 27.2, and macOS Golden Gate 27.2; no public exploit identified at time of analysis, and EPSS is 0.20%.
A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted image may result in disclosure of process memory.
This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27. An app may be able to access sensitive user data.
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted video file may lead to unexpected app termination.
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted calendar invitation may lead to memory corruption.
This issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. A malicious application may be able to bypass Privacy preferences.
A race condition was addressed with improved state handling. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27. An app may be able to cause unexpected system termination.
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Processing a maliciously crafted image may lead to arbitrary code execution.
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to an unexpected process termination.
An out-of-bounds write in Apple's image handling on iOS/iPadOS, macOS and visionOS can terminate the affected application when a user opens a maliciously crafted image, giving an availability-only denial-of-service outcome (CVSS 6.5, C:N/I:N/A:H). The attacker cannot trigger the fault directly: exploitation requires the victim to process the crafted file in an affected app, as reflected by the UI:R vector component, and macOS is affected across three branches (Sequoia before 15.8.2, Tahoe before 26.7.2, Golden Gate before 27.2) while iOS/iPadOS is affected before 26.7.2 and before 27.2 and visionOS before 27.2. Apple has released fixes for all listed platforms with improved bounds checking; no public exploit identified at time of analysis, EPSS is 0.58% (48th percentile), and CISA SSVC rates exploitation as none with partial technical impact, making this a moderate, not top-tier, priority.
The issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted image may result in disclosure of process memory.
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious USB device may be able to cause unexpected system termination or read kernel memory.
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to an unexpected process termination.
Memory corruption in Apple's mobile and desktop operating systems (iOS/iPadOS, macOS, tvOS, visionOS, watchOS) allows an app already executing on the device to trigger a buffer overflow that terminates the system or corrupts process memory. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:N/I:L/A:H) confirms a local attack path with low privileges and no user interaction, so the practical gate is getting an app onto the target device; there is no confidentiality impact. No public exploit has been identified at time of analysis, EPSS is only 0.22% (12th percentile) and CISA SSVC records exploitation as none with automatable: no, so this is a moderate-severity, patch-on-normal-cadence item rather than an emergency.
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2. Processing a maliciously crafted font may result in the disclosure of process memory.
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory.
A privacy issue was addressed by moving sensitive data to a protected location. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An app may be able to identify what other apps a user has installed.
Moderate-severity local authorization flaws in Apple's operating systems allow an installed app with low privileges to read sensitive user data without proper authorization on iOS/iPadOS before 26.7.2 or 27.2, macOS before 15.8.2, 26.7.2, or 27.2, and tvOS, visionOS, and watchOS before 27.2. The issue is CWE-862 missing authorization involving improper state management, and only confidentiality is affected (CVSS 5.5). No public exploit was identified at time of analysis; EPSS is 0.24% (15th percentile), the vuln.today priority is this_month, and vendor patches are available.
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.
Information disclosure in Apple iOS and iPadOS before 27.2 allows a malicious, trojanized, or otherwise compromised app already running on the device to access sensitive user data that should be protected by the platform sandbox. The underlying flaw is a CWE-843 type confusion that Apple addressed with improved checks; exploitation is local and requires app-level privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). No public exploit was identified at time of analysis, EPSS is 0.17% (7th percentile), and the issue is rated moderate severity rather than an emergency; Apple has released iOS 27.2 and iPadOS 27.2 as the fix.
This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An app may be able to fingerprint the user.
A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted message may lead to a denial-of-service.
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.
Apps running locally on unpatched Apple platforms can reach sensitive user data that the operating system's permission boundary is supposed to withhold, with impact limited to confidentiality (C:H, I:N, A:N). Affected software includes iOS and iPadOS before 26.7.2 and before 27.2, macOS Sequoia before 15.8.2, macOS Tahoe before 26.7.2, macOS Golden Gate before 27.2, visionOS before 27.2 and watchOS before 27.2; the CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N means the attacker must already have app-level code executing on the device and needs no further user interaction. No public exploit has been identified at time of analysis and EPSS is low at 0.22% (13th percentile), which together with the this_month priority label points to a moderate, routine patching item rather than an emergency; the specific permission boundary that is bypassed is not described in the available sources, and the flaw yields no code execution, data modification or denial of service.
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination or corrupt kernel memory.
This issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. A remote attacker may be able to break out of Web Content sandbox.
Local low-privileged apps on unpatched Apple iOS, iPadOS, and macOS devices can exploit an improper authorization and state-management weakness to read sensitive user data outside their intended access. The flaw affects releases before iOS 27, iPadOS 27, and macOS Golden Gate 27, and Apple has shipped fixes in those versions. No public exploit identified at time of analysis, and CISA SSVC rates exploitation as none with non-automatable attack potential, keeping this a moderate local-risk issue rather than a remotely exploitable one.
An out-of-bounds read in Apple's image-handling code across iOS/iPadOS, macOS, tvOS, visionOS, and watchOS can cause unexpected process termination when a maliciously crafted image is processed. All platform releases prior to version 27 are affected; the flaw is fixed in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. Attackers must convince a victim to open, preview, or render the crafted image (CVSS UI:R, PR:N), and the impact is bounded to a crash (A:L only, C:N/I:N) - no public exploit code or active exploitation has been identified at time of analysis, and CISA SSVC rates exploitation as none and automatable as no, making this a low-priority availability issue.
