Watchos
Monthly
An incorrect-authorization flaw in Apple's Bluetooth state management allows an already-installed app to obtain Bluetooth access it was never granted, undermining the platform's per-app permission model on iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27 - but only on versions prior to those releases. Apple fixed the issue through improved state handling and published coordinated advisories for every affected platform; a local attacker or malicious app is required, so this is not remotely reachable without code execution already on the device. No public exploit code has been identified and EPSS is very low (0.20%, 10th percentile), so this rates as a patching-hygiene item rather than an emergency.
Improper access control in Apple watchOS prior to 26.4 allows a person with physical possession of a locked Apple Watch to view the device owner's contacts without authentication. The flaw, classified as CWE-284 (Improper Access Control), stems from insufficient permissions checking on a code path accessible from the lock screen. Apple has confirmed the fix in watchOS 26.4; no active exploitation has been identified per CISA SSVC assessment.
Information disclosure in Apple iOS and iPadOS 26.6, along with macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6, allows a local app to access sensitive user data due to a state management flaw. The vulnerability was addressed with improved state handling, and no public exploit code or active exploitation has been identified; EPSS indicates a low likelihood of real-world attacks.
Unauthorized reading of a persistent device identifier in Apple iOS, iPadOS, tvOS, watchOS, and visionOS allows a malicious app to access a unique identifier without user consent. The issue originates from a permissions enforcement weakness fixed in iOS 26.6, iPadOS 26.6, tvOS 26.6, watchOS 26.6, and visionOS 26.6. No active exploitation or public exploit code is known, and EPSS predicts a very low exploitation probability (0.16%).
UI spoofing in Apple Safari 26.5 and earlier allows attackers using cross-origin framing to misrepresent website identity. The vulnerability requires user interaction (visiting a malicious page) and could lead to phishing or deceptive actions. No active exploitation or public exploit code identified; patch is available.
Unauthorized file read via a sandbox escape vulnerability in Apple iOS, iPadOS, macOS, tvOS, watchOS, and visionOS allows a malicious app to access files outside its designated sandbox. Exploitation requires user interaction to install and launch a malicious app, but no active exploitation or public exploit code is currently known. CVSS medium severity (6.5) is offset by a very low EPSS score (0.17%), indicating low real-world exploitation probability.
A local denial-of-service vulnerability in Apple's operating systems allows a malicious app to cause unexpected system termination by triggering an out-of-bounds read. Fixes are available in version 26.6 for iOS, iPadOS, macOS, tvOS, visionOS, and watchOS; no active exploitation or public exploit has been identified, and EPSS indicates a low probability of exploitation.
We need to generate a comprehensive JSON synthesis based on provided CVE data. The output must be plain text strings, each field a coherent paragraph, following strict rules. Let's analyze the given data. CVE-2026-43801: Description: "This issue was addressed with improved checks. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to access sensitive user data." CVSS: 5.5, vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. CWE-200: Information Exposure. Multi-source intelligence: EPSS 0.17% (6 percentile), Patch: Available from vendor, Reported by: apple. CPEs: many Apple operating systems. Tags: Apple, Information Disclosure, etc. EUVD affected versions list. References: Apple support pages. We need to fill out the JSON fields: product_name: 1-3 words ONLY. Affected product is Apple's operating systems across multiple platforms. The specific product? "Apple iOS" or "Apple macOS"? The vulnerability affects multiple products, but choose primary. Since iOS is listed first, maybe "Apple iOS". Or maybe "Apple iOS and macOS"? It's an app that can access sensitive user data across all these OSs. The product name should be the primary affected product. The CPE includes ios_and_ipados, macos, tvos, visionos, watchos. So it's essentially all Apple OS platforms. Could we say "Apple Operating Systems"? That's not 1-3 words, it's 3 words: "Apple Operating Systems"? Or "Apple OS". The description says "This issue is fixed in iOS 26.6 ..." So the primary product might be the general OS. I'll go with "Apple iOS/macOS" but that's two. I'll say "Apple OS". The rule: "1-3 words ONLY. The specific product or service name affected." If multiple products, pick the primary one. The primary might be "iOS" as it's the first listed. So I'll put "Apple iOS". But it's not just iOS; it's all Apple platforms. However, the CVE description typically picks one platform. I'
