Ios And Ipados
Monthly
An out-of-bounds read in Apple's font parsing code lets a maliciously crafted font file leak process memory on unpatched builds of iOS, iPadOS, macOS, tvOS, visionOS and watchOS, with all affected platforms fixed in the version 27 releases. Triggering it requires the victim to render attacker-supplied content containing the crafted font — an email, document, web page or message preview — but no credentials or elevated privileges are needed once that interaction happens, and the resulting confidentiality impact is rated high with no integrity or availability effect. No public exploit code or active exploitation has been identified, and EPSS sits at a low 0.20% (10th percentile), so this is best handled as a scheduled platform update rather than an emergency response.
An out-of-bounds read in the font-parsing path of Apple's operating systems lets a remote attacker disclose the contents of process memory when a victim processes a maliciously crafted font. All Apple platforms are affected prior to the version 27 releases — iOS and iPadOS, macOS Golden Gate, tvOS, visionOS and watchOS — and Apple has shipped fixes for each. There is no CISA KEV listing and no public exploit code identified, and the EPSS score of 0.17% (7th percentile) indicates a low probability of near-term exploitation; because the sole impact is memory disclosure and exploitation requires the victim to open or render attacker-supplied content, this is a moderate-priority patch rather than an emergency.
Information disclosure in Apple's iOS, iPadOS, macOS, tvOS and watchOS platforms allows an app running on the device to reach sensitive user data that the operating system's data protection mechanisms were supposed to keep isolated from it. Apple resolved the issue with improved data protection in iOS and iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27 and watchOS 27, with vendor advisories published across seven support pages. No public exploit code or active exploitation has been reported, EPSS is low at 0.20% (10th percentile), and the issue is not listed in CISA KEV, so this reads as a routine hardening fix rather than an urgent emergency-patch event.
A use-after-free memory-management flaw affects Apple's operating system family prior to the 26.6 releases — iOS and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6 and watchOS 26.6 — and allows a locally installed app to trigger unexpected system termination (a denial-of-service condition). The vulnerability is rated CVSS 5.5 with a local attack vector, low complexity and low privileges required, but no confidentiality or integrity impact; EPSS is only 0.19 percent and there is no CISA KEV listing and no publicly available exploit code identified at time of analysis. Apple has shipped fixes in all four platform advisories, so the practical risk is concentrated on unpatched devices rather than on active exploitation.
Improper authorization checks in Apple's headphone motion data handling allow a locally installed app to read motion sensor data from connected headphones without prompting the user for consent, affecting iOS/iPadOS 26.7 and 27 and earlier, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27 and watchOS 27 and earlier. Exploitation requires a malicious or compromised app and user interaction, and the impact is limited to confidentiality of headphone sensor data (CVSS 5.5, C:H/I:N/A:N). Apple has shipped fixes in all affected operating systems; EPSS is low (0.20%, 10th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis.
Loading attacker-controlled web content on an unpatched Apple device can trigger a null pointer dereference in the WebKit rendering pipeline, crashing the browser or app that renders the page and producing a denial-of-service on iPhone, iPad, Mac, Apple Watch and Apple Vision Pro. Apple shipped fixes in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, visionOS 27 and watchOS 27. The flaw scores CVSS 6.5 with a user-interaction requirement (UI:R), EPSS is only 0.20% (10th percentile), and there is no public exploit code or CISA KEV listing at time of analysis.
An authorization flaw in Apple's operating systems lets a locally installed malicious app bypass Privacy preferences on affected iOS, iPadOS, and macOS builds. Apple addressed the issue through improved state management in iOS 18.7.10, iPadOS 18.7.10, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.8, and macOS Sonoma 14.8.8. The CVSS 3.1 base score is 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N), EPSS is 0.21% (11th percentile), there is no CISA KEV listing and no public exploit code identified at the time of analysis.
An out-of-bounds write in Apple's image handling code lets a maliciously crafted image crash the parsing process on affected iPhones, iPads, Macs, Apple TVs, Vision Pro and Apple Watches. Apple fixed the flaw through improved bounds checking in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27. Exploitation requires the victim to open or preview the crafted image (UI:R), the observed impact is process termination only — no code execution, data theft or tampering is described — and there is currently no public exploit code or CISA KEV listing; EPSS is a low 0.17% (7th percentile).
Connecting an Apple device to an attacker-controlled NFS server can cause the kernel NFS client to mishandle memory and return out-of-bounds kernel memory to the malicious server, an information-disclosure issue tracked as CVE-2026-43687. All shipping Apple platforms are affected — iOS/iPadOS before 26.7 and 27, macOS Tahoe before 26.7, macOS Golden Gate before 27, and tvOS, visionOS and watchOS before 27 — while the fix is distributed across Apple's 26.7/27 update wave. Exploitation requires the victim to initiate a connection to the hostile server (UI:R), which keeps real-world risk moderate: EPSS is only 0.18% (7th percentile), CISA KEV does not list it, SSVC rates exploitation as 'none' and automatable as 'no', and no public exploit code was identified at time of analysis.
A buffer overflow in multiple Apple operating systems — iOS 18.7.10, iPadOS 18.7.10, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.8, and macOS Sonoma 14.8.8 and earlier — allows a locally executing app to crash the affected system or process, producing a denial of service. The flaw stems from insufficient bounds checking (CWE-120) and is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N, availability-only impact), meaning an attacker must already have the ability to run code as a low-privileged app on the device. Apple has released patches and there is no CISA KEV listing, no public exploit code identified, and EPSS is low at 0.21% (12th percentile), so real-world exploitation pressure is currently minimal.
An out-of-bounds write in Apple's operating system kernel (CWE-787) allows a locally installed app to corrupt kernel memory or force an unexpected system termination, affecting iOS/iPadOS, macOS, tvOS, visionOS, and watchOS. Apple fixed the flaw with improved bounds checking in iOS 26.7 and 27, iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. Exploitation requires a local app (CVSS PR:L) with no user interaction, so real-world risk is currently low - EPSS is only 0.21% (11th percentile), the issue is not listed in CISA KEV, and no public exploit code has been identified.
A race condition in Apple's state-handling code allows a locally installed app to crash the system or cause unexpected termination of system processes on iOS, iPadOS, macOS, tvOS, visionOS and watchOS. The flaw carries a CVSS 3.1 score of 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) — availability-only impact, local attack vector, high complexity — and is fixed in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, and tvOS, visionOS and watchOS 27. Neither public exploit code nor CISA KEV activity has been recorded, and EPSS puts exploitation probability at roughly 0.2% (10th percentile), so this is a patching-hygiene item rather than an emergency.
Universal cross-site scripting (UXSS) in Apple Safari and WebKit on iOS, iPadOS, macOS, and visionOS below version 27 allows an attacker to inject script into the context of any site once a victim opens a maliciously crafted .webarchive file. The root cause is a logic/state-management issue in webarchive handling (CWE-79); exploitation requires user interaction (UI:R) to deliver and open the file, and there are no authentication prerequisites (PR:N), as reflected in the independently assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and EPSS is low at 0.15% (4th percentile), though the UXSS scope change and high confidentiality/integrity impact make patching important.
Mounting a maliciously crafted disk image on unpatched Apple devices triggers an out-of-bounds write in image-parsing code, leading to memory corruption and unexpected system termination (denial of service). Affected platforms include iOS/iPadOS before 26.7 and 27, and macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27. Apple has shipped fixes in iOS 26.7/27, iPadOS 26.7/27, and the corresponding macOS releases; no public exploit code or active exploitation has been identified, and EPSS is negligible at 0.17% (7th percentile), indicating a low-likelihood, availability-only defect.
Kernel memory disclosure in Apple's client operating systems - iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.8 and macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6 - allows a locally installed, low-privilege application to read portions of kernel memory that should have been redacted, leaking sensitive data from kernel address space. The flaw is rated CVSS 3.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and is bounded to confidentiality loss with no integrity or availability impact and no arbitrary kernel read. There is no public exploit identified at time of analysis, EPSS is only 0.20% (10th percentile), and the issue is not in CISA KEV; Apple has released fixes across all affected platforms. Because the attacker must already have a malicious or compromised app installed and running on the device, this is best treated as a low-priority information-disclosure building block rather than a standalone compromise path.
Denial of service in Apple iOS, iPadOS, and macOS results from an integer overflow (CWE-190) that a locally installed and executing application can trigger to cause unexpected system termination. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.5) confirms local access with low privileges, no user interaction, and impact limited to availability - there is no confidentiality or integrity loss and no remote or network-triggerable path. This is a genuinely low-priority issue despite its MEDIUM rating: EPSS is 0.20% (10th percentile), no public exploit code was identified at time of analysis, there is no CISA KEV listing, and Apple has shipped fixed versions (iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27), leaving exposure limited to unpatched devices on which an attacker can already run code.
Information disclosure in Apple iOS and iPadOS (versions before 26.7 and before 27) lets a locally installed app determine which other apps the user has installed, exposing a device-fingerprinting and privacy surface rather than files, credentials, or user data. The root cause is a state-management defect (CWE-200) that Apple fixed in iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27. Exploitation requires the victim to install and run a malicious sandboxed app on the target device (CVSS AV:L, PR:L), so there is no remote or unauthenticated path; no public exploit code has been identified at time of analysis, and EPSS is 0.17% (7th percentile), consistent with a low-severity, low-priority finding.
Connecting an attacker-controlled hardware accessory to an unpatched iPhone, iPad, or Mac can drive a memory corruption fault that terminates the system (unexpected system termination) in iOS/iPadOS before 26.7 and before 27, and in macOS Tahoe before 26.7 and macOS Golden Gate before 27. The vendor describes the root cause as insufficient input validation (CWE-20) on data supplied by the attached peripheral; the vector requires no privileges on the target device (PR:N) but does require the victim to physically attach the malicious accessory and to interact with it (UI:R), and the impact is availability-only with no confidentiality or integrity loss. Apple has released fixes (iOS/iPadOS 26.7 and 27, macOS Tahoe 26.7 and macOS Golden Gate 27), the vendor score is 5.5, EPSS is 0.15% (5th percentile), and there is no CISA KEV listing and no public exploit identified at time of analysis.
An unauthenticated attacker positioned within radio range of an Apple iPhone or iPad can send specially crafted wireless input that causes the device to terminate unexpectedly (crash/restart), due to an input validation failure in the affected platform. The flaw is rated CVSS 6.5 (AV:A, A:H) and affects iOS and iPadOS before version 27; Apple has released a fixed version and no public exploit code or active exploitation has been identified (EPSS 0.14%, 4th percentile). Impact is limited to availability - there is no confidentiality or integrity impact.
An out-of-bounds write in Apple's image processing pipeline (CWE-787) allows a maliciously crafted image to corrupt memory when it is viewed on affected Apple platforms. Apple addressed the flaw with improved bounds checking in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, and visionOS 27. The CVSS 3.1 base score of 6.5 reflects a network-delivered attack requiring the victim to open the image (UI:R), with impact limited to availability (C:N/I:N/A:H); EPSS is very low at 0.18% (7th percentile) and there is no public exploit identified at time of analysis.
Improper access control in Apple's iOS, iPadOS, macOS, visionOS, and watchOS allows a locally installed app running with ordinary, non-privileged permissions to read sensitive user data that should be isolated from it. Exploitation requires the attacker to already have a malicious app executing on the device (CVSS 3.1 AV:L/PR:L/UI:N, confidentiality-only C:H/I:N/A:N, base 5.5), so there is no remote or unauthenticated path and no additional user interaction beyond installing and launching the app. Apple addressed the flaw with improved checks, and vendor-released patches are available in iOS/iPadOS 26.7, iOS/iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, visionOS 27, and watchOS 27; no public exploit code has been identified and EPSS is low at 0.20% (10th percentile), so this reads as a modest, locally-gated confidentiality issue rather than an urgent priority.
Apps installed on Apple iOS/iPadOS, tvOS, visionOS, and watchOS prior to version 27 can read the user-assigned device name without the additional authorization Apple intended, an improper permission-management flaw tracked as CVE-2026-86893 and fixed in the iOS 27, iPadOS 27, tvOS 27, visionOS 27 and watchOS 27 releases. The issue requires a malicious or compromised app already running locally with ordinary low-privilege sandbox access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base score 3.3) and yields nothing beyond disclosure of that single low-sensitivity identifier - no code execution, no privilege escalation, and no effect on integrity or availability, with macOS unaffected. There is no public exploit identified at time of analysis, EPSS is 0.16% (6th percentile), and the CVE is not in CISA KEV; the practical gate is getting a hostile app onto the device in the first place, which keeps real-world exposure low.
Incorrect authorization handling in Apple's iOS, iPadOS, macOS, and tvOS lets a locally installed app reach sensitive user data that should be fenced off by the platform's state and sandbox checks. The flaw is a local, low-privilege issue (CVSS 5.5, AV:L/PR:L) requiring a malicious or compromised app already running on the device — no network vector and no user interaction beyond launching the app. Apple has shipped fixes in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, and tvOS 27; EPSS is very low (0.17%, 6th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis.
An out-of-bounds read in Apple's kernel, fixed across iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27, allows a locally installed application to disclose kernel memory to user space. The flaw (CWE-125) stems from insufficient input validation in a kernel code path reached by app-supplied data, and yields high confidentiality impact only - no integrity or availability loss. Apple has released patches for all affected platforms; EPSS is very low (0.15%, 5th percentile), and there is no public exploit code or CISA KEV listing at time of analysis.