Denial-of-service in Apple's iOS and iPadOS (26.x releases before 26.7, and versions before 27) allows an attacker who already holds a privileged on-path network position to degrade or halt availability on the target device; there is no confidentiality or integrity impact (CVSS 5.9, C:N/I:N/A:H, AC:H/PR:N/UI:N). Exploitation is gated by the on-path precondition - the attacker must already sit on the traffic path as a man-in-the-middle - so this cannot be triggered by an arbitrary remote Internet attacker against a device behind normal network boundaries, and no public exploit code was identified at time of analysis. Affected devices are fixed by updating to iOS/iPadOS 26.7 or 27.
Double-free memory corruption in Apple's iOS/iPadOS, macOS, tvOS, visionOS and watchOS lets a locally installed app trigger an unexpected system termination by driving a vulnerable system code path - a crash-only denial of service with no confidentiality or integrity impact per the assessed vector. The flaw affects every release prior to the fixed builds (iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7 and macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27) and requires the attacker to already be running code as an app on the device, so it is neither remotely reachable nor automatable (CISA SSVC: Exploitation none, Automatable no, Technical Impact partial). No public exploit code was identified at time of analysis, and Apple has shipped vendor fixes; this is a moderate, availability-only issue rather than an urgent patching priority.
Unexpected process termination in Apple iOS, iPadOS, and macOS image handling can be triggered when a user processes a maliciously crafted image, affecting iOS/iPadOS before 26.7 and before 27 and macOS before Sequoia 15.8, Tahoe 26.7, and Golden Gate 27. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, so the victim must interact with the image and the only assessed impact is low availability loss, with no confidentiality or integrity impact; EPSS is 0.15% (4th percentile) and no public exploit identified at time of analysis.
Out-of-bounds read in Apple's wireless stack can crash affected devices when an unauthenticated attacker within wireless/radio proximity triggers the vulnerable code path. It affects iOS/iPadOS before 26.7 and before 27, macOS before Sequoia 15.8, Tahoe 26.7, and Golden Gate 27, plus tvOS, visionOS, and watchOS before 27; Apple has released fixed versions. No public exploit code was identified at time of analysis, and CISA SSVC rates exploitation as none and automation as no.
iOS and iPadOS devices running versions prior to 27 contain a missing-authorization defect in permission-state management that can allow an already-installed app to access sensitive user data beyond its intended sandbox. Exploitation is local (AV:L) and requires a malicious or compromised app to be present and running with low privileges (PR:L), with no additional user interaction (UI:N); confidentiality impact is high while integrity and availability are unaffected. Apple addressed the issue through improved state management in iOS 27 and iPadOS 27, and no public exploit code or CISA KEV entry was identified at time of analysis.
Denial-of-service in Apple operating systems prior to version 27 can be triggered by an attacker in physical proximity through an out-of-bounds write that corrupts memory. The flaw affects iOS and iPadOS, macOS Golden Gate, tvOS, visionOS, and watchOS, with impact limited to availability (CVSS 4.6, AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H); no code execution, data disclosure, or integrity loss is assessed. No public exploit was identified at time of analysis, and CISA SSVC rates exploitation as none and automatable as no.
An out-of-bounds write in Apple's iOS/iPadOS and macOS code lets an app already running on the device trigger an unexpected system termination, so the realistic impact is a local denial of service rather than code execution or data compromise. Affected are iOS and iPadOS before 26.7, macOS Sequoia before 15.8, and macOS Tahoe before 26.7; Apple fixed the flaw with improved bounds checking and published advisories 149041-149043. Exploitation is not confirmed (not in CISA KEV), no public exploit code has been identified, and EPSS is 0.15% (4th percentile), consistent with a moderate-severity, low-urgency issue; the prerequisite of already executing code on the device limits exposure.
Local code execution on iOS and iPadOS (before 26.7 and the 27 line), macOS Golden Gate (before 27), and visionOS (before 27) can let an attacker-controlled app process overwrite restricted files, breaking file-system integrity protections. The issue is an improper privilege-management and permissions-validation weakness (CWE-269) scored 6.2 with a local-only vector (AV:L/AC:L/PR:N/UI:N), so it is unauthenticated once code is running but cannot be reached remotely - a malicious or sideloaded app must first execute on the device. No public exploit identified at time of analysis and no KEV confirmation; Apple has released vendor patches in iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, macOS Golden Gate 27, and visionOS 27.
Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS before version 27 contain an out-of-bounds write in image handling that can terminate the affected app when it processes a maliciously crafted image. The flaw is remotely reachable without authentication but requires victim interaction to open, preview, or render the image, and the assessed impact is availability-only (CVSS 4.3, UI:R, A:L). No public exploit identified at time of analysis; EPSS is 0.15% (4th percentile), CISA SSVC exploitation is none, and vendor fixes are available in version 27.
A use-after-free memory-safety flaw in Apple's media file processing affects iOS/iPadOS, macOS, tvOS, visionOS, and watchOS builds prior to the fixed releases (iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8 / Tahoe 26.7 / Golden Gate 27, tvOS 27, visionOS 27, watchOS 27). Processing a maliciously crafted media file can cause unexpected app termination or corruption of process memory; the assessed outcome is limited to availability and partial integrity impact, with no confirmed code execution or data disclosure. Apple addressed the issue through improved memory management, and there is no public exploit identified at time of analysis, with a low EPSS score (0.17%) consistent with the required user interaction (CVSS vector AV:N/AC:L/PR:N/UI:R) and constrained impact.