We need to analyze CVE-2026-64709 and produce a JSON with the specified fields. Let's gather all input data: - CVE ID: CVE-2026-64709 - Description: "The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to disclose kernel memory." - CVSS Score: 5.5 - CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - CWE: CWE-200 (Information Exposure) - EPSS: 0.17% (percentile 7%), so low. - Patch: Available from vendor - Reported by: apple - CPEs: apple:ios_and_ipados:* (all versions), apple:macos:* (all versions), apple:tvos:*, apple:visionos:*, apple:watchos:* - Tags: Apple, Information Disclosure, Ios And Ipados, Tvos, Visionos, Watchos - SSVC: Exploitation: none, Automatable: no, Technical Impact: partial -> so not currently exploited, not automatable, partial impact. - ENISA EUVD ID: EUVD-2026-49513 - Affected versions list: macOS <14.8.8, macOS <15.7.8, visionOS <26.6, macOS <26.6 (this might be Tahoe, version 26.6?), watchOS <26.6, iOS and iPadOS <26.6, tvOS <26.6. Note the "macOS 0 <26.6" probably refers to macOS Tahoe (version 26.6), but they list macOS 0 <14.8.8 (Sonoma), macOS 0 <15.7.8 (Sequoia), and macOS 0 <26.6 (Tahoe). So three macOS branches. - References: 7 support.apple.com URLs. Now we need to produce a JSON object with the fields. All fields are plain text strings, no arrays, no objects. Let's step through each field: 1. "product_name": 1-3 words ONLY. The primary product. This vulnerability affects multiple Apple operating systems, but the description mentions "An app may be able to disclose kernel memory." The core product is the kernel, but we need to pick one product name that represents the family. The CPEs list iOS and iPadOS, macOS, tvOS, visionOS, watchOS. So the primary product is "Apple iOS" or "Apple macOS"? The description lists multiple, but it says "An app may be ab
Denial-of-service via out-of-bounds write in Apple CoreAudio when processing malicious audio streams. Affected iOS, iPadOS, macOS, tvOS, watchOS, and visionOS versions are vulnerable. No known active exploitation or public exploit code exists at time of analysis, and EPSS probability is low (0.17%).
Information disclosure in Apple iOS/iPadOS versions prior to 26.6 allows a locally installed app to access sensitive user data without proper permissions. Apple has released patches in iOS/iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, and watchOS 26.6. No public exploit or active exploitation has been reported, and the EPSS score indicates a low likelihood of exploitation.
An out-of-bounds write vulnerability in Apple iOS 26.6 and earlier allows a malicious app to cause unexpected system termination (kernel panic). No public exploit or active exploitation has been reported; patch available from Apple.
Denial-of-service in multiple Apple operating systems allows a local network attacker to cause resource exhaustion and system unavailability. The vulnerability is addressed in iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No public exploit or active exploitation has been identified at this time, and the EPSS score is low (0.17%).
Bypass of iframe sandboxing policy in Apple Safari and all Apple operating systems through version 26.5 allows malicious web content to violate sandbox restrictions. Affected users include anyone running Safari on iOS, iPadOS, macOS Tahoe, tvOS, visionOS, or watchOS prior to version 26.6. An attacker can cause integrity violations, such as injecting or modifying content within sandboxed iframes, but requires user interaction (clicking a link or visiting a malicious page) and no public exploit or active exploitation has been identified at this time.
A malicious app can access sensitive user
An inconsistent user interface state management in multiple Apple operating systems allows remote attackers to bypass network filters, potentially leading to unauthorized actions on the system. The vulnerability requires user interaction (e.g., clicking a link) and affects iOS and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No active exploitation has been reported at this time, and the EPSS score (0.27%, 20th percentile) indicates a low immediate threat.
Protected user data exposure in Apple operating systems allows a malicious app with on-device access to read sensitive information through insufficient input sanitization. This CVE-2026-43714 affects iOS and iPadOS before 26.6, macOS Sequoia before 15.7.8, Sonoma before 14.8.8, Tahoe before 26.6, visionOS before 26.6, and watchOS before 26.6. No public exploit has been identified and the low EPSS score
Denial-of-service via type confusion in Apple ImageIO affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Processing a maliciously crafted image can crash an application, with no code execution. No active exploitation or public exploit is known; EPSS 0.17% indicates low likelihood of widespread attacks.
Cleartext transmission of sensitive data in Apple iOS 26.6 and earlier allows an app to access sensitive user data over the network. The issue is fixed by enforcing HTTPS in iOS and iPadOS 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No public exploit has been identified and EPSS risk is low (0.16%).