Improper access control in Apple iOS, iPadOS, and macOS lets a locally installed application running with low privileges read sensitive user data, with no user interaction required, affecting iOS and iPadOS before 26.7 and before 27 and macOS before Sequoia 15.8, Tahoe 26.7, and Golden Gate 27. Apple fixed the authorization flaw (CWE-285) through improved access control as part of its 26.7/27 release cycle, so vendor patches are available for every affected platform. At a CVSS base score of 5.5 and an EPSS score of only 0.19% (9th percentile), this is a moderate-severity, low-priority local authorization issue; no public exploit code has been identified at time of analysis.
Archive expansion on Apple operating systems can slip past Gatekeeper's file-quarantine checks, allowing unsigned or un-notarized code inside a crafted archive to run without the normal block or warning prompt; macOS (Sequoia, Tahoe and Golden Gate), iOS/iPadOS, visionOS and watchOS are all affected and remediated in the 26.7/27 and 15.8 releases documented in Apple advisories 149034-149043. The flaw is local in nature (CVSS:3.1/AV:L/AC:L), requires the archive to actually reach and be expanded on the device, and carries bounded impact (C:L/I:L/A:N) because it defeats a trust warning rather than granting elevated execution - though the vendor's vector assumes low privileges and no user interaction while our independent assessment treats the expand/open step as user-driven. There is no public exploit identified at time of analysis and no CISA KEV listing, with EPSS at 0.18% (8th percentile), making this a genuinely low-priority issue despite the security-relevant nature of a Gatekeeper bypass; exploitation status is 'no public exploit identified at time of analysis'.
An out-of-bounds write in Apple's operating systems - iOS and iPadOS before 26.7 and before 27, macOS before Sequoia 15.8, before Tahoe 26.7 and before Golden Gate 27, tvOS before 27, and visionOS before 27 - allows a remote, unauthenticated attacker to crash the application that processes a maliciously crafted file, with the flaw addressed through improved bounds checking. Successful exploitation requires the victim to open or process the attacker-supplied file (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L), and the realized impact is limited to termination of the processing app with no confidentiality or integrity effect and no system-wide crash. Vendor patches are available from Apple across all affected platforms, the EPSS score is low at 0.20% (10th percentile), and no public exploit has been identified at time of analysis. This is a genuinely low-priority issue despite the memory-corruption class.
A race condition in Apple's OS state-handling code (CWE-362) lets an application already executing on an affected device crash the system, causing unexpected termination and a local denial of service across iOS/iPadOS, macOS, tvOS, visionOS and watchOS. Only local, already-installed apps can reach the flaw (AV:L, PR:L), and because the attacker must reliably win a narrow timing window (AC:H), exploitation is difficult; there is no data exposure or code execution, only availability impact (CVSS:3.1 4.7). No public exploit code has been identified at time of analysis, EPSS is a low 0.18% (8th percentile), and vendor patches are already released in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27, so this is a low-to-moderate priority hardening item rather than an urgent threat.
Heap-based buffer overflow in Apple's operating system platforms - iOS and iPadOS (before 26.7 and 27), macOS Golden Gate (before 27), visionOS (before 27), and watchOS (before 27) - allows a remote attacker to crash the processing application by delivering a maliciously crafted file that the victim opens. Successful exploitation requires user interaction (CVSS UI:R) and leads only to unexpected termination of the affected app; there is no confidentiality or integrity impact and no described code execution or system-wide compromise, which is why our independent assessment lowers the availability impact to A:L rather than the vendor's A:H. No public exploit code has been identified at time of analysis and exploitation is not confirmed actively exploited (CISA KEV); EPSS is 0.18% (8th percentile), indicating a low predicted likelihood of exploitation. Vendor patches are available.
Opening a maliciously crafted file on an unpatched Apple device can crash the parsing process or disclose its memory contents, an out-of-bounds read that Apple addressed with improved input validation and fixed in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, and visionOS 27. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L), exploitation is unauthenticated from the network but hinges entirely on user interaction - the victim must open the crafted file - and impact is confined to the vulnerable process as a limited read-only disclosure or denial of service, with no code execution or data modification. EPSS is 0.18% (7th percentile), no public exploit has been identified at time of analysis, and vendor patches are already available, making this a low-priority issue despite the network attack vector.
An out-of-bounds read in Apple's font-processing code can crash (terminate) an application on iOS, iPadOS, macOS, tvOS, visionOS and watchOS when it parses a maliciously crafted font file, but it cannot be used to execute code, escalate privileges, or steal data. The issue affects iOS/iPadOS before 26.7 and before 27, macOS before Sequoia 15.8, Tahoe 26.7 and Golden Gate 27, and tvOS, visionOS and watchOS before 27, and it is fixed in those listed releases; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, score 4.3) confirms that unauthenticated remote attackers can only succeed if a victim is induced to open or render the crafted font (user interaction required), and exploitation yields availability loss only. No public exploit code has been identified at time of analysis and the EPSS score is 0.21% (11th percentile), so real-world exploitation is unlikely; this is a genuinely low-priority issue despite the network attack vector.
Network traffic integrity can be silently undermined on unpatched Apple platforms - iOS and iPadOS before 27, macOS Golden Gate before 27, tvOS before 27, and watchOS before 27 - by an unauthenticated attacker who already holds a privileged on-path network position between the device and its peer. Apple fixed the underlying cryptographic weakness through improved integrity checks in the 27-generation releases, restoring the guarantee that intercepted traffic cannot be modified undetected. Exploitation is constrained by the adjacency requirement (AV:A) and high attack complexity (AC:H), EPSS is only 0.17% (7th percentile), and no public exploit code has been identified at time of analysis.
A local permission-enforcement flaw in Apple's operating systems lets an app escalate read-only access to a file into full modify capability, so it can alter content it was only ever authorized to view. The issue affects iOS and iPadOS before 27, macOS before 15.8, 26.7, and 27, tvOS before 27, and visionOS before 27, and carries a modest CVSS 5.5 (AV:L/PR:L, integrity-only impact) with an EPSS of just 0.20% at the 10th percentile. Exploitation is not remotely reachable and no public exploit has been identified at time of analysis; Apple has shipped fixes, so risk is concentrated in unpatched devices running a local malicious or compromised app.
Processing a maliciously crafted image on unpatched Apple platforms can leak uninitialized process memory, exposing small, non-deterministic fragments of data that happened to be in memory at decode time. Affected are iOS and iPadOS before 26.7 and before 27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, plus tvOS, visionOS, and watchOS before 27; the CVSS vector (AV:N/AC:L/PR:N/UI:R) means no credentials or special configuration are needed but the victim must open, preview, or otherwise trigger decoding of the attacker-supplied image. Impact is limited to confidentiality (C:L) with no integrity or availability effect, EPSS is a low 0.18% (8th percentile), and no public exploit has been identified at time of analysis; Apple has shipped fixed versions for every affected platform, so the practical priority is routine patch cadence rather than emergency response.
Improper authorization in Apple's mobile and wearable operating systems - iOS and iPadOS, tvOS, visionOS, and watchOS - lets an app that is already installed and running on the device reach sensitive user data it should not be able to see. The flaw stems from weak state management in an authorization check (CWE-285) and is fixed in iOS 27, iPadOS 27, tvOS 27, visionOS 27, and watchOS 27. Exploitation requires a malicious or compromised app already resident on the device (CVSS:3.1/AV:L/PR:L/UI:N, 5.5), so it is bounded by Apple's App Store review, sandboxing, and code-signing controls; there is no remote or unauthenticated path, macOS is not affected, EPSS sits at 0.16% (6th percentile), and no public exploit has been identified at time of analysis. This is a genuinely low-priority issue despite its medium CVSS score.
A memory-safety defect (out-of-bounds read, CWE-125) in Apple's iOS, iPadOS, macOS, tvOS, visionOS, and watchOS can be triggered by a locally running application and causes an unexpected system termination - a denial-of-service/availability impact with no confidentiality or integrity loss. Affected versions are those prior to the fixed releases: iOS/iPadOS before 26.7 (and before 27), macOS before Sequoia 15.8, before Tahoe 26.7, and before Golden Gate 27, plus tvOS, visionOS, and watchOS before 27. Exploitation requires the attacker to already have a malicious app running on the device with its own app-level privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, scored 5.5); no public exploit code has been identified at time of analysis, EPSS is low at 0.21% (11th percentile), and there is no CISA KEV entry. Apple has released patched versions, so the practical exposure is limited to unpatched devices running a hostile app - a low-to-moderate priority issue.
A locally installed app on unpatched Apple platforms can read a persistent account identifier it is not authorized to access, handing the app a stable value that could be used to correlate or track a user across apps and sessions. Impact is confined to privacy-relevant information disclosure: the assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (3.3), meaning a low-privilege app must already be installed and running on the device, with no remote or network vector and no user interaction beyond launching that app. Affected are iOS and iPadOS before 27, macOS before 27 (Golden Gate) and before 26.7 (Tahoe), tvOS before 27, visionOS before 27, and watchOS before 27, all of which now have fixed releases. This is a low-priority issue overall: exploitation is not confirmed, no public exploit identified at time of analysis, and EPSS is just 0.19% (9th percentile).
Improper authorization in Apple's Shortcuts messaging action allows a crafted shortcut to send messages on an unpatched device without the confirmation prompt the user would normally see. Affected platforms are iOS/iPadOS, macOS Golden Gate, tvOS, visionOS and watchOS in all versions prior to the 27 release train, across the CPE-listed Apple product families. Exploitation requires the victim to obtain and run a malicious shortcut (unauthenticated but user-interaction dependent, UI:R) and is limited to unauthorized message sending with low confidentiality and integrity impact; there is no public exploit identified at time of analysis and EPSS is only 0.16% (6th percentile), making this a genuine but low-to-moderate severity issue rather than a high-priority emergency. Vendor patches are available as iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27.
Improper authentication state management in Apple iOS and iPadOS versions prior to 27 lets someone with physical access to an already-unlocked iPhone or iPad view stored Wi-Fi passwords without supplying credentials. The flaw is purely physical (CVSS:3.1/AV:P/AC:L/PR:N/UI:N), carries a high confidentiality impact (C:H) but no integrity or availability effect, and does not affect devices running iOS 27 or iPadOS 27, where Apple corrected the state-handling logic. Exploitation is confirmed to be neither remotely reachable nor scalable, EPSS is only 0.21% (11th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis.
Unexpected system termination (denial of service) is possible on unpatched Apple platforms after a locally installed, already-executing app triggers a type confusion in OS memory handling - affecting iOS/iPadOS before 26.7 and before 27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, and tvOS, visionOS and watchOS before 27. The flaw is strictly local: the attacker must first get code running as an app on the device (AV:L, PR:L, UI:N per the assessed CVSS:3.1 vector), and successful exploitation produces only a crash with no confidentiality or integrity impact (C:N/I:N/A:H, base score 5.5). Apple has released patches, exploitation yields denial of service only, and no public exploit code or CISA KEV listing has been identified at time of analysis; EPSS is low at 0.17% (7th percentile).
Local denial-of-service in Apple iOS, iPadOS, and visionOS lets an app already executing on the device exhaust resources or crash a system service by abusing an OS interface that failed to enforce required entitlement checks, producing an availability-only impact (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Exploitation is constrained to locally installed, attacker-controlled or compromised apps (PR:L, AV:L), so there is no remote or unauthenticated path and no data exposure or code-integrity loss. Apple addressed the flaw by adding entitlement validation in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and visionOS 27; no public exploit code has been identified at the time of analysis and EPSS is low at 0.16% (6th percentile), consistent with a narrow local-only attack surface.
A privacy flaw in Apple operating systems lets a malicious application already running on the device determine the user's current location, because location data was not properly redacted from log entries (CWE-532). The issue is local-only: the CVSS vector (AV:L, PR:L, UI:N, C:H/I:N/A:N) means an attacker must first get a malicious app installed and executing on the target device, after which no further user interaction is needed, and the impact is confined to confidentiality - the user's location is disclosed with no integrity or availability effect. Apple has fixed the flaw in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27; there is no public exploit identified at time of analysis, EPSS is very low (0.21%, 11th percentile), and the practical barrier is Apple's app-distribution controls rather than any remote attack path.
A use-after-free (CWE-416) in Apple's memory management code allows a locally running application on iOS, iPadOS, macOS, tvOS, visionOS and watchOS to crash the affected system, producing an unexpected termination or reboot. The flaw affects all platforms before the fixed releases (iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27) and rates CVSS 5.5 (AV:L/PR:L/UI:N, availability-only impact). No public exploit code or active exploitation has been identified, and EPSS is low at 0.21% (11th percentile), so this is a patched, availability-only issue rather than an urgent remote-code-execution threat.
Improper memory handling in Apple iOS, iPadOS, and macOS lets a locally running application trigger an unexpected system termination, crashing the device or the operating system; affected versions are iOS/iPadOS prior to 26.7 or 27, and macOS prior to Golden Gate 27, Sequoia 15.8, and Tahoe 26.7. The only prerequisite is the ability to run a malicious or malformed app on the target device (local access, PR:L, no user interaction and no network reachability), and the demonstrated impact is limited to availability - no code execution, privilege escalation, or data access. No public exploit identified at time of analysis, no evidence of active exploitation (not in CISA KEV), EPSS is 0.20% (10th percentile), and vendor patches have been released.