An out-of-bounds write in Apple's operating systems (iOS/iPadOS, macOS, tvOS, visionOS, watchOS) allows an attacker within wireless radio range to crash or unexpectedly terminate the system. No authentication or user interaction is required, but the impact is limited to denial of service - there is no memory disclosure or code execution. Unpatched devices below iOS/iPadOS 26.7 or 27, macOS Sequoia 15.8 / Tahoe 26.7 / Golden Gate 27, and tvOS/visionOS/watchOS 27 remain affected; no public exploit code or active exploitation has been identified, and EPSS is low (0.18%, 7th percentile) with CISA SSVC reporting no exploitation and low automatability.
Local information disclosure in Apple's OS 27 line (iOS/iPadOS, macOS Golden Gate, tvOS, visionOS, watchOS) allows an app already installed and running on the device to reach sensitive user data that should have been off-limits to it. Apple fixed the flaw with 'improved access restrictions' in the 27 releases, so any device still on an earlier build of these platforms remains exposed to an attacker who can first get code executing locally (AV:L, PR:L, UI:N); impact is confidentiality-only, with no integrity or availability effect. No public exploit has been identified at time of analysis, EPSS is low at 0.16% (5th percentile), and the flaw is not in CISA KEV, making this a this_month priority rather than an emergency.
Improper access-control validation in Apple's operating systems lets a locally installed app read protected user data that should be off-limits to it. The flaw affects iOS and iPadOS before 27, macOS Tahoe before 26.7 and macOS Golden Gate before 27, and visionOS before 27; exploitation requires an attacker to first get a crafted app onto the device, since the vector is local with low privileges (AV:L/PR:L) and no user interaction beyond launching the app (UI:N). Impact is confidentiality-only (C:H/I:N/A:N) with a CVSS base score of 5.5, EPSS is low at 0.16% (5th percentile), CISA SSVC records no exploitation, and no public exploit code has been identified at time of analysis.
Digital ID authentication on a locked iPhone can be bypassed by an attacker with physical access when an iPhone Mirroring session is already active. The flaw is an improper-authentication and state-management issue rated CVSS 2.0 because exploitation requires device possession, a locked state, and the non-default condition of active mirroring, affecting iOS and iPadOS before version 27. Apple released fixes in iOS 27 and iPadOS 27; no public exploit is identified at time of analysis, no active exploitation is indicated by CISA KEV or SSVC, and EPSS is 0.19% (8th percentile).
A type confusion flaw (CWE-843) in memory handling across Apple's current operating system family lets a malicious app crash the affected device or component, producing a local denial of service. Exploitation requires the victim to install and launch a crafted app — the CVSS vector is AV:L/PR:N/UI:R with availability-only impact, so there is no remote unauthenticated path and no confidentiality or integrity loss. Apple has shipped fixes in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7 and macOS Golden Gate 27, plus tvOS 27, visionOS 27 and watchOS 27; EPSS is only 0.17% (6th percentile) and there is no public exploit identified at time of analysis, so this is a routine patch-cycle item rather than an urgent exposure.
An out-of-bounds write in Apple's operating system memory handling lets a process already confined to the platform sandbox break out of those restrictions, gaining partial read and write access to data it should not reach. Affected platforms are iOS and iPadOS before 26.7/27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, visionOS before 27 and watchOS before 27. Apple has released fixes for every affected platform, and CISA's SSVC assessment records no exploitation, no automation and only partial technical impact.
An information-disclosure flaw in Apple's WebKit-based browser stack lets a malicious website infer which applications a user has installed across Safari, iOS/iPadOS, and macOS. Apple addressed it through improved state management in Safari 27, iOS 27 and iPadOS 27, and macOS Golden Gate 27, so any device still on an earlier release remains exposed. Exploitation requires the victim to visit the attacker's page (CVSS UI:R) and yields only low-confidentiality impact, with no public exploit code and no CISA KEV listing at time of analysis.
Archive extraction on Apple platforms fails to properly validate path components, letting a maliciously crafted archive write files outside the intended destination directory. Affected systems include iOS and iPadOS before 26.7 (and before 27), macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, and visionOS before 27, with the flaw rated CVSS 5.5 (integrity-only, local vector with required user interaction). Apple has released patched versions for every affected platform; there is no CISA KEV listing and no public exploit code identified, and EPSS is only 0.18% (7th percentile), indicating low predicted exploitation activity.
Local information disclosure in Apple iOS and iPadOS (and visionOS) before version 27 allows an app running on the device to read sensitive user data it should not be able to reach. Apple fixed the flaw through improved file handling in iOS 27, iPadOS 27 and visionOS 27. No public exploit code or active exploitation has been reported, and the EPSS score of 0.15% (5th percentile) plus SSVC 'exploitation: none' point to a low-volume, user-assisted local attack rather than a mass-exploited one.
A path validation weakness in Apple's iOS, iPadOS, and macOS allows a malicious application to reach files outside its intended sandbox and read user-sensitive data. Apple addressed the flaw with improved path validation in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, and macOS Sequoia 15.8, so all older releases remain exposed until updated. Exploitation requires a locally installed app and some user interaction (CVSS AV:L/UI:R), exploit probability is currently very low (EPSS 0.20%, 10th percentile), and no public exploit code or CISA KEV entry has been identified at time of analysis.