Local information disclosure in macOS Tahoe and watchOS allows an installed app to access sensitive user data without proper authorization. The vulnerability requires user interaction and is fixed in macOS Tahoe 26.6 and watchOS 26.6. No active exploitation or public exploit has been reported, and EPSS probability is low at 0.15%.
We are tasked with synthesizing data from multiple intelligence sources about CVE-2026-64754 into a comprehensive analysis, returning a JSON object with specific fields. All fields must be plain text strings (paragraphs). We must use all provided data and cross-reference to add value. The output must be grounded in the input data, not invented. Let's extract and analyze the provided data: - CVE ID: CVE-2026-64754 - Description: "An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to a denial-of-service." - CVSS Score: 5.5, Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CWE: CWE-787 (Out-of-bounds Write) - EPSS: 0.16% (percentile 5%) — low exploitation probability. - Patch: Available from vendor (Yes). The fix is listed in the versions above. - Reported by: apple - CPE: apple:ios_and_ipados, apple:macos, apple:tvos, apple:visionos, apple:watchos — all with *:*:*:*:*:*:*. Specific version ranges given by EUVD: macOS 0 <15.7.8, macOS 0 <14.8.8, iOS and iPadOS 0 <26.6, macOS 0 <26.6, watchOS 0 <26.6, tvOS 0 <26.6, visionOS 0 <26.6. Note the macOS versions include Sequoia 15.7.8 fix, Sonoma 14.8.8, Tahoe 26.6. "macOS 0 <26.6" likely means macOS Tahoe (version 26.x). So affected products: all Apple operating systems before these fixed versions. - Tags: Apple, Buffer Overflow, Ios And Ipados, Tvos, Visionos, Watchos, Memory Corruption. Also "Memory Corruption" tag is relevant. - References: All are Apple support pages: 128066, 128067, 128068, 128069, 128070, 128071, 128072. Also ENISA EUVD ID: EUVD-2026-49465, with link to NVD. Now, we need to produce each field as a paragraph. 1. product_name: "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'. NOT
Sensitive user data can be accessed by unauthorized apps on macOS and watchOS due to an authorization flaw in state management. Apple released patches in macOS Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.6, and watchOS 26.6. No public exploit or active exploitation is known; EPSS indicates a low likelihood of exploitation.
An authorization bypass in Apple iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS versions before 26.6 allows an app to access sensitive user data without proper permission. The vulnerability requires user interaction (opening a malicious app) and has not been actively exploited, with no CISA KEV listing and a low EPSS probability of 0.16%.
Unexpected Safari crash via use-after-free when processing maliciously crafted web content affects Safari 26.6 and earlier on all Apple platforms. This denial-of-service condition requires user interaction to open a malicious webpage; no public exploit identified and EPSS probability is low (0.14%).
Information disclosure in Apple Contacts across iOS, iPadOS, macOS, visionOS, and watchOS allows a local attacker to leak sensitive data by processing a maliciously crafted contact. Apple has released patches in iOS 26.6 and other updates. No public exploit is identified, and EPSS indicates
Denial of service in Apple operating systems via out-of-bounds write allows a local app to cause unexpected system termination. Affected versions include iOS/iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS prior to 26.6. No active exploitation has been reported, EPSS risk is low at 0.16%, and no public exploit code identified at time of analysis.
Process crash vulnerability in Apple's web content processing stack affects iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS across both the legacy 18.x and new 26.x release trains. An unauthenticated remote attacker (per CVSS PR:N) can trigger an unexpected rendering process crash by delivering maliciously crafted web content to a user who visits or interacts with attacker-controlled material. The impact is limited to availability (denial of service via process crash) with no confidentiality or integrity consequences; no public exploit code exists and CISA has not listed this in KEV, consistent with the 0.03% EPSS score.
Process termination via buffer overflow in Apple's audio stream parser affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS across all supported release lines. Opening a maliciously crafted media file triggers a CWE-120 buffer copy without bounds checking during audio stream processing, crashing the media-handling process. No active exploitation is confirmed (not in CISA KEV), EPSS sits at 0.02% (7th percentile), and SSVC classifies this as non-automatable with partial technical impact - placing it firmly in the patch-on-schedule tier rather than emergency response.
Improper memory handling in Apple's web content processing engine triggers an unexpected process crash when a user visits or renders maliciously crafted web content, affecting every current Apple platform. The vulnerability is confirmed patched in iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5, and the presence of multiple Red Hat errata references suggests the underlying component (likely WebKitGTK) also carries impact into Linux distributions. No public exploit code and no active exploitation have been identified; EPSS sits at the 5th percentile and CISA SSVC rates exploitation as none.