Locally installed applications on Apple iOS/iPadOS, macOS Golden Gate, tvOS, and watchOS releases prior to version 27 can bypass intended permission restrictions and read sensitive user data they should be denied. Exploitation requires a malicious or compromised app already running on the device (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 5.5 MEDIUM) - there is no network-reachable path, so an attacker must first deliver an app through the App Store, sideloading, or enterprise/MDM distribution, after which no further user interaction is needed. There is no public exploit identified at time of analysis and the EPSS score is 0.16% (6th percentile); Apple has shipped fixes in the version 27 releases across all four affected platforms, so exposure is limited to unpatched devices below version 27.
Insufficient permission restrictions in Apple's iOS/iPadOS, visionOS, and watchOS allow an app already installed and running locally on the device to reach sensitive user data it should not be able to read. Exploitation requires local code execution with the privileges of a normal installed app (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and yields confidentiality impact only - no integrity or availability effect, and no remote or unauthenticated path. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is 0.16% (6th percentile), so this is a low-priority, patch-and-move-on issue that is fully resolved by updating to iOS 27/iPadOS 27, visionOS 27, or watchOS 27; macOS and tvOS are not listed as affected.
An app on an affected Apple device can bypass authorization checks and read sensitive user data it should not be able to reach, due to improper state management in iOS and iPadOS before 26.7 and before 27, tvOS before 27, and visionOS before 27. The attacker must already have a malicious or compromised app installed and running locally on the device with ordinary low-level sandbox privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), so there is no remote or network attack surface and no user interaction is needed once that app is present; the impact is confidentiality-only (C:H) with no code execution, integrity, or availability effect, and macOS is unaffected. There is no public exploit identified at time of analysis, EPSS is negligible at 0.16% (6th percentile), and Apple has released fixed versions (iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, tvOS 27, visionOS 27) - Apple self-reports the issue, though the CVE record carries no vendor attribution in the reference metadata.
Mounting a maliciously crafted disk image or removable-media volume on an unpatched Apple device triggers a heap buffer overflow in the operating system's volume-parsing code, causing unexpected system termination (denial of service). Affected builds are iOS/iPadOS before 26.7 and 27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate 27. Exploitation is gated by mandatory user interaction - the crafted volume must be attached and mounted by the victim - and the assessed impact is limited to system termination with no code execution, data disclosure, or persistence; EPSS is only 0.19% (9th percentile) and no public exploit code has been identified, though Apple has released patched versions and CISA KEV does not list this CVE. Real-world risk is LOW-to-MODERATE despite the 6.5 (Medium) CVSS, since the practical attack path is local/physical delivery rather than network reach.
Kernel memory corruption in Apple's operating systems lets an app running on the device crash the system or corrupt kernel memory, with the independent assessment scoring integrity and availability impact as High (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H). Every unpatched device is exposed once a user launches a malicious or compromised app: no network vector, no user interaction beyond app execution, and no special configuration is required. There is no confirmed active exploitation (CISA KEV does not list this CVE) and no public exploit code identified at time of analysis, and EPSS is low at 0.21% (11th percentile), so real-world urgency is modest even though the flaw sits in the kernel. Apple has shipped fixed builds across all affected platforms: iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27.
Bypass of on-device network restrictions in Apple iOS/iPadOS, macOS Golden Gate, visionOS, and watchOS builds prior to version 27 allows a locally installed, already-running app to reach network resources the operating system should have blocked, producing low confidentiality and low integrity impact with no availability effect. Exploitation requires an app that is already installed and executing with normal, authenticated app privileges on the target device (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, score 4.4); there is no remote or unauthenticated attack path, no public exploit identified at time of analysis, and EPSS is a low 0.21% (11th percentile). Apple has shipped vendor-released fixes in iOS 27, iPadOS 27, macOS Golden Gate 27, visionOS 27, and watchOS 27.
Local apps on iOS, iPadOS, and visionOS can bypass certain Privacy preference controls and reach sensitive data they were never authorized to see; Apple addressed it by removing sensitive data from the reachable location. Affected are iOS and iPadOS before 26.7 and before 27, plus visionOS before 27, with fixes shipped in iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, and visionOS 27. Exploitation is local-only and requires a malicious or overprivileged app to already be installed and running on the device (CVSS 3.3, AV:L/PR:L/UI:N, low confidentiality impact); there is no public exploit identified at time of analysis and EPSS is negligible at 0.17% (7th percentile).
Unexpected system termination in Apple operating systems can be triggered by a locally installed app that wins a race condition in system state handling, affecting iOS/iPadOS before 27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, tvOS before 27, visionOS before 27, and watchOS before 27. The defect is availability-only (C:N/I:N/A:H) with a local attack vector (AV:L), high attack complexity (AC:H), and low privileges required (PR:L), meaning an authenticated app must hit a narrow timing window to crash the system. No public exploit identified at time of analysis and no confirmation of active exploitation (not in CISA KEV); EPSS is 0.20% (10th percentile), and Apple has released patched versions.
Improper bounds checking during image processing on unpatched Apple operating systems lets a crafted image crash the application that renders it, affecting iOS and iPadOS before 27, macOS Golden Gate before 27, tvOS before 27, visionOS before 27, and watchOS before 27. The defect is scored 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L), meaning an unauthenticated remote attacker can trigger it only if the victim opens or renders the malicious image, and the outcome is limited to unexpected application termination rather than code execution, data disclosure, or integrity loss. No public exploit code has been identified and there is no confirmed active exploitation; EPSS is a low 0.21% (12th percentile), so this is a low-to-moderate priority issue rather than an emergency.
Out-of-bounds memory corruption in Apple's 3D scene processing pipeline lets a maliciously crafted scene file terminate the application that renders it across iOS/iPadOS, macOS, tvOS, visionOS and watchOS builds released before the fixed versions. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L (score 4.3): no authentication or elevated privileges are required, but the attacker cannot succeed without the victim opening or rendering the supplied scene, and the resulting impact is confined to application termination with no confidentiality, integrity, or demonstrated code-execution effect. No public exploit identified at time of analysis, EPSS is 0.18% (8th percentile), and Apple has shipped patches for every affected platform, making this a low-priority denial-of-service defect rather than a code-execution emergency.
Kernel memory disclosure on unpatched Apple devices allows a locally running, low-privilege app to read kernel memory that it should not be able to access, potentially exposing sensitive kernel-side data. The issue - an information-disclosure weakness (CWE-200) caused by improper memory management - affects iOS and iPadOS before 26.7 and before 27, macOS Tahoe before 26.7 and macOS Golden Gate before 27, and tvOS, visionOS and watchOS before 27, and is fixed in the corresponding 26.7/27 releases. Exploitation requires the attacker to already be executing code inside a sandboxed app on the target device (CVSS 3.1 3.3, AV:L/AC:L/PR:L/UI:N, confidentiality-only impact), so overall risk is low; no public exploit identified at time of analysis, with an EPSS score of roughly 0.2% (10th percentile) and no CISA KEV listing.
Loading maliciously crafted web content in Apple's WebKit engine can crash the renderer or host process on Safari, iOS/iPadOS, macOS, tvOS, visionOS and watchOS builds earlier than the version 27 releases, producing a denial-of-service condition rather than code execution or data exposure. The flaw is a state-management logic error in the type-confusion class (CWE-843), and it is reachable from a remote web-content delivery path, so exploitation hinges on getting a victim to open a hostile page or embed WebKit content. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; EPSS is only 0.14% (4th percentile), and Apple has shipped fixed '27' releases across all affected platforms, so the practical risk is moderate and availability-only. Note that Apple's published vector lists PR:L/UI:N while our assessment uses PR:N/UI:R, a contradiction worth confirming with the vendor.
Uninitialized kernel memory disclosure in Apple's operating system family allows a local app that already holds root privileges to read residual data left in kernel memory buffers, an information-leak primitive that exposes potentially sensitive kernel memory contents. The flaw is fixed across iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27, so affected users should update promptly. No public exploit code has been identified at time of analysis, and EPSS places the probability of exploitation at roughly 0.17% (7th percentile), consistent with the assessment that the mandatory root prerequisite - the attacker must already be running code at the highest local privilege level - makes this a post-compromise leak rather than an initial-access or privilege-escalation primitive, and a genuinely low real-world priority despite the 6.2 Medium base score.
An out-of-bounds write in Apple's NTLM handling can terminate affected applications on iOS, iPadOS and macOS when they process maliciously crafted NTLM authentication input, yielding a denial-of-service primitive with no confidentiality or integrity impact. Per Apple's CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 6.2) exploitation is local, requires no privileges and no user interaction beyond the target app parsing the crafted NTLM data, and is constrained to versions before iOS 27, iPadOS 27 and macOS Golden Gate 27. Real-world risk is LOW-to-MODERATE and consistent across signals: EPSS is 0.16% (5th percentile), the issue is not listed in CISA KEV, and no public exploit code has been identified at time of analysis, though Apple has released patched versions.
An authorization flaw in Apple's operating systems (iOS/iPadOS, macOS, tvOS, visionOS, watchOS) lets a locally installed, malicious or compromised app read sensitive user data that should be off-limits to it, due to improper state management in the platform's authorization checks. Only devices running versions prior to the fixed releases are exposed: iOS/iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. Exploitation is strictly local - the attacker must already have code running on the target device - and there is no public exploit identified at time of analysis, with a low EPSS of 0.18% (7th percentile) reflecting the limited attack surface. This is a genuine but low-priority local authorization issue with high confidentiality impact but no integrity or availability impact.
Locally installed apps on unpatched Apple platforms (iOS and iPadOS before 27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, and tvOS, visionOS and watchOS before 27) can read sensitive user data that the system wrote into logs without adequate redaction. Apple fixed the flaw by improving data redaction in the release train listed in its security advisories. Impact is confidentiality-only and strictly local, with no network attack path, and a low EPSS of 0.18% (7th percentile) reflects that; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis. One prerequisite discrepancy is worth noting: the published vector requires user interaction (UI:R), while our assessed vector treats the app as already installed and running without interaction.
An out-of-bounds write in Apple's image handling code can terminate an application on iOS and iPadOS before 26.7 and on macOS before Golden Gate 27 when a user opens a maliciously crafted image. The attacker needs no credentials or privileges, but the victim must actively render the attacker-supplied image, and the maximum assessed impact is availability only (app crash) with no code execution, privilege gain, or data exposure. Exploitation is not confirmed in the wild (no CISA KEV listing), EPSS is 0.15% (5th percentile), and no public exploit code has been identified; Apple has shipped fixes in iOS 26.7, iPadOS 26.7, and macOS Golden Gate 27.
Processing maliciously crafted web content in Apple's WebKit-based browser stack can disclose sensitive user information across Safari 27, iOS/iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27 and earlier. Apple classifies the root cause as an improper privilege management (permissions) issue and fixed it by removing the vulnerable code rather than adding a check, per the vendor advisories referenced for CVE-2026-64753. Real-world urgency is currently low: EPSS is 0.14% (4th percentile), there is no CISA KEV listing or public exploit identified at time of analysis, and CISA's SSVC assessment is exploitation:none / automatable:no / technical impact:partial, while a vendor patch is already available.
Path traversal in Apple iOS/iPadOS and watchOS lets a locally installed, low-privileged app write outside its intended file-handling path and modify protected system files, producing a high integrity impact with no data disclosure or denial of service claimed. Apple addressed the issue through improved input validation in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, and watchOS 27, so unpatched devices below those releases remain exposed. Exploitation is gated: the attacker must already have a malicious app executing on the device, no public exploit code has been identified at time of analysis, and EPSS is 0.16% (6th percentile), consistent with a moderate, local-only risk rather than an urgent one.
Holding a locked iPhone or iPad, an attacker can reach a lockscreen-accessible interface that improperly passes an authentication check, allowing sensitive user information to be viewed without the passcode being entered. The flaw is a logic error classed as CWE-287 (improper authentication) that affects iOS and iPadOS builds prior to 26.7 and 27, and Apple has shipped fixes in iOS/iPadOS 26.7 and iOS/iPadOS 27, so it is fully remediated by updating. Exploitation requires hands-on physical possession of the locked device and cannot be performed remotely or at scale; EPSS is 0.17% (6th percentile) and no public exploit has been identified at time of analysis, making this a low-to-medium real-world priority driven mostly by confidentiality exposure on lost or stolen devices.
A type confusion flaw (CWE-843) in multiple Apple operating systems lets an already-installed, locally executing app trigger a type-handling error that ends in unexpected system termination, giving a crash-based denial of service but no path to code execution, privilege gain, or data access. Affected are iOS/iPadOS before 26.7 (and the 27 line before 27), macOS before Sequoia 15.8, Tahoe 26.7 or Golden Gate 27, and tvOS, visionOS and watchOS before 27; Apple has shipped fixed versions in each of those releases, and exploitation requires an authenticated local app context (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). No public exploit code has been identified at time of analysis and EPSS is only 0.17% (7th percentile), so despite the MEDIUM 5.5 rating this is a genuinely low-priority issue with limited impact beyond a system crash.
iCloud Private Relay on Apple platforms could disclose a user's real IP address to a website even while the privacy proxy is active, because of a state-management flaw in the relay implementation. The issue affects iOS and iPadOS before 18.7.10 and before 26.6.1, macOS Tahoe before 26.6.2, and visionOS before 26.6.1, and requires the victim to browse to attacker-controlled web content (UI:R, no privileges needed). Severity is modest (CVSS 4.3, confidentiality-only) and there is no CISA KEV listing or public exploit identified at time of analysis, but the privacy impact is disproportionate for users who depend on Private Relay for anonymity.