Apple fixed a kernel uninitialized-memory flaw (CWE-457) across iOS/iPadOS, macOS, tvOS, visionOS, and watchOS in which a locally installed app can determine kernel memory layout, defeating address-space randomization. The impact is information disclosure only - high confidentiality, no integrity or availability impact - and exploitation requires a local app plus user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R, 5.5). Apple shipped patches on [dates not specified] for iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27; no public exploit code or active exploitation is indicated, and EPSS is low (0.21%, 11th percentile).
A race condition in Apple's kernel state handling lets a locally installed app corrupt kernel memory or trigger unexpected system termination across iOS/iPadOS, macOS, tvOS, visionOS, and watchOS. Apple addressed the flaw in iOS 18.7.10 and 26.6, iPadOS 18.7.10 and 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, and tvOS/visionOS/watchOS 26.6, so exploitation is limited to unpatched devices running a malicious app plus user interaction. No public exploit code and no active exploitation are known; EPSS is 0.17% (6th percentile) and CVSS rates it 6.3, reflecting a local, high-complexity attack with no confidentiality impact.
A race condition in core Apple operating system components lets a locally installed app trigger an unexpected system termination on iOS, iPadOS, macOS, tvOS, visionOS and watchOS. Apple fixed the flaw through improved state handling in iOS 26.7/27, iPadOS 26.7/27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27. Impact is availability-only (no data exposure or modification), exploitation requires a local malicious app and winning a timing window, EPSS is a low 0.21%, and no public exploit code or active exploitation has been identified at time of analysis.
Improper access control in Apple's Keychain service lets a locally installed app delete credentials stored by other applications on iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27 (all versions prior to these releases). The bug is fixed by removing the vulnerable code path; it is rated CVSS 5.5 with integrity-only impact, and there is no public exploit or CISA KEV confirmation at time of analysis (EPSS 0.15%).
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. The user's original email address may be leaked when using the Hide My Email feature.
An out-of-bounds read in Apple's image-handling code lets a maliciously crafted image terminate the affected application when a user opens or renders it, affecting iOS and iPadOS, macOS and visionOS. Impact is confined to availability (C:N/I:N/A:H) and requires the victim to process the file (UI:R) with no authentication needed (PR:N); exploitation is limited to builds older than iOS/iPadOS 26.7.2 and 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, macOS Golden Gate 27.2 and visionOS 27.2. No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and EPSS is 0.60% (49th percentile); the realistic ceiling is denial of service, not data exposure or code execution.
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to access sensitive user data.
A local authorization-check flaw in Apple iOS and iPadOS before 27.2 lets an already-installed app reach sensitive user data it should not be able to read. Devices running versions prior to 27.2 are affected; the vendor addressed the issue with improved checks and released 27.2 as the fix. Exploitation requires a malicious or compromised app to be installed and running on the device, with no user interaction needed beyond that app executing. Severity is moderate (CVSS 5.5, local vector, high confidentiality impact only), EPSS is low at 0.18% (8th percentile), and no public exploit code or active exploitation is identified in the available data.
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted image may result in disclosure of process memory.
An out-of-bounds write in Apple's image-processing path causes affected iOS, iPadOS and macOS systems to terminate an application when a maliciously crafted image is processed, giving an attacker a denial-of-service effect against a targeted app. The flaw affects iOS and iPadOS before 26.7.2 and before 27.2, plus macOS Sequoia before 15.8.2, macOS Tahoe before 26.7.2 and macOS Golden Gate before 27.2; no authentication or prior privilege is needed, but a victim must be induced to open the crafted image (UI:R), and the confirmed impact is availability only, with no disclosed code execution or data exposure. EPSS is low at 0.55% (46th percentile), SSVC records no known exploitation and no automatable path, and no public exploit identified at time of analysis; Apple has released fixed versions for every affected branch.
A logic issue was addressed with improved checks. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27. An attacker with physical access may be able to access contacts from the lock screen.
An integer underflow was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciously crafted image may result in memory corruption.
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted 3D model may lead to memory corruption.
A race condition in Apple's operating system stack allows an app already running on the device to read sensitive user data that it should not be able to reach; Apple addressed it by adding validation, shipping fixes in iOS/iPadOS 26.7.2 and 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, and visionOS 27.2. The issue is scored CVSS 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning the attacker needs local code execution and must win a timing-dependent race, with impact limited to confidentiality. No public exploit has been identified at time of analysis, EPSS is 0.21% (11th percentile), and the CVE is not listed in CISA KEV, so this is a genuine but low-urgency issue rather than a drop-everything emergency.
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2. An app may be able to cause unexpected system termination or write kernel memory.
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.
An out-of-bounds write (CWE-787) in Apple's operating systems - iOS and iPadOS, macOS Sequoia, macOS Tahoe, macOS Golden Gate, and visionOS - allows a crafted or malicious app, or attacker-supplied content that a user interacts with, to trigger memory corruption and unexpected system termination. The impact is availability-focused: the supplied vector (PR:N/UI:R, C:N/I:N/A:H) and the independent assessment agree that confidentiality and integrity are not confirmed as affected, while system stability and process memory are. There is no KEV listing and no public exploit code identified at time of analysis, EPSS is low at 0.55% (46th percentile), and CISA SSVC rates exploitation as none and automatable as no, so this is routine patch-cycle work rather than an emergency; Apple fixed it with improved input validation across all current branches.
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may result in the disclosure of process memory.
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted file may lead to unexpected app termination.
A heap buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An attacker in radio range may be able to cause unexpected system termination.