Memory corruption in Apple's WebKit web content processing engine causes an unexpected process crash (denial-of-service) across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS when a victim processes attacker-controlled web content. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H confirms network-reachable, unauthenticated exploitation limited to availability impact within the affected process - no code execution or data exfiltration is indicated. No public exploit code has been identified at time of analysis, and EPSS scoring at 0.03% (10th percentile) combined with SSVC Exploitation status of 'none' signal low current exploitation pressure.
Safari on Apple platforms crashes when processing maliciously crafted web content due to a use-after-free vulnerability in memory management, resulting in denial of service. Affects iOS and iPadOS below 26.5, macOS Tahoe below 26.5, tvOS below 26.5, visionOS below 26.5, and watchOS below 26.5. Exploitation requires user interaction to visit a malicious webpage but does not allow code execution or information disclosure.
Race condition in Apple operating systems allows local apps to access sensitive user data without authorization. Affects iOS and iPadOS versions below 26.5, macOS Sequoia 15.7.7, Sonoma 14.8.7, Tahoe 26.5, tvOS, visionOS, and watchOS versions below 26.5. Requires local app execution and user interaction. CVSS 5.5 reflects high confidentiality impact but low exploitation likelihood (EPSS 0.02%, 7th percentile).
Web content processing across all major Apple platforms is vulnerable to a memory mismanagement flaw (CWE-119) that causes an unexpected process crash when a user visits or renders attacker-controlled web content. Affected platforms include iOS/iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS - all versions prior to the 26.5 release line. The impact is limited to availability (A:H), with no confidentiality or integrity exposure per the CVSS vector, and no active exploitation is confirmed - EPSS sits at 0.02% (5th percentile) and SSVC rates exploitation as none, making this a moderate-priority patch rather than an emergency response item.
Out-of-bounds read (CWE-125) in Apple's file parsing subsystem causes unexpected application termination across all major Apple platforms when a maliciously crafted file is processed. Affected platforms include iOS/iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS - all prior to their respective 26.5 releases. The impact is limited to availability (denial of service via app crash); no confidentiality or integrity impact is indicated. No public exploit code exists and no active exploitation has been confirmed: EPSS stands at 0.02% (6th percentile) and CISA has not added this to KEV.
Out-of-bounds memory access in Apple media processing affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS, allowing remote attackers to trigger unexpected application termination or memory corruption through maliciously crafted media files. The vulnerability requires user interaction (opening/playing the malicious file) but no authentication. Apple has released patched versions for all affected platforms with CVSS 6.3 (moderate severity) and no public exploitation identified at time of analysis.
A sandbox escape vulnerability in Apple's WebKit browser engine allows malicious websites to process restricted web content outside the security sandbox, potentially enabling unauthorized access to protected system resources. The vulnerability affects Safari and all Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Apple has addressed this issue through improved memory handling in Safari 26.4 and corresponding OS updates across all affected platforms.
Denial of service affecting Apple's macOS, iOS, iPadOS, watchOS, tvOS, and visionOS results from a memory handling flaw that crashes processes when parsing malicious web content. An unauthenticated remote attacker can trigger unexpected application termination through crafted web pages, requiring only user interaction to visit a malicious site. A patch is not currently available for this medium-severity vulnerability.
Insufficient validation of environment variables in Apple's macOS, iOS, iPadOS, and visionOS allows local applications to read sensitive user data without user interaction. An attacker with the ability to run code on the affected device could exploit this to access confidential information through improperly sanitized environment variable handling. A patch is not currently available for this medium-severity vulnerability.
Local privilege escalation in Apple operating systems (iOS, iPadOS, macOS Tahoe, visionOS, watchOS) allows authenticated applications to bypass payment token access restrictions and obtain sensitive payment credentials. The vulnerability affects all versions prior to the 26.2 release across affected platforms. CVSS 5.5 with low real-world exploitation risk (EPSS 0.01%), no public exploit identified, not listed in CISA KEV.
Installed app enumeration via permissions bypass in Apple operating systems allows a locally authenticated app to discover what other applications a user has installed through insufficient access controls. Affects iOS 18.7.2 and earlier, iPadOS 18.7.2 and earlier, macOS Tahoe 26.1 and earlier, tvOS 26.1 and earlier, visionOS 26.1 and earlier, and watchOS 26.1 and earlier. The vulnerability has a low CVSS score (3.3) with extremely low exploitation probability (EPSS 0.02%) and no public exploit identified at time of analysis.