A use-after-free memory management flaw in Apple iOS and iPadOS allows a locally installed application to crash the system, causing unexpected device termination (denial of service). All versions prior to iOS 27 / iPadOS 27 are affected per the vendor CPE wildcard and ENISA EUVD version range (0 < 27). Apple addressed the issue with improved memory management in iOS 27 and iPadOS 27; no public exploit code has been identified and the EPSS probability is very low (0.17%, 7th percentile), so this is primarily a stability/patch-hygiene issue rather than an active exploitation threat.
A local permission-assignment flaw in Apple's mobile and desktop operating systems lets an app installed on the device modify protected parts of the file system, giving it an integrity-only foothold outside its normal sandbox boundaries. Affected platforms are iOS and iPadOS before 26.7 and 27, and macOS before Golden Gate 27, Sequoia 15.8, and Tahoe 26.7; exploitation requires a locally-installed, running app plus user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N), with no confidentiality or availability impact and no remote or network reachability. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV), and EPSS sits at 0.17% (7th percentile), so this is a moderate, not urgent, priority that is addressed by vendor-released updates.
An information disclosure flaw in Apple's iCloud Private Relay lets a website determine a visitor's real IP address even when Private Relay is switched on, defeating the core privacy guarantee of the feature. The issue affects iOS and iPadOS before 26.6.1, macOS before 26.6.2 (Tahoe), and visionOS before 26.6.1, and is reachable from the network but requires the victim to browse to an attacker-controlled page. Apple addressed it through improved state management, and no public exploit code or active exploitation has been identified at time of analysis.
Information disclosure in Apple iOS and iPadOS versions before 27 allows a locally installed malicious or compromised app to access sensitive user data after the user installs and opens it. The flaw is a permissions issue (CWE-200) that Apple addressed with additional restrictions in iOS 27 and iPadOS 27. No public exploit identified at time of analysis and EPSS is 0.17% (7th percentile), but the CVSS score of 5.5 reflects the high confidentiality impact; exploitation requires local app execution and user interaction, with no remote path.
Sensitive user data disclosure in Apple iOS and related platforms allows a locally installed malicious app to bypass entitlement checks and access protected data, affecting Safari before 27, iOS/iPadOS before 26.7 and 27, macOS before Golden Gate 27, and visionOS before 27. The flaw requires local app installation and user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R) and only impacts confidentiality (C:H) with no integrity or availability effect. No public exploit has been identified at time of analysis, and EPSS is 0.18% (7th percentile), indicating low exploitation likelihood.
A malicious or compromised app running on iOS and iPadOS prior to 26.7 (and prior to 27), and on visionOS prior to 27, can abuse insufficient path validation to write to protected parts of the file system. Apple addressed the path handling flaw with improved validation in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and visionOS 27, so patched devices are not exposed. Scoring 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N), the issue requires the user to install and launch a hostile app but then needs no additional privileges; EPSS is only 0.17% (6th percentile) and no public exploit code or confirmed active exploitation has been identified at time of analysis, so this is a moderate local-integrity flaw rather than a network-exploitable emergency.
Unexpected system termination can be triggered on Apple devices by a locally executed app that exploits a use-after-free memory corruption in shared system code, which Apple addressed through improved memory management. The flaw affects essentially every current Apple OS branch below the fixed releases — iOS/iPadOS 26.6+, macOS 15.8/26.6+/27, tvOS 26.6+/27, visionOS 26.6+/27 and watchOS 26.6+/27 — with CVSS 5.5 reflecting an availability-only impact and a local attack vector. EPSS is low (0.24%, 16th percentile), no public exploit code has been identified, and there is no CISA KEV entry, so this is a routine patch-cycle item rather than an urgent threat.
A sandboxed application running on Apple iOS/iPadOS, macOS Golden Gate, tvOS, visionOS, or watchOS can bypass authorization checks and read contents of the System Keychain, exposing stored secrets such as credentials, certificates, and tokens. The flaw stems from incorrect authorization combined with faulty state management (CWE-863) and affects all versions prior to the 27 release train; the platform owner has shipped fixes in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. The CVSS v3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, score 5.5) is consistent with our independent assessment: this is a genuine but locally-scoped access-control defect that requires an attacker to get a sandboxed app onto the device and have the user launch it (UI:R), so it cannot be triggered remotely over the network. EPSS is 0.16% (6th percentile) and no public exploit code has been identified at time of analysis, with no CISA KEV listing - impact is limited to confidentiality (keychain disclosure) with no integrity or availability effect, and patched 27-or-newer systems are not exposed.
Sensitive user data can be read by a malicious or compromised app on unpatched Apple devices because a logic-validation flaw lets the app cross its data-access boundary. Affected platforms are iOS and iPadOS before 26.7 and before 27, macOS before Sequoia 15.8, before Tahoe 26.7 and before Golden Gate 27, tvOS before 27, and visionOS before 27; the assessed vector (AV:L/AC:L/PR:N/UI:R/C:H/I:N/A:N) shows the attacker must first get a hostile app onto the device and the user must run it, with confidentiality-only impact. Vendor patches are available for every platform, EPSS rates exploitation probability at roughly 0.18% (7th percentile), and no public exploit has been identified at time of analysis.
Processing a maliciously crafted image on unpatched Apple devices can trigger a memory-corruption fault that crashes the affected process, producing a local denial-of-service (CVSS 3.1 base 5.5, AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Affected platforms are iOS and iPadOS before 18.7.10 and macOS before Sonoma 14.8.8, Sequoia 15.7.8, and Golden Gate 27; the attacker cannot trigger the flaw remotely and must get the victim to open or auto-render the crafted image. All signals point to a low-priority issue: EPSS is 0.20% (10th percentile), no public exploit code has been identified at time of analysis, there is no CISA KEV listing, and vendor patches are already available.
A remote denial-of-service flaw in Apple iOS and iPadOS (all versions before 27) stems from insufficient input validation in a code path that processes remotely supplied content, allowing an attacker to crash or hang the affected feature. Exploitation requires the victim to interact with the malicious input (CVSS UI:R) and yields only availability impact - confidentiality and integrity are unaffected. Apple addressed the issue with improved input validation in iOS 27 and iPadOS 27; there is no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so the practical priority is routine patching rather than emergency response.
Improper access control in Apple iOS and iPadOS, macOS Tahoe, and visionOS lets a locally installed app read user-sensitive data that it should not be able to reach. The flaw (CWE-284) stems from insufficient validation checks and is remediated in iOS/iPadOS 26.6, macOS Tahoe 26.6, and visionOS 26.6; the assessed vector (CVSS 5.5, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) means exploitation requires the victim to install and launch a malicious app on an unpatched build, with no remote attack path and no integrity or availability impact. The attacker's app needs no special privileges, but there is no public exploit identified at time of analysis and EPSS is low at 0.19% (9th percentile), so this is a genuine but low-priority confidentiality issue.
Improper access control (CWE-284) in Apple iOS, iPadOS, and macOS allows a locally installed app to read user-sensitive data outside the permission boundary the operating system is supposed to enforce, an information-disclosure impact rated CVSS 5.5 (confidentiality High, integrity None, availability None). Exploitation is local and requires user interaction: the attacker must first get a malicious or compromised app onto the device and convince the user to launch it (AV:L, PR:N, UI:R), so there is no remote, network-triggerable, or self-propagating path. Apple has released fixes in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27; no public exploit code has been identified at time of analysis and EPSS is low at 0.17 percent (7th percentile), with no CISA KEV listing.
Information disclosure in Apple iOS, iPadOS, macOS, tvOS, visionOS and watchOS allows a locally installed and running app to read a persistent account identifier that the operating system should have kept out of its reach. The root cause is a permissions/sandbox restriction gap (CWE-200), fixed by Apple with additional access restrictions in iOS and iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27; successful exploitation requires the user to install and launch a malicious local app (AV:L/PR:N/UI:R), so a remote, unauthenticated network attack is not possible. There is no public exploit identified at time of analysis and EPSS is 0.18% (8th percentile), making this low-to-moderate risk rather than an urgent priority, with impact confined to the confidentiality of one identifier and no integrity or availability effect.
Persistent device identifier disclosure in Apple iOS, iPadOS, macOS, tvOS, visionOS and watchOS stems from an incorrect authorization check that lets an ordinary, unprivileged installed app read identifiers it should not be able to access (CWE-863, CVSS 5.5, C:H/I:N/A:N). Exploitation is local-only (AV:L, PR:N) and requires user interaction to install and launch a malicious or compromised application on a device running an unpatched OS; there is no remote or network path, and no public exploit code has been identified at time of analysis, with EPSS at 0.17% (7th percentile) and no CISA KEV listing. Apple has released fixed versions and the impact is confined to confidentiality/privacy rather than code execution or data modification.
Improper access control in Apple's operating system family (iOS/iPadOS, macOS, tvOS, visionOS, watchOS) lets a locally installed app bypass intended permission restrictions and read sensitive user data it should not be able to reach. Apple addressed the flaw with additional restrictions in iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. Exploitation requires the attacker to already run code on the device as an app (PR:L, AV:L), and no public exploit code or active exploitation has been identified; EPSS is only 0.20% (10th percentile) and CISA SSVC records exploitation as 'none'.
An integer overflow in Apple's file-processing code, fixed through improved input validation, allows a maliciously crafted file to cause disclosure of process memory on affected Apple platforms. Unpatched devices running iOS/iPadOS before 26.7 and 27, macOS before Sequoia 15.8, Tahoe 26.7 or Golden Gate 27, plus tvOS, visionOS and watchOS before 27 are exposed, but exploitation requires the victim to open the crafted file (CVSS UI:R). There is no public exploit code and no evidence of active exploitation; EPSS is very low at 0.18% (8th percentile) and CISA SSVC rates the issue non-automatable with only partial technical impact, and Apple has released patches.
An improper authorization flaw in Apple iOS/iPadOS and macOS Tahoe allows a locally installed application to reach sensitive user data that the platform's authorization state checks should have blocked. Apple addressed the flaw through improved state management, shipping fixes in iOS 26.6, iPadOS 26.6, and macOS Tahoe 26.6 for all versions prior to those releases. The issue is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, 5.5) with confidentiality impact only; EPSS is 0.15% (5th percentile), CISA SSVC rates exploitation as 'none' and technical impact as 'partial', and no public exploit code was identified at time of analysis.
Sandboxed applications on Apple iOS, iPadOS, macOS, and visionOS can bypass sandbox file-access restrictions and read restricted files because of insufficient path validation in the affected operating system components (CWE-22). Exploitation requires a local attacker to get a crafted sandboxed app installed and launched by the user on a vulnerable device (CVSS 3.1 AV:L/AC:L/PR:N/UI:R), making this a delivery-gated, confidentiality-only information-disclosure flaw rather than a remotely reachable one. Apple has shipped fixes in iOS 26.7 and 27, iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, and visionOS 27; no public exploit code has been identified at time of analysis, the EPSS score is only 0.17% (6th percentile), and the CVE is not listed in CISA KEV.
An incorrect-authorization flaw in Apple's Bluetooth state management allows an already-installed app to obtain Bluetooth access it was never granted, undermining the platform's per-app permission model on iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27 - but only on versions prior to those releases. Apple fixed the issue through improved state handling and published coordinated advisories for every affected platform; a local attacker or malicious app is required, so this is not remotely reachable without code execution already on the device. No public exploit code has been identified and EPSS is very low (0.20%, 10th percentile), so this rates as a patching-hygiene item rather than an emergency.
A use-after-free memory-management flaw in Apple's operating systems allows a locally installed application to crash the system, causing unexpected termination (denial of service) on affected iPhone, iPad, Mac, and Apple Vision Pro devices. Apple addressed the issue across iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and visionOS 27. There is no evidence of active exploitation: CISA KEV does not list the CVE, SSVC records exploitation as 'none' and automatable as 'no', EPSS is a low 0.18% (7th percentile), and no public exploit code has been identified at the time of analysis.
Null pointer dereference in iOS and iPadOS allows a locally installed app to trigger unexpected system termination (device crash/reboot) by supplying crafted input that bypasses input validation. Affected versions span the legacy 18.x branch (prior to 18.7.9) and the current 26.x branch (prior to 26.5), covering a broad swath of Apple mobile devices. No active exploitation has been identified - CISA KEV status is absent, SSVC rates exploitation as none, and EPSS sits at the 1st percentile - placing this squarely as a patch-cycle priority rather than an emergency response item.
Insufficient permissions restrictions in iOS and iPadOS (all versions prior to 26.5) allow a malicious locally-installed app to enumerate other applications installed on the device. The flaw, rooted in improper privilege management (CWE-269), exposes app inventory data that Apple's sandbox model is designed to protect. No public exploit identified at time of analysis, EPSS is extremely low at 0.09%, and SSVC exploitation status is confirmed none - placing this squarely as a low-urgency privacy concern rather than an active threat.
Safari on iOS, iPadOS, and macOS Tahoe crashes when processing specially crafted web content due to improper state management (CWE-703), resulting in a denial-of-service condition. Affected are iOS and iPadOS versions prior to 18.7.10 and 26.6.1, and macOS Tahoe prior to 26.6.2. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; impact is limited entirely to availability.