The issue was addressed with improved memory handling. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory.
Missing authorization checks in Apple's operating systems let a locally installed app reach sensitive user data that should be walled off behind a permission boundary, affecting iOS and iPadOS before 26.7.2 (and the 27.x branch before 27.2), plus tvOS, visionOS and watchOS before 27.2. The exposure is confidentiality-only (C:H, no integrity or availability impact), scoped to devices where a malicious or abused app is already running locally, and Apple states the flaw was fixed by adding additional restrictions to the permission logic. Scoring is medium (CVSS 5.5) with a low EPSS of 0.21% (10th percentile), and no public exploit has been identified at time of analysis, so this is a real-but-not-urgent issue that fits a routine monthly update cadence.
An out-of-bounds write (CWE-787) in Apple's image-processing code affects iOS and iPadOS before 26.7.2 and 27.2 and macOS Golden Gate before 27.2 and macOS Tahoe before 26.7.2; opening or otherwise causing a maliciously crafted image to be processed can crash the affected app, yielding a denial of service scored CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Exploitation requires user interaction - the victim must cause the image to be processed - so this is not a zero-click remote attack on default configurations, and the assessed impact is limited to unexpected app termination with no confidentiality or integrity loss. No public exploit is identified at time of analysis: SSVC records Exploitation: none and there is no KEV entry, though EPSS sits at 0.50% (42nd percentile); Apple has released fixed builds and the vendor cites improved bounds checking.
A null pointer dereference was addressed with improved validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An attacker in physical proximity may be able to cause a denial-of-service.
An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An app may be able to fingerprint the user.
This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27. An app may be able to modify protected parts of the file system.
A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to disclose kernel memory.
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted font may result in the disclosure of process memory.
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.
A logic issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27. An app may be able to access sensitive user data.
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2. An attacker in radio range may be able to cause unexpected system termination.
An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An app may be able to read the device's name.
Processing a maliciously crafted image on unpatched Apple devices can terminate the affected application, giving a denial-of-service condition on iOS/iPadOS, macOS, and visionOS. The flaw is an out-of-bounds read (CWE-125) that Apple addressed with improved bounds checking in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, and visionOS 27.2. The vector (AV:N/AC:L/PR:N/UI:R, C:N/I:N/A:H) means a remote attacker needs the victim to open or render the image, with no authentication; impact is limited to app termination and there is no public exploit identified at time of analysis, with EPSS at 0.58% (48th percentile) and CISA SSVC recording no exploitation and no automatable path.
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents.
A null pointer dereference was addressed with improved validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An attacker in physical proximity may be able to cause a denial-of-service.
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or write kernel memory.
This issue was addressed with improved input validation. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2. Processing maliciously crafted web content may lead to an unexpected process crash.
Local apps on Apple iOS and iPadOS and on visionOS can reach sensitive user data that should be outside their access boundary, because access restrictions were insufficient in versions prior to 27.2. The flaw is a moderate-severity local access-control weakness: an attacker must already have a malicious or compromised app installed and running on the device, and the resulting impact is limited to confidentiality (data disclosure) with no modification or availability effect. Apple addressed it in iOS 27.2, iPadOS 27.2 and visionOS 27.2; EPSS is 0.20% (10th percentile), there is no CISA KEV entry, and no public exploit has been identified at the time of analysis.
A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.
Local apps on Apple iOS, iPadOS, and macOS before 27.2 can leverage insufficient input validation to access sensitive user data that should not be available to them. The issue requires a malicious or malformed app already installed and executing on the device (CVSS AV:L/PR:L, no user interaction) and does not provide a remote or network attack path. Apple fixed it in iOS 27.2, iPadOS 27.2, and macOS Golden Gate 27.2; no public exploit identified at time of analysis, and EPSS is 0.20%.
A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted image may result in disclosure of process memory.
This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27. An app may be able to access sensitive user data.
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted video file may lead to unexpected app termination.
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted calendar invitation may lead to memory corruption.
This issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. A malicious application may be able to bypass Privacy preferences.
A race condition was addressed with improved state handling. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27. An app may be able to cause unexpected system termination.
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Processing a maliciously crafted image may lead to arbitrary code execution.
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to an unexpected process termination.
An out-of-bounds write in Apple's image handling on iOS/iPadOS, macOS and visionOS can terminate the affected application when a user opens a maliciously crafted image, giving an availability-only denial-of-service outcome (CVSS 6.5, C:N/I:N/A:H). The attacker cannot trigger the fault directly: exploitation requires the victim to process the crafted file in an affected app, as reflected by the UI:R vector component, and macOS is affected across three branches (Sequoia before 15.8.2, Tahoe before 26.7.2, Golden Gate before 27.2) while iOS/iPadOS is affected before 26.7.2 and before 27.2 and visionOS before 27.2. Apple has released fixes for all listed platforms with improved bounds checking; no public exploit identified at time of analysis, EPSS is 0.58% (48th percentile), and CISA SSVC rates exploitation as none with partial technical impact, making this a moderate, not top-tier, priority.
The issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted image may result in disclosure of process memory.
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious USB device may be able to cause unexpected system termination or read kernel memory.
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to an unexpected process termination.