Local apps on Apple devices can access a user's Safari browsing history due to insufficient data redaction in system logging, affecting iOS, iPadOS, macOS Tahoe, and watchOS prior to version 26.2. An attacker with local app execution privileges can extract sensitive Safari history from system logs without user interaction. This vulnerability carries a 3.3 CVSS score with minimal real-world exploitation probability (EPSS 0.01%) and no known public exploits.
Safari and Apple operating systems contain a race condition that crashes the rendering process when processing maliciously crafted web content, affecting Safari 26.2 and earlier, iOS 18.7.3 and earlier, iPadOS 18.7.3 and earlier, macOS Tahoe 26.2 and earlier, tvOS 26.2 and earlier, visionOS 26.2 and earlier, and watchOS 26.2 and earlier. The vulnerability requires user interaction (clicking a malicious link or visiting a hostile website) and has high attack complexity, resulting in denial of service through process crash rather than data compromise. No public exploit code has been identified, EPSS exploitation probability is very low at 0.12%, and Apple has released patched versions across all affected platforms.
Mail header parsing flaw in Apple operating systems allows unauthenticated remote attackers to trigger persistent denial-of-service conditions across iOS, iPadOS, macOS, visionOS, and watchOS platforms. The vulnerability affects all major Apple OS releases prior to January 2025 patches (iOS/iPadOS 18.7.2/26.1, macOS Sequoia 15.7.2/Sonoma 14.8.2/Tahoe 26.1, visionOS 26.1, watchOS 26.1). With EPSS exploitation probability at 0.19% (41st percentile) and no public exploit identified at time of analysis, real-world risk appears moderate despite the 7.5 CVSS score.
An authentication issue was addressed with improved state management. Rated medium severity (CVSS 4.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A use-after-free issue was addressed with improved memory management. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A use-after-free issue was addressed with improved memory management. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved memory handling. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Double free memory management vulnerability in Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) allows local apps to trigger unexpected system termination through memory corruption. Affecting iOS 18.5 and earlier, iPadOS 18.5 and earlier, macOS Sequoia 15.5 and earlier, macOS Sonoma 14.7.6 and earlier, macOS Ventura 13.7.6 and earlier, tvOS 18.5 and earlier, visionOS 2.5 and earlier, and watchOS 11.5 and earlier. No public exploit code or active exploitation confirmed; EPSS score of 0.01% indicates minimal real-world exploitation probability despite moderate CVSS rating.
The issue was addressed with improved memory handling. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A correctness issue was addressed with improved checks. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Out-of-bounds read in Apple Safari and system WebKit implementations allows local attackers to disclose internal application state by processing maliciously crafted web content, affecting Safari 18.5 and earlier, iOS 18.5 and earlier, iPadOS 18.5 and earlier, macOS Sequoia 15.5 and earlier, tvOS 18.5 and earlier, visionOS 2.5 and earlier, and watchOS 11.5 and earlier. The vulnerability requires local access and user interaction but poses information disclosure risk with CVSS 4.0 and EPSS 0.02% (very low exploitation probability); no public exploit code or active exploitation has been identified.
Memory corruption vulnerabilities in Apple's graphics texture processing engine across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS allow remote code execution via maliciously crafted texture files. Affects all major Apple platforms prior to July 2025 updates (iOS/iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6). Despite a critical CVSS 9.8 score indicating network-exploitable remote code execution without authentication, EPSS shows only 0.18% exploitation probability (40th percentile), and no public exploit identified at time of analysis. The vulnerability requires processing specially crafted texture data, likely through applications handling untrusted image or 3D content.
Insufficient permission checks in Apple operating systems allow local apps to access user-sensitive data without proper authorization. The vulnerability affects iOS 18.5 and earlier, iPadOS 18.5 and earlier (and iPadOS 17.7.8 and earlier), macOS Sequoia 15.5 and earlier, tvOS 18.5 and earlier, visionOS 2.5 and earlier, and watchOS 11.5 and earlier. An unprivileged local application can exploit this to read sensitive user information by circumventing the permission model. No public exploit code has been identified at time of analysis, and EPSS scoring (0.02%, 4th percentile) indicates very low real-world exploitation probability despite the information disclosure impact.