An out-of-bounds read in Apple's font parsing code lets a maliciously crafted font file leak process memory on unpatched builds of iOS, iPadOS, macOS, tvOS, visionOS and watchOS, with all affected platforms fixed in the version 27 releases. Triggering it requires the victim to render attacker-supplied content containing the crafted font — an email, document, web page or message preview — but no credentials or elevated privileges are needed once that interaction happens, and the resulting confidentiality impact is rated high with no integrity or availability effect. No public exploit code or active exploitation has been identified, and EPSS sits at a low 0.20% (10th percentile), so this is best handled as a scheduled platform update rather than an emergency response.
An out-of-bounds read in the font-parsing path of Apple's operating systems lets a remote attacker disclose the contents of process memory when a victim processes a maliciously crafted font. All Apple platforms are affected prior to the version 27 releases — iOS and iPadOS, macOS Golden Gate, tvOS, visionOS and watchOS — and Apple has shipped fixes for each. There is no CISA KEV listing and no public exploit code identified, and the EPSS score of 0.17% (7th percentile) indicates a low probability of near-term exploitation; because the sole impact is memory disclosure and exploitation requires the victim to open or render attacker-supplied content, this is a moderate-priority patch rather than an emergency.
Information disclosure in Apple's iOS, iPadOS, macOS, tvOS and watchOS platforms allows an app running on the device to reach sensitive user data that the operating system's data protection mechanisms were supposed to keep isolated from it. Apple resolved the issue with improved data protection in iOS and iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27 and watchOS 27, with vendor advisories published across seven support pages. No public exploit code or active exploitation has been reported, EPSS is low at 0.20% (10th percentile), and the issue is not listed in CISA KEV, so this reads as a routine hardening fix rather than an urgent emergency-patch event.
A use-after-free memory-management flaw affects Apple's operating system family prior to the 26.6 releases — iOS and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6 and watchOS 26.6 — and allows a locally installed app to trigger unexpected system termination (a denial-of-service condition). The vulnerability is rated CVSS 5.5 with a local attack vector, low complexity and low privileges required, but no confidentiality or integrity impact; EPSS is only 0.19 percent and there is no CISA KEV listing and no publicly available exploit code identified at time of analysis. Apple has shipped fixes in all four platform advisories, so the practical risk is concentrated on unpatched devices rather than on active exploitation.
Improper authorization checks in Apple's headphone motion data handling allow a locally installed app to read motion sensor data from connected headphones without prompting the user for consent, affecting iOS/iPadOS 26.7 and 27 and earlier, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27 and watchOS 27 and earlier. Exploitation requires a malicious or compromised app and user interaction, and the impact is limited to confidentiality of headphone sensor data (CVSS 5.5, C:H/I:N/A:N). Apple has shipped fixes in all affected operating systems; EPSS is low (0.20%, 10th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis.
Loading attacker-controlled web content on an unpatched Apple device can trigger a null pointer dereference in the WebKit rendering pipeline, crashing the browser or app that renders the page and producing a denial-of-service on iPhone, iPad, Mac, Apple Watch and Apple Vision Pro. Apple shipped fixes in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, visionOS 27 and watchOS 27. The flaw scores CVSS 6.5 with a user-interaction requirement (UI:R), EPSS is only 0.20% (10th percentile), and there is no public exploit code or CISA KEV listing at time of analysis.
An authorization flaw in Apple's operating systems lets a locally installed malicious app bypass Privacy preferences on affected iOS, iPadOS, and macOS builds. Apple addressed the issue through improved state management in iOS 18.7.10, iPadOS 18.7.10, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.8, and macOS Sonoma 14.8.8. The CVSS 3.1 base score is 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N), EPSS is 0.21% (11th percentile), there is no CISA KEV listing and no public exploit code identified at the time of analysis.
An out-of-bounds write in Apple's image handling code lets a maliciously crafted image crash the parsing process on affected iPhones, iPads, Macs, Apple TVs, Vision Pro and Apple Watches. Apple fixed the flaw through improved bounds checking in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27. Exploitation requires the victim to open or preview the crafted image (UI:R), the observed impact is process termination only — no code execution, data theft or tampering is described — and there is currently no public exploit code or CISA KEV listing; EPSS is a low 0.17% (7th percentile).
Connecting an Apple device to an attacker-controlled NFS server can cause the kernel NFS client to mishandle memory and return out-of-bounds kernel memory to the malicious server, an information-disclosure issue tracked as CVE-2026-43687. All shipping Apple platforms are affected — iOS/iPadOS before 26.7 and 27, macOS Tahoe before 26.7, macOS Golden Gate before 27, and tvOS, visionOS and watchOS before 27 — while the fix is distributed across Apple's 26.7/27 update wave. Exploitation requires the victim to initiate a connection to the hostile server (UI:R), which keeps real-world risk moderate: EPSS is only 0.18% (7th percentile), CISA KEV does not list it, SSVC rates exploitation as 'none' and automatable as 'no', and no public exploit code was identified at time of analysis.
A buffer overflow in multiple Apple operating systems — iOS 18.7.10, iPadOS 18.7.10, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.8, and macOS Sonoma 14.8.8 and earlier — allows a locally executing app to crash the affected system or process, producing a denial of service. The flaw stems from insufficient bounds checking (CWE-120) and is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N, availability-only impact), meaning an attacker must already have the ability to run code as a low-privileged app on the device. Apple has released patches and there is no CISA KEV listing, no public exploit code identified, and EPSS is low at 0.21% (12th percentile), so real-world exploitation pressure is currently minimal.
An out-of-bounds write in Apple's operating system kernel (CWE-787) allows a locally installed app to corrupt kernel memory or force an unexpected system termination, affecting iOS/iPadOS, macOS, tvOS, visionOS, and watchOS. Apple fixed the flaw with improved bounds checking in iOS 26.7 and 27, iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. Exploitation requires a local app (CVSS PR:L) with no user interaction, so real-world risk is currently low - EPSS is only 0.21% (11th percentile), the issue is not listed in CISA KEV, and no public exploit code has been identified.
A race condition in Apple's state-handling code allows a locally installed app to crash the system or cause unexpected termination of system processes on iOS, iPadOS, macOS, tvOS, visionOS and watchOS. The flaw carries a CVSS 3.1 score of 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) — availability-only impact, local attack vector, high complexity — and is fixed in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, and tvOS, visionOS and watchOS 27. Neither public exploit code nor CISA KEV activity has been recorded, and EPSS puts exploitation probability at roughly 0.2% (10th percentile), so this is a patching-hygiene item rather than an emergency.
Universal cross-site scripting (UXSS) in Apple Safari and WebKit on iOS, iPadOS, macOS, and visionOS below version 27 allows an attacker to inject script into the context of any site once a victim opens a maliciously crafted .webarchive file. The root cause is a logic/state-management issue in webarchive handling (CWE-79); exploitation requires user interaction (UI:R) to deliver and open the file, and there are no authentication prerequisites (PR:N), as reflected in the independently assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and EPSS is low at 0.15% (4th percentile), though the UXSS scope change and high confidentiality/integrity impact make patching important.
Mounting a maliciously crafted disk image on unpatched Apple devices triggers an out-of-bounds write in image-parsing code, leading to memory corruption and unexpected system termination (denial of service). Affected platforms include iOS/iPadOS before 26.7 and 27, and macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27. Apple has shipped fixes in iOS 26.7/27, iPadOS 26.7/27, and the corresponding macOS releases; no public exploit code or active exploitation has been identified, and EPSS is negligible at 0.17% (7th percentile), indicating a low-likelihood, availability-only defect.
Kernel memory disclosure in Apple's client operating systems - iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.8 and macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6 - allows a locally installed, low-privilege application to read portions of kernel memory that should have been redacted, leaking sensitive data from kernel address space. The flaw is rated CVSS 3.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and is bounded to confidentiality loss with no integrity or availability impact and no arbitrary kernel read. There is no public exploit identified at time of analysis, EPSS is only 0.20% (10th percentile), and the issue is not in CISA KEV; Apple has released fixes across all affected platforms. Because the attacker must already have a malicious or compromised app installed and running on the device, this is best treated as a low-priority information-disclosure building block rather than a standalone compromise path.
Denial of service in Apple iOS, iPadOS, and macOS results from an integer overflow (CWE-190) that a locally installed and executing application can trigger to cause unexpected system termination. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.5) confirms local access with low privileges, no user interaction, and impact limited to availability - there is no confidentiality or integrity loss and no remote or network-triggerable path. This is a genuinely low-priority issue despite its MEDIUM rating: EPSS is 0.20% (10th percentile), no public exploit code was identified at time of analysis, there is no CISA KEV listing, and Apple has shipped fixed versions (iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27), leaving exposure limited to unpatched devices on which an attacker can already run code.
Information disclosure in Apple iOS and iPadOS (versions before 26.7 and before 27) lets a locally installed app determine which other apps the user has installed, exposing a device-fingerprinting and privacy surface rather than files, credentials, or user data. The root cause is a state-management defect (CWE-200) that Apple fixed in iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27. Exploitation requires the victim to install and run a malicious sandboxed app on the target device (CVSS AV:L, PR:L), so there is no remote or unauthenticated path; no public exploit code has been identified at time of analysis, and EPSS is 0.17% (7th percentile), consistent with a low-severity, low-priority finding.
Connecting an attacker-controlled hardware accessory to an unpatched iPhone, iPad, or Mac can drive a memory corruption fault that terminates the system (unexpected system termination) in iOS/iPadOS before 26.7 and before 27, and in macOS Tahoe before 26.7 and macOS Golden Gate before 27. The vendor describes the root cause as insufficient input validation (CWE-20) on data supplied by the attached peripheral; the vector requires no privileges on the target device (PR:N) but does require the victim to physically attach the malicious accessory and to interact with it (UI:R), and the impact is availability-only with no confidentiality or integrity loss. Apple has released fixes (iOS/iPadOS 26.7 and 27, macOS Tahoe 26.7 and macOS Golden Gate 27), the vendor score is 5.5, EPSS is 0.15% (5th percentile), and there is no CISA KEV listing and no public exploit identified at time of analysis.
An unauthenticated attacker positioned within radio range of an Apple iPhone or iPad can send specially crafted wireless input that causes the device to terminate unexpectedly (crash/restart), due to an input validation failure in the affected platform. The flaw is rated CVSS 6.5 (AV:A, A:H) and affects iOS and iPadOS before version 27; Apple has released a fixed version and no public exploit code or active exploitation has been identified (EPSS 0.14%, 4th percentile). Impact is limited to availability - there is no confidentiality or integrity impact.
An out-of-bounds write in Apple's image processing pipeline (CWE-787) allows a maliciously crafted image to corrupt memory when it is viewed on affected Apple platforms. Apple addressed the flaw with improved bounds checking in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, and visionOS 27. The CVSS 3.1 base score of 6.5 reflects a network-delivered attack requiring the victim to open the image (UI:R), with impact limited to availability (C:N/I:N/A:H); EPSS is very low at 0.18% (7th percentile) and there is no public exploit identified at time of analysis.
Improper access control in Apple's iOS, iPadOS, macOS, visionOS, and watchOS allows a locally installed app running with ordinary, non-privileged permissions to read sensitive user data that should be isolated from it. Exploitation requires the attacker to already have a malicious app executing on the device (CVSS 3.1 AV:L/PR:L/UI:N, confidentiality-only C:H/I:N/A:N, base 5.5), so there is no remote or unauthenticated path and no additional user interaction beyond installing and launching the app. Apple addressed the flaw with improved checks, and vendor-released patches are available in iOS/iPadOS 26.7, iOS/iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, visionOS 27, and watchOS 27; no public exploit code has been identified and EPSS is low at 0.20% (10th percentile), so this reads as a modest, locally-gated confidentiality issue rather than an urgent priority.
Apps installed on Apple iOS/iPadOS, tvOS, visionOS, and watchOS prior to version 27 can read the user-assigned device name without the additional authorization Apple intended, an improper permission-management flaw tracked as CVE-2026-86893 and fixed in the iOS 27, iPadOS 27, tvOS 27, visionOS 27 and watchOS 27 releases. The issue requires a malicious or compromised app already running locally with ordinary low-privilege sandbox access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base score 3.3) and yields nothing beyond disclosure of that single low-sensitivity identifier - no code execution, no privilege escalation, and no effect on integrity or availability, with macOS unaffected. There is no public exploit identified at time of analysis, EPSS is 0.16% (6th percentile), and the CVE is not in CISA KEV; the practical gate is getting a hostile app onto the device in the first place, which keeps real-world exposure low.
Incorrect authorization handling in Apple's iOS, iPadOS, macOS, and tvOS lets a locally installed app reach sensitive user data that should be fenced off by the platform's state and sandbox checks. The flaw is a local, low-privilege issue (CVSS 5.5, AV:L/PR:L) requiring a malicious or compromised app already running on the device — no network vector and no user interaction beyond launching the app. Apple has shipped fixes in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, and tvOS 27; EPSS is very low (0.17%, 6th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis.
An out-of-bounds read in Apple's kernel, fixed across iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27, allows a locally installed application to disclose kernel memory to user space. The flaw (CWE-125) stems from insufficient input validation in a kernel code path reached by app-supplied data, and yields high confidentiality impact only - no integrity or availability loss. Apple has released patches for all affected platforms; EPSS is very low (0.15%, 5th percentile), and there is no public exploit code or CISA KEV listing at time of analysis.