Memory corruption in Apple's mobile and desktop operating systems (iOS/iPadOS, macOS, tvOS, visionOS, watchOS) allows an app already executing on the device to trigger a buffer overflow that terminates the system or corrupts process memory. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:N/I:L/A:H) confirms a local attack path with low privileges and no user interaction, so the practical gate is getting an app onto the target device; there is no confidentiality impact. No public exploit has been identified at time of analysis, EPSS is only 0.22% (12th percentile) and CISA SSVC records exploitation as none with automatable: no, so this is a moderate-severity, patch-on-normal-cadence item rather than an emergency.
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2. Processing a maliciously crafted font may result in the disclosure of process memory.
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory.
A privacy issue was addressed by moving sensitive data to a protected location. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An app may be able to identify what other apps a user has installed.
Moderate-severity local authorization flaws in Apple's operating systems allow an installed app with low privileges to read sensitive user data without proper authorization on iOS/iPadOS before 26.7.2 or 27.2, macOS before 15.8.2, 26.7.2, or 27.2, and tvOS, visionOS, and watchOS before 27.2. The issue is CWE-862 missing authorization involving improper state management, and only confidentiality is affected (CVSS 5.5). No public exploit was identified at time of analysis; EPSS is 0.24% (15th percentile), the vuln.today priority is this_month, and vendor patches are available.
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.
Information disclosure in Apple iOS and iPadOS before 27.2 allows a malicious, trojanized, or otherwise compromised app already running on the device to access sensitive user data that should be protected by the platform sandbox. The underlying flaw is a CWE-843 type confusion that Apple addressed with improved checks; exploitation is local and requires app-level privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). No public exploit was identified at time of analysis, EPSS is 0.17% (7th percentile), and the issue is rated moderate severity rather than an emergency; Apple has released iOS 27.2 and iPadOS 27.2 as the fix.
This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An app may be able to fingerprint the user.
A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted message may lead to a denial-of-service.
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.
Apps running locally on unpatched Apple platforms can reach sensitive user data that the operating system's permission boundary is supposed to withhold, with impact limited to confidentiality (C:H, I:N, A:N). Affected software includes iOS and iPadOS before 26.7.2 and before 27.2, macOS Sequoia before 15.8.2, macOS Tahoe before 26.7.2, macOS Golden Gate before 27.2, visionOS before 27.2 and watchOS before 27.2; the CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N means the attacker must already have app-level code executing on the device and needs no further user interaction. No public exploit has been identified at time of analysis and EPSS is low at 0.22% (13th percentile), which together with the this_month priority label points to a moderate, routine patching item rather than an emergency; the specific permission boundary that is bypassed is not described in the available sources, and the flaw yields no code execution, data modification or denial of service.
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination or corrupt kernel memory.
This issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. A remote attacker may be able to break out of Web Content sandbox.
Local low-privileged apps on unpatched Apple iOS, iPadOS, and macOS devices can exploit an improper authorization and state-management weakness to read sensitive user data outside their intended access. The flaw affects releases before iOS 27, iPadOS 27, and macOS Golden Gate 27, and Apple has shipped fixes in those versions. No public exploit identified at time of analysis, and CISA SSVC rates exploitation as none with non-automatable attack potential, keeping this a moderate local-risk issue rather than a remotely exploitable one.
An out-of-bounds read in Apple's image-handling code across iOS/iPadOS, macOS, tvOS, visionOS, and watchOS can cause unexpected process termination when a maliciously crafted image is processed. All platform releases prior to version 27 are affected; the flaw is fixed in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. Attackers must convince a victim to open, preview, or render the crafted image (CVSS UI:R, PR:N), and the impact is bounded to a crash (A:L only, C:N/I:N) - no public exploit code or active exploitation has been identified at time of analysis, and CISA SSVC rates exploitation as none and automatable as no, making this a low-priority availability issue.
Denial-of-service in Apple's iOS and iPadOS (26.x releases before 26.7, and versions before 27) allows an attacker who already holds a privileged on-path network position to degrade or halt availability on the target device; there is no confidentiality or integrity impact (CVSS 5.9, C:N/I:N/A:H, AC:H/PR:N/UI:N). Exploitation is gated by the on-path precondition - the attacker must already sit on the traffic path as a man-in-the-middle - so this cannot be triggered by an arbitrary remote Internet attacker against a device behind normal network boundaries, and no public exploit code was identified at time of analysis. Affected devices are fixed by updating to iOS/iPadOS 26.7 or 27.
Double-free memory corruption in Apple's iOS/iPadOS, macOS, tvOS, visionOS and watchOS lets a locally installed app trigger an unexpected system termination by driving a vulnerable system code path - a crash-only denial of service with no confidentiality or integrity impact per the assessed vector. The flaw affects every release prior to the fixed builds (iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7 and macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27) and requires the attacker to already be running code as an app on the device, so it is neither remotely reachable nor automatable (CISA SSVC: Exploitation none, Automatable no, Technical Impact partial). No public exploit code was identified at time of analysis, and Apple has shipped vendor fixes; this is a moderate, availability-only issue rather than an urgent patching priority.
Unexpected process termination in Apple iOS, iPadOS, and macOS image handling can be triggered when a user processes a maliciously crafted image, affecting iOS/iPadOS before 26.7 and before 27 and macOS before Sequoia 15.8, Tahoe 26.7, and Golden Gate 27. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, so the victim must interact with the image and the only assessed impact is low availability loss, with no confidentiality or integrity impact; EPSS is 0.15% (4th percentile) and no public exploit identified at time of analysis.
Out-of-bounds read in Apple's wireless stack can crash affected devices when an unauthenticated attacker within wireless/radio proximity triggers the vulnerable code path. It affects iOS/iPadOS before 26.7 and before 27, macOS before Sequoia 15.8, Tahoe 26.7, and Golden Gate 27, plus tvOS, visionOS, and watchOS before 27; Apple has released fixed versions. No public exploit code was identified at time of analysis, and CISA SSVC rates exploitation as none and automation as no.
iOS and iPadOS devices running versions prior to 27 contain a missing-authorization defect in permission-state management that can allow an already-installed app to access sensitive user data beyond its intended sandbox. Exploitation is local (AV:L) and requires a malicious or compromised app to be present and running with low privileges (PR:L), with no additional user interaction (UI:N); confidentiality impact is high while integrity and availability are unaffected. Apple addressed the issue through improved state management in iOS 27 and iPadOS 27, and no public exploit code or CISA KEV entry was identified at time of analysis.
Denial-of-service in Apple operating systems prior to version 27 can be triggered by an attacker in physical proximity through an out-of-bounds write that corrupts memory. The flaw affects iOS and iPadOS, macOS Golden Gate, tvOS, visionOS, and watchOS, with impact limited to availability (CVSS 4.6, AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H); no code execution, data disclosure, or integrity loss is assessed. No public exploit was identified at time of analysis, and CISA SSVC rates exploitation as none and automatable as no.
An out-of-bounds write in Apple's iOS/iPadOS and macOS code lets an app already running on the device trigger an unexpected system termination, so the realistic impact is a local denial of service rather than code execution or data compromise. Affected are iOS and iPadOS before 26.7, macOS Sequoia before 15.8, and macOS Tahoe before 26.7; Apple fixed the flaw with improved bounds checking and published advisories 149041-149043. Exploitation is not confirmed (not in CISA KEV), no public exploit code has been identified, and EPSS is 0.15% (4th percentile), consistent with a moderate-severity, low-urgency issue; the prerequisite of already executing code on the device limits exposure.
Local code execution on iOS and iPadOS (before 26.7 and the 27 line), macOS Golden Gate (before 27), and visionOS (before 27) can let an attacker-controlled app process overwrite restricted files, breaking file-system integrity protections. The issue is an improper privilege-management and permissions-validation weakness (CWE-269) scored 6.2 with a local-only vector (AV:L/AC:L/PR:N/UI:N), so it is unauthenticated once code is running but cannot be reached remotely - a malicious or sideloaded app must first execute on the device. No public exploit identified at time of analysis and no KEV confirmation; Apple has released vendor patches in iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, macOS Golden Gate 27, and visionOS 27.
Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS before version 27 contain an out-of-bounds write in image handling that can terminate the affected app when it processes a maliciously crafted image. The flaw is remotely reachable without authentication but requires victim interaction to open, preview, or render the image, and the assessed impact is availability-only (CVSS 4.3, UI:R, A:L). No public exploit identified at time of analysis; EPSS is 0.15% (4th percentile), CISA SSVC exploitation is none, and vendor fixes are available in version 27.
A use-after-free memory-safety flaw in Apple's media file processing affects iOS/iPadOS, macOS, tvOS, visionOS, and watchOS builds prior to the fixed releases (iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8 / Tahoe 26.7 / Golden Gate 27, tvOS 27, visionOS 27, watchOS 27). Processing a maliciously crafted media file can cause unexpected app termination or corruption of process memory; the assessed outcome is limited to availability and partial integrity impact, with no confirmed code execution or data disclosure. Apple addressed the issue through improved memory management, and there is no public exploit identified at time of analysis, with a low EPSS score (0.17%) consistent with the required user interaction (CVSS vector AV:N/AC:L/PR:N/UI:R) and constrained impact.
An out-of-bounds write in Apple's operating systems (iOS/iPadOS, macOS, tvOS, visionOS, watchOS) allows an attacker within wireless radio range to crash or unexpectedly terminate the system. No authentication or user interaction is required, but the impact is limited to denial of service - there is no memory disclosure or code execution. Unpatched devices below iOS/iPadOS 26.7 or 27, macOS Sequoia 15.8 / Tahoe 26.7 / Golden Gate 27, and tvOS/visionOS/watchOS 27 remain affected; no public exploit code or active exploitation has been identified, and EPSS is low (0.18%, 7th percentile) with CISA SSVC reporting no exploitation and low automatability.
Local information disclosure in Apple's OS 27 line (iOS/iPadOS, macOS Golden Gate, tvOS, visionOS, watchOS) allows an app already installed and running on the device to reach sensitive user data that should have been off-limits to it. Apple fixed the flaw with 'improved access restrictions' in the 27 releases, so any device still on an earlier build of these platforms remains exposed to an attacker who can first get code executing locally (AV:L, PR:L, UI:N); impact is confidentiality-only, with no integrity or availability effect. No public exploit has been identified at time of analysis, EPSS is low at 0.16% (5th percentile), and the flaw is not in CISA KEV, making this a this_month priority rather than an emergency.
Improper access-control validation in Apple's operating systems lets a locally installed app read protected user data that should be off-limits to it. The flaw affects iOS and iPadOS before 27, macOS Tahoe before 26.7 and macOS Golden Gate before 27, and visionOS before 27; exploitation requires an attacker to first get a crafted app onto the device, since the vector is local with low privileges (AV:L/PR:L) and no user interaction beyond launching the app (UI:N). Impact is confidentiality-only (C:H/I:N/A:N) with a CVSS base score of 5.5, EPSS is low at 0.16% (5th percentile), CISA SSVC records no exploitation, and no public exploit code has been identified at time of analysis.