Improper access control in Apple iOS, iPadOS, and macOS lets a locally installed application running with low privileges read sensitive user data, with no user interaction required, affecting iOS and iPadOS before 26.7 and before 27 and macOS before Sequoia 15.8, Tahoe 26.7, and Golden Gate 27. Apple fixed the authorization flaw (CWE-285) through improved access control as part of its 26.7/27 release cycle, so vendor patches are available for every affected platform. At a CVSS base score of 5.5 and an EPSS score of only 0.19% (9th percentile), this is a moderate-severity, low-priority local authorization issue; no public exploit code has been identified at time of analysis.
Archive expansion on Apple operating systems can slip past Gatekeeper's file-quarantine checks, allowing unsigned or un-notarized code inside a crafted archive to run without the normal block or warning prompt; macOS (Sequoia, Tahoe and Golden Gate), iOS/iPadOS, visionOS and watchOS are all affected and remediated in the 26.7/27 and 15.8 releases documented in Apple advisories 149034-149043. The flaw is local in nature (CVSS:3.1/AV:L/AC:L), requires the archive to actually reach and be expanded on the device, and carries bounded impact (C:L/I:L/A:N) because it defeats a trust warning rather than granting elevated execution - though the vendor's vector assumes low privileges and no user interaction while our independent assessment treats the expand/open step as user-driven. There is no public exploit identified at time of analysis and no CISA KEV listing, with EPSS at 0.18% (8th percentile), making this a genuinely low-priority issue despite the security-relevant nature of a Gatekeeper bypass; exploitation status is 'no public exploit identified at time of analysis'.
An out-of-bounds write in Apple's operating systems - iOS and iPadOS before 26.7 and before 27, macOS before Sequoia 15.8, before Tahoe 26.7 and before Golden Gate 27, tvOS before 27, and visionOS before 27 - allows a remote, unauthenticated attacker to crash the application that processes a maliciously crafted file, with the flaw addressed through improved bounds checking. Successful exploitation requires the victim to open or process the attacker-supplied file (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L), and the realized impact is limited to termination of the processing app with no confidentiality or integrity effect and no system-wide crash. Vendor patches are available from Apple across all affected platforms, the EPSS score is low at 0.20% (10th percentile), and no public exploit has been identified at time of analysis. This is a genuinely low-priority issue despite the memory-corruption class.
A race condition in Apple's OS state-handling code (CWE-362) lets an application already executing on an affected device crash the system, causing unexpected termination and a local denial of service across iOS/iPadOS, macOS, tvOS, visionOS and watchOS. Only local, already-installed apps can reach the flaw (AV:L, PR:L), and because the attacker must reliably win a narrow timing window (AC:H), exploitation is difficult; there is no data exposure or code execution, only availability impact (CVSS:3.1 4.7). No public exploit code has been identified at time of analysis, EPSS is a low 0.18% (8th percentile), and vendor patches are already released in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27, so this is a low-to-moderate priority hardening item rather than an urgent threat.
Heap-based buffer overflow in Apple's operating system platforms - iOS and iPadOS (before 26.7 and 27), macOS Golden Gate (before 27), visionOS (before 27), and watchOS (before 27) - allows a remote attacker to crash the processing application by delivering a maliciously crafted file that the victim opens. Successful exploitation requires user interaction (CVSS UI:R) and leads only to unexpected termination of the affected app; there is no confidentiality or integrity impact and no described code execution or system-wide compromise, which is why our independent assessment lowers the availability impact to A:L rather than the vendor's A:H. No public exploit code has been identified at time of analysis and exploitation is not confirmed actively exploited (CISA KEV); EPSS is 0.18% (8th percentile), indicating a low predicted likelihood of exploitation. Vendor patches are available.
Opening a maliciously crafted file on an unpatched Apple device can crash the parsing process or disclose its memory contents, an out-of-bounds read that Apple addressed with improved input validation and fixed in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, and visionOS 27. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L), exploitation is unauthenticated from the network but hinges entirely on user interaction - the victim must open the crafted file - and impact is confined to the vulnerable process as a limited read-only disclosure or denial of service, with no code execution or data modification. EPSS is 0.18% (7th percentile), no public exploit has been identified at time of analysis, and vendor patches are already available, making this a low-priority issue despite the network attack vector.
An out-of-bounds read in Apple's font-processing code can crash (terminate) an application on iOS, iPadOS, macOS, tvOS, visionOS and watchOS when it parses a maliciously crafted font file, but it cannot be used to execute code, escalate privileges, or steal data. The issue affects iOS/iPadOS before 26.7 and before 27, macOS before Sequoia 15.8, Tahoe 26.7 and Golden Gate 27, and tvOS, visionOS and watchOS before 27, and it is fixed in those listed releases; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, score 4.3) confirms that unauthenticated remote attackers can only succeed if a victim is induced to open or render the crafted font (user interaction required), and exploitation yields availability loss only. No public exploit code has been identified at time of analysis and the EPSS score is 0.21% (11th percentile), so real-world exploitation is unlikely; this is a genuinely low-priority issue despite the network attack vector.
Network traffic integrity can be silently undermined on unpatched Apple platforms - iOS and iPadOS before 27, macOS Golden Gate before 27, tvOS before 27, and watchOS before 27 - by an unauthenticated attacker who already holds a privileged on-path network position between the device and its peer. Apple fixed the underlying cryptographic weakness through improved integrity checks in the 27-generation releases, restoring the guarantee that intercepted traffic cannot be modified undetected. Exploitation is constrained by the adjacency requirement (AV:A) and high attack complexity (AC:H), EPSS is only 0.17% (7th percentile), and no public exploit code has been identified at time of analysis.
A local permission-enforcement flaw in Apple's operating systems lets an app escalate read-only access to a file into full modify capability, so it can alter content it was only ever authorized to view. The issue affects iOS and iPadOS before 27, macOS before 15.8, 26.7, and 27, tvOS before 27, and visionOS before 27, and carries a modest CVSS 5.5 (AV:L/PR:L, integrity-only impact) with an EPSS of just 0.20% at the 10th percentile. Exploitation is not remotely reachable and no public exploit has been identified at time of analysis; Apple has shipped fixes, so risk is concentrated in unpatched devices running a local malicious or compromised app.
Processing a maliciously crafted image on unpatched Apple platforms can leak uninitialized process memory, exposing small, non-deterministic fragments of data that happened to be in memory at decode time. Affected are iOS and iPadOS before 26.7 and before 27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, plus tvOS, visionOS, and watchOS before 27; the CVSS vector (AV:N/AC:L/PR:N/UI:R) means no credentials or special configuration are needed but the victim must open, preview, or otherwise trigger decoding of the attacker-supplied image. Impact is limited to confidentiality (C:L) with no integrity or availability effect, EPSS is a low 0.18% (8th percentile), and no public exploit has been identified at time of analysis; Apple has shipped fixed versions for every affected platform, so the practical priority is routine patch cadence rather than emergency response.
Improper authorization in Apple's mobile and wearable operating systems - iOS and iPadOS, tvOS, visionOS, and watchOS - lets an app that is already installed and running on the device reach sensitive user data it should not be able to see. The flaw stems from weak state management in an authorization check (CWE-285) and is fixed in iOS 27, iPadOS 27, tvOS 27, visionOS 27, and watchOS 27. Exploitation requires a malicious or compromised app already resident on the device (CVSS:3.1/AV:L/PR:L/UI:N, 5.5), so it is bounded by Apple's App Store review, sandboxing, and code-signing controls; there is no remote or unauthenticated path, macOS is not affected, EPSS sits at 0.16% (6th percentile), and no public exploit has been identified at time of analysis. This is a genuinely low-priority issue despite its medium CVSS score.
A memory-safety defect (out-of-bounds read, CWE-125) in Apple's iOS, iPadOS, macOS, tvOS, visionOS, and watchOS can be triggered by a locally running application and causes an unexpected system termination - a denial-of-service/availability impact with no confidentiality or integrity loss. Affected versions are those prior to the fixed releases: iOS/iPadOS before 26.7 (and before 27), macOS before Sequoia 15.8, before Tahoe 26.7, and before Golden Gate 27, plus tvOS, visionOS, and watchOS before 27. Exploitation requires the attacker to already have a malicious app running on the device with its own app-level privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, scored 5.5); no public exploit code has been identified at time of analysis, EPSS is low at 0.21% (11th percentile), and there is no CISA KEV entry. Apple has released patched versions, so the practical exposure is limited to unpatched devices running a hostile app - a low-to-moderate priority issue.
A locally installed app on unpatched Apple platforms can read a persistent account identifier it is not authorized to access, handing the app a stable value that could be used to correlate or track a user across apps and sessions. Impact is confined to privacy-relevant information disclosure: the assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (3.3), meaning a low-privilege app must already be installed and running on the device, with no remote or network vector and no user interaction beyond launching that app. Affected are iOS and iPadOS before 27, macOS before 27 (Golden Gate) and before 26.7 (Tahoe), tvOS before 27, visionOS before 27, and watchOS before 27, all of which now have fixed releases. This is a low-priority issue overall: exploitation is not confirmed, no public exploit identified at time of analysis, and EPSS is just 0.19% (9th percentile).
Improper authorization in Apple's Shortcuts messaging action allows a crafted shortcut to send messages on an unpatched device without the confirmation prompt the user would normally see. Affected platforms are iOS/iPadOS, macOS Golden Gate, tvOS, visionOS and watchOS in all versions prior to the 27 release train, across the CPE-listed Apple product families. Exploitation requires the victim to obtain and run a malicious shortcut (unauthenticated but user-interaction dependent, UI:R) and is limited to unauthorized message sending with low confidentiality and integrity impact; there is no public exploit identified at time of analysis and EPSS is only 0.16% (6th percentile), making this a genuine but low-to-moderate severity issue rather than a high-priority emergency. Vendor patches are available as iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27.
Improper authentication state management in Apple iOS and iPadOS versions prior to 27 lets someone with physical access to an already-unlocked iPhone or iPad view stored Wi-Fi passwords without supplying credentials. The flaw is purely physical (CVSS:3.1/AV:P/AC:L/PR:N/UI:N), carries a high confidentiality impact (C:H) but no integrity or availability effect, and does not affect devices running iOS 27 or iPadOS 27, where Apple corrected the state-handling logic. Exploitation is confirmed to be neither remotely reachable nor scalable, EPSS is only 0.21% (11th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis.
Unexpected system termination (denial of service) is possible on unpatched Apple platforms after a locally installed, already-executing app triggers a type confusion in OS memory handling - affecting iOS/iPadOS before 26.7 and before 27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, and tvOS, visionOS and watchOS before 27. The flaw is strictly local: the attacker must first get code running as an app on the device (AV:L, PR:L, UI:N per the assessed CVSS:3.1 vector), and successful exploitation produces only a crash with no confidentiality or integrity impact (C:N/I:N/A:H, base score 5.5). Apple has released patches, exploitation yields denial of service only, and no public exploit code or CISA KEV listing has been identified at time of analysis; EPSS is low at 0.17% (7th percentile).
Local denial-of-service in Apple iOS, iPadOS, and visionOS lets an app already executing on the device exhaust resources or crash a system service by abusing an OS interface that failed to enforce required entitlement checks, producing an availability-only impact (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Exploitation is constrained to locally installed, attacker-controlled or compromised apps (PR:L, AV:L), so there is no remote or unauthenticated path and no data exposure or code-integrity loss. Apple addressed the flaw by adding entitlement validation in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and visionOS 27; no public exploit code has been identified at the time of analysis and EPSS is low at 0.16% (6th percentile), consistent with a narrow local-only attack surface.
A privacy flaw in Apple operating systems lets a malicious application already running on the device determine the user's current location, because location data was not properly redacted from log entries (CWE-532). The issue is local-only: the CVSS vector (AV:L, PR:L, UI:N, C:H/I:N/A:N) means an attacker must first get a malicious app installed and executing on the target device, after which no further user interaction is needed, and the impact is confined to confidentiality - the user's location is disclosed with no integrity or availability effect. Apple has fixed the flaw in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27; there is no public exploit identified at time of analysis, EPSS is very low (0.21%, 11th percentile), and the practical barrier is Apple's app-distribution controls rather than any remote attack path.
A use-after-free (CWE-416) in Apple's memory management code allows a locally running application on iOS, iPadOS, macOS, tvOS, visionOS and watchOS to crash the affected system, producing an unexpected termination or reboot. The flaw affects all platforms before the fixed releases (iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27) and rates CVSS 5.5 (AV:L/PR:L/UI:N, availability-only impact). No public exploit code or active exploitation has been identified, and EPSS is low at 0.21% (11th percentile), so this is a patched, availability-only issue rather than an urgent remote-code-execution threat.
Improper memory handling in Apple iOS, iPadOS, and macOS lets a locally running application trigger an unexpected system termination, crashing the device or the operating system; affected versions are iOS/iPadOS prior to 26.7 or 27, and macOS prior to Golden Gate 27, Sequoia 15.8, and Tahoe 26.7. The only prerequisite is the ability to run a malicious or malformed app on the target device (local access, PR:L, no user interaction and no network reachability), and the demonstrated impact is limited to availability - no code execution, privilege escalation, or data access. No public exploit identified at time of analysis, no evidence of active exploitation (not in CISA KEV), EPSS is 0.20% (10th percentile), and vendor patches have been released.