Digital ID authentication on a locked iPhone can be bypassed by an attacker with physical access when an iPhone Mirroring session is already active. The flaw is an improper-authentication and state-management issue rated CVSS 2.0 because exploitation requires device possession, a locked state, and the non-default condition of active mirroring, affecting iOS and iPadOS before version 27. Apple released fixes in iOS 27 and iPadOS 27; no public exploit is identified at time of analysis, no active exploitation is indicated by CISA KEV or SSVC, and EPSS is 0.19% (8th percentile).
A type confusion flaw (CWE-843) in memory handling across Apple's current operating system family lets a malicious app crash the affected device or component, producing a local denial of service. Exploitation requires the victim to install and launch a crafted app — the CVSS vector is AV:L/PR:N/UI:R with availability-only impact, so there is no remote unauthenticated path and no confidentiality or integrity loss. Apple has shipped fixes in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7 and macOS Golden Gate 27, plus tvOS 27, visionOS 27 and watchOS 27; EPSS is only 0.17% (6th percentile) and there is no public exploit identified at time of analysis, so this is a routine patch-cycle item rather than an urgent exposure.
An out-of-bounds write in Apple's operating system memory handling lets a process already confined to the platform sandbox break out of those restrictions, gaining partial read and write access to data it should not reach. Affected platforms are iOS and iPadOS before 26.7/27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, visionOS before 27 and watchOS before 27. Apple has released fixes for every affected platform, and CISA's SSVC assessment records no exploitation, no automation and only partial technical impact.
An information-disclosure flaw in Apple's WebKit-based browser stack lets a malicious website infer which applications a user has installed across Safari, iOS/iPadOS, and macOS. Apple addressed it through improved state management in Safari 27, iOS 27 and iPadOS 27, and macOS Golden Gate 27, so any device still on an earlier release remains exposed. Exploitation requires the victim to visit the attacker's page (CVSS UI:R) and yields only low-confidentiality impact, with no public exploit code and no CISA KEV listing at time of analysis.
Archive extraction on Apple platforms fails to properly validate path components, letting a maliciously crafted archive write files outside the intended destination directory. Affected systems include iOS and iPadOS before 26.7 (and before 27), macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, and visionOS before 27, with the flaw rated CVSS 5.5 (integrity-only, local vector with required user interaction). Apple has released patched versions for every affected platform; there is no CISA KEV listing and no public exploit code identified, and EPSS is only 0.18% (7th percentile), indicating low predicted exploitation activity.
Local information disclosure in Apple iOS and iPadOS (and visionOS) before version 27 allows an app running on the device to read sensitive user data it should not be able to reach. Apple fixed the flaw through improved file handling in iOS 27, iPadOS 27 and visionOS 27. No public exploit code or active exploitation has been reported, and the EPSS score of 0.15% (5th percentile) plus SSVC 'exploitation: none' point to a low-volume, user-assisted local attack rather than a mass-exploited one.
A path validation weakness in Apple's iOS, iPadOS, and macOS allows a malicious application to reach files outside its intended sandbox and read user-sensitive data. Apple addressed the flaw with improved path validation in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, and macOS Sequoia 15.8, so all older releases remain exposed until updated. Exploitation requires a locally installed app and some user interaction (CVSS AV:L/UI:R), exploit probability is currently very low (EPSS 0.20%, 10th percentile), and no public exploit code or CISA KEV entry has been identified at time of analysis.
Apple fixed a kernel uninitialized-memory flaw (CWE-457) across iOS/iPadOS, macOS, tvOS, visionOS, and watchOS in which a locally installed app can determine kernel memory layout, defeating address-space randomization. The impact is information disclosure only - high confidentiality, no integrity or availability impact - and exploitation requires a local app plus user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R, 5.5). Apple shipped patches on [dates not specified] for iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27; no public exploit code or active exploitation is indicated, and EPSS is low (0.21%, 11th percentile).
A race condition in Apple's kernel state handling lets a locally installed app corrupt kernel memory or trigger unexpected system termination across iOS/iPadOS, macOS, tvOS, visionOS, and watchOS. Apple addressed the flaw in iOS 18.7.10 and 26.6, iPadOS 18.7.10 and 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, and tvOS/visionOS/watchOS 26.6, so exploitation is limited to unpatched devices running a malicious app plus user interaction. No public exploit code and no active exploitation are known; EPSS is 0.17% (6th percentile) and CVSS rates it 6.3, reflecting a local, high-complexity attack with no confidentiality impact.
A race condition in core Apple operating system components lets a locally installed app trigger an unexpected system termination on iOS, iPadOS, macOS, tvOS, visionOS and watchOS. Apple fixed the flaw through improved state handling in iOS 26.7/27, iPadOS 26.7/27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27. Impact is availability-only (no data exposure or modification), exploitation requires a local malicious app and winning a timing window, EPSS is a low 0.21%, and no public exploit code or active exploitation has been identified at time of analysis.
Improper access control in Apple's Keychain service lets a locally installed app delete credentials stored by other applications on iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27 (all versions prior to these releases). The bug is fixed by removing the vulnerable code path; it is rated CVSS 5.5 with integrity-only impact, and there is no public exploit or CISA KEV confirmation at time of analysis (EPSS 0.15%).