Locally installed applications on Apple iOS/iPadOS, macOS Golden Gate, tvOS, and watchOS releases prior to version 27 can bypass intended permission restrictions and read sensitive user data they should be denied. Exploitation requires a malicious or compromised app already running on the device (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 5.5 MEDIUM) - there is no network-reachable path, so an attacker must first deliver an app through the App Store, sideloading, or enterprise/MDM distribution, after which no further user interaction is needed. There is no public exploit identified at time of analysis and the EPSS score is 0.16% (6th percentile); Apple has shipped fixes in the version 27 releases across all four affected platforms, so exposure is limited to unpatched devices below version 27.
Insufficient permission restrictions in Apple's iOS/iPadOS, visionOS, and watchOS allow an app already installed and running locally on the device to reach sensitive user data it should not be able to read. Exploitation requires local code execution with the privileges of a normal installed app (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and yields confidentiality impact only - no integrity or availability effect, and no remote or unauthenticated path. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is 0.16% (6th percentile), so this is a low-priority, patch-and-move-on issue that is fully resolved by updating to iOS 27/iPadOS 27, visionOS 27, or watchOS 27; macOS and tvOS are not listed as affected.
An app on an affected Apple device can bypass authorization checks and read sensitive user data it should not be able to reach, due to improper state management in iOS and iPadOS before 26.7 and before 27, tvOS before 27, and visionOS before 27. The attacker must already have a malicious or compromised app installed and running locally on the device with ordinary low-level sandbox privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), so there is no remote or network attack surface and no user interaction is needed once that app is present; the impact is confidentiality-only (C:H) with no code execution, integrity, or availability effect, and macOS is unaffected. There is no public exploit identified at time of analysis, EPSS is negligible at 0.16% (6th percentile), and Apple has released fixed versions (iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, tvOS 27, visionOS 27) - Apple self-reports the issue, though the CVE record carries no vendor attribution in the reference metadata.
Mounting a maliciously crafted disk image or removable-media volume on an unpatched Apple device triggers a heap buffer overflow in the operating system's volume-parsing code, causing unexpected system termination (denial of service). Affected builds are iOS/iPadOS before 26.7 and 27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate 27. Exploitation is gated by mandatory user interaction - the crafted volume must be attached and mounted by the victim - and the assessed impact is limited to system termination with no code execution, data disclosure, or persistence; EPSS is only 0.19% (9th percentile) and no public exploit code has been identified, though Apple has released patched versions and CISA KEV does not list this CVE. Real-world risk is LOW-to-MODERATE despite the 6.5 (Medium) CVSS, since the practical attack path is local/physical delivery rather than network reach.
Kernel memory corruption in Apple's operating systems lets an app running on the device crash the system or corrupt kernel memory, with the independent assessment scoring integrity and availability impact as High (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H). Every unpatched device is exposed once a user launches a malicious or compromised app: no network vector, no user interaction beyond app execution, and no special configuration is required. There is no confirmed active exploitation (CISA KEV does not list this CVE) and no public exploit code identified at time of analysis, and EPSS is low at 0.21% (11th percentile), so real-world urgency is modest even though the flaw sits in the kernel. Apple has shipped fixed builds across all affected platforms: iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27.
Bypass of on-device network restrictions in Apple iOS/iPadOS, macOS Golden Gate, visionOS, and watchOS builds prior to version 27 allows a locally installed, already-running app to reach network resources the operating system should have blocked, producing low confidentiality and low integrity impact with no availability effect. Exploitation requires an app that is already installed and executing with normal, authenticated app privileges on the target device (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, score 4.4); there is no remote or unauthenticated attack path, no public exploit identified at time of analysis, and EPSS is a low 0.21% (11th percentile). Apple has shipped vendor-released fixes in iOS 27, iPadOS 27, macOS Golden Gate 27, visionOS 27, and watchOS 27.
Local apps on iOS, iPadOS, and visionOS can bypass certain Privacy preference controls and reach sensitive data they were never authorized to see; Apple addressed it by removing sensitive data from the reachable location. Affected are iOS and iPadOS before 26.7 and before 27, plus visionOS before 27, with fixes shipped in iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, and visionOS 27. Exploitation is local-only and requires a malicious or overprivileged app to already be installed and running on the device (CVSS 3.3, AV:L/PR:L/UI:N, low confidentiality impact); there is no public exploit identified at time of analysis and EPSS is negligible at 0.17% (7th percentile).
Unexpected system termination in Apple operating systems can be triggered by a locally installed app that wins a race condition in system state handling, affecting iOS/iPadOS before 27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, tvOS before 27, visionOS before 27, and watchOS before 27. The defect is availability-only (C:N/I:N/A:H) with a local attack vector (AV:L), high attack complexity (AC:H), and low privileges required (PR:L), meaning an authenticated app must hit a narrow timing window to crash the system. No public exploit identified at time of analysis and no confirmation of active exploitation (not in CISA KEV); EPSS is 0.20% (10th percentile), and Apple has released patched versions.
Improper bounds checking during image processing on unpatched Apple operating systems lets a crafted image crash the application that renders it, affecting iOS and iPadOS before 27, macOS Golden Gate before 27, tvOS before 27, visionOS before 27, and watchOS before 27. The defect is scored 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L), meaning an unauthenticated remote attacker can trigger it only if the victim opens or renders the malicious image, and the outcome is limited to unexpected application termination rather than code execution, data disclosure, or integrity loss. No public exploit code has been identified and there is no confirmed active exploitation; EPSS is a low 0.21% (12th percentile), so this is a low-to-moderate priority issue rather than an emergency.
Out-of-bounds memory corruption in Apple's 3D scene processing pipeline lets a maliciously crafted scene file terminate the application that renders it across iOS/iPadOS, macOS, tvOS, visionOS and watchOS builds released before the fixed versions. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L (score 4.3): no authentication or elevated privileges are required, but the attacker cannot succeed without the victim opening or rendering the supplied scene, and the resulting impact is confined to application termination with no confidentiality, integrity, or demonstrated code-execution effect. No public exploit identified at time of analysis, EPSS is 0.18% (8th percentile), and Apple has shipped patches for every affected platform, making this a low-priority denial-of-service defect rather than a code-execution emergency.
Kernel memory disclosure on unpatched Apple devices allows a locally running, low-privilege app to read kernel memory that it should not be able to access, potentially exposing sensitive kernel-side data. The issue - an information-disclosure weakness (CWE-200) caused by improper memory management - affects iOS and iPadOS before 26.7 and before 27, macOS Tahoe before 26.7 and macOS Golden Gate before 27, and tvOS, visionOS and watchOS before 27, and is fixed in the corresponding 26.7/27 releases. Exploitation requires the attacker to already be executing code inside a sandboxed app on the target device (CVSS 3.1 3.3, AV:L/AC:L/PR:L/UI:N, confidentiality-only impact), so overall risk is low; no public exploit identified at time of analysis, with an EPSS score of roughly 0.2% (10th percentile) and no CISA KEV listing.
Loading maliciously crafted web content in Apple's WebKit engine can crash the renderer or host process on Safari, iOS/iPadOS, macOS, tvOS, visionOS and watchOS builds earlier than the version 27 releases, producing a denial-of-service condition rather than code execution or data exposure. The flaw is a state-management logic error in the type-confusion class (CWE-843), and it is reachable from a remote web-content delivery path, so exploitation hinges on getting a victim to open a hostile page or embed WebKit content. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; EPSS is only 0.14% (4th percentile), and Apple has shipped fixed '27' releases across all affected platforms, so the practical risk is moderate and availability-only. Note that Apple's published vector lists PR:L/UI:N while our assessment uses PR:N/UI:R, a contradiction worth confirming with the vendor.
Uninitialized kernel memory disclosure in Apple's operating system family allows a local app that already holds root privileges to read residual data left in kernel memory buffers, an information-leak primitive that exposes potentially sensitive kernel memory contents. The flaw is fixed across iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27, so affected users should update promptly. No public exploit code has been identified at time of analysis, and EPSS places the probability of exploitation at roughly 0.17% (7th percentile), consistent with the assessment that the mandatory root prerequisite - the attacker must already be running code at the highest local privilege level - makes this a post-compromise leak rather than an initial-access or privilege-escalation primitive, and a genuinely low real-world priority despite the 6.2 Medium base score.
An out-of-bounds write in Apple's NTLM handling can terminate affected applications on iOS, iPadOS and macOS when they process maliciously crafted NTLM authentication input, yielding a denial-of-service primitive with no confidentiality or integrity impact. Per Apple's CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 6.2) exploitation is local, requires no privileges and no user interaction beyond the target app parsing the crafted NTLM data, and is constrained to versions before iOS 27, iPadOS 27 and macOS Golden Gate 27. Real-world risk is LOW-to-MODERATE and consistent across signals: EPSS is 0.16% (5th percentile), the issue is not listed in CISA KEV, and no public exploit code has been identified at time of analysis, though Apple has released patched versions.
An authorization flaw in Apple's operating systems (iOS/iPadOS, macOS, tvOS, visionOS, watchOS) lets a locally installed, malicious or compromised app read sensitive user data that should be off-limits to it, due to improper state management in the platform's authorization checks. Only devices running versions prior to the fixed releases are exposed: iOS/iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. Exploitation is strictly local - the attacker must already have code running on the target device - and there is no public exploit identified at time of analysis, with a low EPSS of 0.18% (7th percentile) reflecting the limited attack surface. This is a genuine but low-priority local authorization issue with high confidentiality impact but no integrity or availability impact.
Locally installed apps on unpatched Apple platforms (iOS and iPadOS before 27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, and tvOS, visionOS and watchOS before 27) can read sensitive user data that the system wrote into logs without adequate redaction. Apple fixed the flaw by improving data redaction in the release train listed in its security advisories. Impact is confidentiality-only and strictly local, with no network attack path, and a low EPSS of 0.18% (7th percentile) reflects that; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis. One prerequisite discrepancy is worth noting: the published vector requires user interaction (UI:R), while our assessed vector treats the app as already installed and running without interaction.
An out-of-bounds write in Apple's image handling code can terminate an application on iOS and iPadOS before 26.7 and on macOS before Golden Gate 27 when a user opens a maliciously crafted image. The attacker needs no credentials or privileges, but the victim must actively render the attacker-supplied image, and the maximum assessed impact is availability only (app crash) with no code execution, privilege gain, or data exposure. Exploitation is not confirmed in the wild (no CISA KEV listing), EPSS is 0.15% (5th percentile), and no public exploit code has been identified; Apple has shipped fixes in iOS 26.7, iPadOS 26.7, and macOS Golden Gate 27.
Processing maliciously crafted web content in Apple's WebKit-based browser stack can disclose sensitive user information across Safari 27, iOS/iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27 and earlier. Apple classifies the root cause as an improper privilege management (permissions) issue and fixed it by removing the vulnerable code rather than adding a check, per the vendor advisories referenced for CVE-2026-64753. Real-world urgency is currently low: EPSS is 0.14% (4th percentile), there is no CISA KEV listing or public exploit identified at time of analysis, and CISA's SSVC assessment is exploitation:none / automatable:no / technical impact:partial, while a vendor patch is already available.
Path traversal in Apple iOS/iPadOS and watchOS lets a locally installed, low-privileged app write outside its intended file-handling path and modify protected system files, producing a high integrity impact with no data disclosure or denial of service claimed. Apple addressed the issue through improved input validation in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, and watchOS 27, so unpatched devices below those releases remain exposed. Exploitation is gated: the attacker must already have a malicious app executing on the device, no public exploit code has been identified at time of analysis, and EPSS is 0.16% (6th percentile), consistent with a moderate, local-only risk rather than an urgent one.
Holding a locked iPhone or iPad, an attacker can reach a lockscreen-accessible interface that improperly passes an authentication check, allowing sensitive user information to be viewed without the passcode being entered. The flaw is a logic error classed as CWE-287 (improper authentication) that affects iOS and iPadOS builds prior to 26.7 and 27, and Apple has shipped fixes in iOS/iPadOS 26.7 and iOS/iPadOS 27, so it is fully remediated by updating. Exploitation requires hands-on physical possession of the locked device and cannot be performed remotely or at scale; EPSS is 0.17% (6th percentile) and no public exploit has been identified at time of analysis, making this a low-to-medium real-world priority driven mostly by confidentiality exposure on lost or stolen devices.
A type confusion flaw (CWE-843) in multiple Apple operating systems lets an already-installed, locally executing app trigger a type-handling error that ends in unexpected system termination, giving a crash-based denial of service but no path to code execution, privilege gain, or data access. Affected are iOS/iPadOS before 26.7 (and the 27 line before 27), macOS before Sequoia 15.8, Tahoe 26.7 or Golden Gate 27, and tvOS, visionOS and watchOS before 27; Apple has shipped fixed versions in each of those releases, and exploitation requires an authenticated local app context (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). No public exploit code has been identified at time of analysis and EPSS is only 0.17% (7th percentile), so despite the MEDIUM 5.5 rating this is a genuinely low-priority issue with limited impact beyond a system crash.
iCloud Private Relay on Apple platforms could disclose a user's real IP address to a website even while the privacy proxy is active, because of a state-management flaw in the relay implementation. The issue affects iOS and iPadOS before 18.7.10 and before 26.6.1, macOS Tahoe before 26.6.2, and visionOS before 26.6.1, and requires the victim to browse to attacker-controlled web content (UI:R, no privileges needed). Severity is modest (CVSS 4.3, confidentiality-only) and there is no CISA KEV listing or public exploit identified at time of analysis, but the privacy impact is disproportionate for users who depend on Private Relay for anonymity.
A use-after-free memory management flaw in Apple iOS and iPadOS allows a locally installed application to crash the system, causing unexpected device termination (denial of service). All versions prior to iOS 27 / iPadOS 27 are affected per the vendor CPE wildcard and ENISA EUVD version range (0 < 27). Apple addressed the issue with improved memory management in iOS 27 and iPadOS 27; no public exploit code has been identified and the EPSS probability is very low (0.17%, 7th percentile), so this is primarily a stability/patch-hygiene issue rather than an active exploitation threat.
A local permission-assignment flaw in Apple's mobile and desktop operating systems lets an app installed on the device modify protected parts of the file system, giving it an integrity-only foothold outside its normal sandbox boundaries. Affected platforms are iOS and iPadOS before 26.7 and 27, and macOS before Golden Gate 27, Sequoia 15.8, and Tahoe 26.7; exploitation requires a locally-installed, running app plus user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N), with no confidentiality or availability impact and no remote or network reachability. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV), and EPSS sits at 0.17% (7th percentile), so this is a moderate, not urgent, priority that is addressed by vendor-released updates.
An information disclosure flaw in Apple's iCloud Private Relay lets a website determine a visitor's real IP address even when Private Relay is switched on, defeating the core privacy guarantee of the feature. The issue affects iOS and iPadOS before 26.6.1, macOS before 26.6.2 (Tahoe), and visionOS before 26.6.1, and is reachable from the network but requires the victim to browse to an attacker-controlled page. Apple addressed it through improved state management, and no public exploit code or active exploitation has been identified at time of analysis.
Information disclosure in Apple iOS and iPadOS versions before 27 allows a locally installed malicious or compromised app to access sensitive user data after the user installs and opens it. The flaw is a permissions issue (CWE-200) that Apple addressed with additional restrictions in iOS 27 and iPadOS 27. No public exploit identified at time of analysis and EPSS is 0.17% (7th percentile), but the CVSS score of 5.5 reflects the high confidentiality impact; exploitation requires local app execution and user interaction, with no remote path.
Sensitive user data disclosure in Apple iOS and related platforms allows a locally installed malicious app to bypass entitlement checks and access protected data, affecting Safari before 27, iOS/iPadOS before 26.7 and 27, macOS before Golden Gate 27, and visionOS before 27. The flaw requires local app installation and user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R) and only impacts confidentiality (C:H) with no integrity or availability effect. No public exploit has been identified at time of analysis, and EPSS is 0.18% (7th percentile), indicating low exploitation likelihood.
A malicious or compromised app running on iOS and iPadOS prior to 26.7 (and prior to 27), and on visionOS prior to 27, can abuse insufficient path validation to write to protected parts of the file system. Apple addressed the path handling flaw with improved validation in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and visionOS 27, so patched devices are not exposed. Scoring 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N), the issue requires the user to install and launch a hostile app but then needs no additional privileges; EPSS is only 0.17% (6th percentile) and no public exploit code or confirmed active exploitation has been identified at time of analysis, so this is a moderate local-integrity flaw rather than a network-exploitable emergency.
Unexpected system termination can be triggered on Apple devices by a locally executed app that exploits a use-after-free memory corruption in shared system code, which Apple addressed through improved memory management. The flaw affects essentially every current Apple OS branch below the fixed releases — iOS/iPadOS 26.6+, macOS 15.8/26.6+/27, tvOS 26.6+/27, visionOS 26.6+/27 and watchOS 26.6+/27 — with CVSS 5.5 reflecting an availability-only impact and a local attack vector. EPSS is low (0.24%, 16th percentile), no public exploit code has been identified, and there is no CISA KEV entry, so this is a routine patch-cycle item rather than an urgent threat.
A sandboxed application running on Apple iOS/iPadOS, macOS Golden Gate, tvOS, visionOS, or watchOS can bypass authorization checks and read contents of the System Keychain, exposing stored secrets such as credentials, certificates, and tokens. The flaw stems from incorrect authorization combined with faulty state management (CWE-863) and affects all versions prior to the 27 release train; the platform owner has shipped fixes in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. The CVSS v3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, score 5.5) is consistent with our independent assessment: this is a genuine but locally-scoped access-control defect that requires an attacker to get a sandboxed app onto the device and have the user launch it (UI:R), so it cannot be triggered remotely over the network. EPSS is 0.16% (6th percentile) and no public exploit code has been identified at time of analysis, with no CISA KEV listing - impact is limited to confidentiality (keychain disclosure) with no integrity or availability effect, and patched 27-or-newer systems are not exposed.
Sensitive user data can be read by a malicious or compromised app on unpatched Apple devices because a logic-validation flaw lets the app cross its data-access boundary. Affected platforms are iOS and iPadOS before 26.7 and before 27, macOS before Sequoia 15.8, before Tahoe 26.7 and before Golden Gate 27, tvOS before 27, and visionOS before 27; the assessed vector (AV:L/AC:L/PR:N/UI:R/C:H/I:N/A:N) shows the attacker must first get a hostile app onto the device and the user must run it, with confidentiality-only impact. Vendor patches are available for every platform, EPSS rates exploitation probability at roughly 0.18% (7th percentile), and no public exploit has been identified at time of analysis.
Processing a maliciously crafted image on unpatched Apple devices can trigger a memory-corruption fault that crashes the affected process, producing a local denial-of-service (CVSS 3.1 base 5.5, AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Affected platforms are iOS and iPadOS before 18.7.10 and macOS before Sonoma 14.8.8, Sequoia 15.7.8, and Golden Gate 27; the attacker cannot trigger the flaw remotely and must get the victim to open or auto-render the crafted image. All signals point to a low-priority issue: EPSS is 0.20% (10th percentile), no public exploit code has been identified at time of analysis, there is no CISA KEV listing, and vendor patches are already available.
A remote denial-of-service flaw in Apple iOS and iPadOS (all versions before 27) stems from insufficient input validation in a code path that processes remotely supplied content, allowing an attacker to crash or hang the affected feature. Exploitation requires the victim to interact with the malicious input (CVSS UI:R) and yields only availability impact - confidentiality and integrity are unaffected. Apple addressed the issue with improved input validation in iOS 27 and iPadOS 27; there is no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so the practical priority is routine patching rather than emergency response.
Improper access control in Apple iOS and iPadOS, macOS Tahoe, and visionOS lets a locally installed app read user-sensitive data that it should not be able to reach. The flaw (CWE-284) stems from insufficient validation checks and is remediated in iOS/iPadOS 26.6, macOS Tahoe 26.6, and visionOS 26.6; the assessed vector (CVSS 5.5, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) means exploitation requires the victim to install and launch a malicious app on an unpatched build, with no remote attack path and no integrity or availability impact. The attacker's app needs no special privileges, but there is no public exploit identified at time of analysis and EPSS is low at 0.19% (9th percentile), so this is a genuine but low-priority confidentiality issue.
Improper access control (CWE-284) in Apple iOS, iPadOS, and macOS allows a locally installed app to read user-sensitive data outside the permission boundary the operating system is supposed to enforce, an information-disclosure impact rated CVSS 5.5 (confidentiality High, integrity None, availability None). Exploitation is local and requires user interaction: the attacker must first get a malicious or compromised app onto the device and convince the user to launch it (AV:L, PR:N, UI:R), so there is no remote, network-triggerable, or self-propagating path. Apple has released fixes in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27; no public exploit code has been identified at time of analysis and EPSS is low at 0.17 percent (7th percentile), with no CISA KEV listing.
Information disclosure in Apple iOS, iPadOS, macOS, tvOS, visionOS and watchOS allows a locally installed and running app to read a persistent account identifier that the operating system should have kept out of its reach. The root cause is a permissions/sandbox restriction gap (CWE-200), fixed by Apple with additional access restrictions in iOS and iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27; successful exploitation requires the user to install and launch a malicious local app (AV:L/PR:N/UI:R), so a remote, unauthenticated network attack is not possible. There is no public exploit identified at time of analysis and EPSS is 0.18% (8th percentile), making this low-to-moderate risk rather than an urgent priority, with impact confined to the confidentiality of one identifier and no integrity or availability effect.
Persistent device identifier disclosure in Apple iOS, iPadOS, macOS, tvOS, visionOS and watchOS stems from an incorrect authorization check that lets an ordinary, unprivileged installed app read identifiers it should not be able to access (CWE-863, CVSS 5.5, C:H/I:N/A:N). Exploitation is local-only (AV:L, PR:N) and requires user interaction to install and launch a malicious or compromised application on a device running an unpatched OS; there is no remote or network path, and no public exploit code has been identified at time of analysis, with EPSS at 0.17% (7th percentile) and no CISA KEV listing. Apple has released fixed versions and the impact is confined to confidentiality/privacy rather than code execution or data modification.
Improper access control in Apple's operating system family (iOS/iPadOS, macOS, tvOS, visionOS, watchOS) lets a locally installed app bypass intended permission restrictions and read sensitive user data it should not be able to reach. Apple addressed the flaw with additional restrictions in iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. Exploitation requires the attacker to already run code on the device as an app (PR:L, AV:L), and no public exploit code or active exploitation has been identified; EPSS is only 0.20% (10th percentile) and CISA SSVC records exploitation as 'none'.
An integer overflow in Apple's file-processing code, fixed through improved input validation, allows a maliciously crafted file to cause disclosure of process memory on affected Apple platforms. Unpatched devices running iOS/iPadOS before 26.7 and 27, macOS before Sequoia 15.8, Tahoe 26.7 or Golden Gate 27, plus tvOS, visionOS and watchOS before 27 are exposed, but exploitation requires the victim to open the crafted file (CVSS UI:R). There is no public exploit code and no evidence of active exploitation; EPSS is very low at 0.18% (8th percentile) and CISA SSVC rates the issue non-automatable with only partial technical impact, and Apple has released patches.
An improper authorization flaw in Apple iOS/iPadOS and macOS Tahoe allows a locally installed application to reach sensitive user data that the platform's authorization state checks should have blocked. Apple addressed the flaw through improved state management, shipping fixes in iOS 26.6, iPadOS 26.6, and macOS Tahoe 26.6 for all versions prior to those releases. The issue is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, 5.5) with confidentiality impact only; EPSS is 0.15% (5th percentile), CISA SSVC rates exploitation as 'none' and technical impact as 'partial', and no public exploit code was identified at time of analysis.
Sandboxed applications on Apple iOS, iPadOS, macOS, and visionOS can bypass sandbox file-access restrictions and read restricted files because of insufficient path validation in the affected operating system components (CWE-22). Exploitation requires a local attacker to get a crafted sandboxed app installed and launched by the user on a vulnerable device (CVSS 3.1 AV:L/AC:L/PR:N/UI:R), making this a delivery-gated, confidentiality-only information-disclosure flaw rather than a remotely reachable one. Apple has shipped fixes in iOS 26.7 and 27, iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, and visionOS 27; no public exploit code has been identified at time of analysis, the EPSS score is only 0.17% (6th percentile), and the CVE is not listed in CISA KEV.
An incorrect-authorization flaw in Apple's Bluetooth state management allows an already-installed app to obtain Bluetooth access it was never granted, undermining the platform's per-app permission model on iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27 - but only on versions prior to those releases. Apple fixed the issue through improved state handling and published coordinated advisories for every affected platform; a local attacker or malicious app is required, so this is not remotely reachable without code execution already on the device. No public exploit code has been identified and EPSS is very low (0.20%, 10th percentile), so this rates as a patching-hygiene item rather than an emergency.
A use-after-free memory-management flaw in Apple's operating systems allows a locally installed application to crash the system, causing unexpected termination (denial of service) on affected iPhone, iPad, Mac, and Apple Vision Pro devices. Apple addressed the issue across iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and visionOS 27. There is no evidence of active exploitation: CISA KEV does not list the CVE, SSVC records exploitation as 'none' and automatable as 'no', EPSS is a low 0.18% (7th percentile), and no public exploit code has been identified at the time of analysis.
Null pointer dereference in iOS and iPadOS allows a locally installed app to trigger unexpected system termination (device crash/reboot) by supplying crafted input that bypasses input validation. Affected versions span the legacy 18.x branch (prior to 18.7.9) and the current 26.x branch (prior to 26.5), covering a broad swath of Apple mobile devices. No active exploitation has been identified - CISA KEV status is absent, SSVC rates exploitation as none, and EPSS sits at the 1st percentile - placing this squarely as a patch-cycle priority rather than an emergency response item.
Insufficient permissions restrictions in iOS and iPadOS (all versions prior to 26.5) allow a malicious locally-installed app to enumerate other applications installed on the device. The flaw, rooted in improper privilege management (CWE-269), exposes app inventory data that Apple's sandbox model is designed to protect. No public exploit identified at time of analysis, EPSS is extremely low at 0.09%, and SSVC exploitation status is confirmed none - placing this squarely as a low-urgency privacy concern rather than an active threat.
Safari on iOS, iPadOS, and macOS Tahoe crashes when processing specially crafted web content due to improper state management (CWE-703), resulting in a denial-of-service condition. Affected are iOS and iPadOS versions prior to 18.7.10 and 26.6.1, and macOS Tahoe prior to 26.6.2. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; impact is limited entirely to availability.