Information disclosure vulnerability in WebKit across Apple's ecosystem allows unauthenticated remote attackers to extract sensitive user information through maliciously crafted web content. The flaw affects Safari 18.x, iOS/iPadOS 18.x, macOS Sequoia 15.x, tvOS 18.x, visionOS 2.x, and watchOS 11.x, stemming from improper state management (CWE-359). Despite a CVSS score of 7.5, real-world exploitation risk remains relatively low with 0.13% EPSS probability and no public exploit identified at time of analysis. Vendor-released patches are available across all affected platforms.
Out-of-bounds memory read in Apple's image processing component allows local attackers without privileges to disclose sensitive process memory by supplying a maliciously crafted image, affecting iOS 18.5 and earlier, iPadOS 17.7.8 and earlier, macOS Sequoia 15.5 and earlier, macOS Sonoma 14.7.6 and earlier, tvOS 18.5 and earlier, visionOS 2.5 and earlier, and watchOS 11.5 and earlier. No public exploit code or active exploitation has been identified; exploitation requires local access and user interaction to process the malicious image. The EPSS score of 0.02% (5th percentile) indicates minimal real-world exploitation likelihood despite the broad platform impact.
Improper input validation in Apple's network configuration subsystem across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS allows unauthenticated remote attackers to trigger denial-of-service conditions and enables non-privileged local users to modify restricted network settings. Fixed in iOS/iPadOS 18.6/17.7.9, macOS Sequoia 15.6, Sonoma 14.7.7, Ventura 13.7.7, tvOS 18.6, visionOS 2.6, and watchOS 11.6. EPSS score of 0.15% (36th percentile) indicates low predicted exploitation probability, and no public exploit identified at time of analysis.
Safari and Apple operating systems contain a use-after-free vulnerability in web content processing that causes unexpected application crashes when users visit maliciously crafted websites. The flaw affects Safari 18.5 and earlier, iOS 18.5 and earlier, iPadOS 18.5 and earlier (also iPadOS 17.7.8 and earlier), macOS Sequoia 15.5 and earlier, tvOS 18.5 and earlier, visionOS 2.5 and earlier, and watchOS 11.5 and earlier. Remote attackers can trigger a denial-of-service condition requiring only user interaction to visit a malicious page, with no elevated privileges required. Apple has released patches for all affected platforms; the EPSS score of 0.10% (28th percentile) indicates low real-world exploitation probability despite the accessibility of the attack vector.
Safari and related Apple platforms crash when processing maliciously crafted web content due to improper memory handling in a buffer overflow condition (CWE-119). The vulnerability affects Safari 18.5 and earlier, iOS 18.5 and earlier, iPadOS 18.5 and earlier, macOS Sequoia 15.5 and earlier, tvOS 18.5 and earlier, visionOS 2.5 and earlier, and watchOS 11.5 and earlier. An unauthenticated remote attacker can trigger denial of service by hosting or injecting malicious web content that causes an unexpected browser crash. No public exploit code or active exploitation has been confirmed at time of analysis, though the low EPSS score (0.15%) suggests minimal real-world exploitation likelihood despite the moderate CVSS 6.5 severity.
Safari and Apple platform web content processing crashes due to a buffer overflow vulnerability when handling maliciously crafted web content. Affects Safari 18.5 and earlier, iOS 18.5 and earlier, iPadOS 18.5 and earlier, macOS Sequoia 15.5 and earlier, tvOS 18.5 and earlier, visionOS 2.5 and earlier, and watchOS 11.5 and earlier. Unauthenticated remote attackers can trigger a denial of service by enticing users to visit a malicious webpage, resulting in application crash with no data theft or code execution capability. No public exploit identified at time of analysis; EPSS score of 0.12% indicates low real-world exploitation probability despite moderate CVSS rating.
Safari and related Apple platforms crash when processing maliciously crafted web content due to a memory handling vulnerability (buffer overflow). Affects Safari 18.5 and earlier, iOS 18.5 and earlier, iPadOS 18.5 and earlier, macOS Sequoia 15.5 and earlier, tvOS 18.5 and earlier, visionOS 2.5 and earlier, and watchOS 11.5 and earlier. An unauthenticated remote attacker can trigger a denial of service by hosting or injecting malicious web content, with user interaction required to visit the affected content. No public exploit code or active exploitation has been confirmed (EPSS 0.08% indicates minimal real-world exploitation activity to date).
Denial-of-service vulnerability in Apple's WebKit engine affects Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS through improper memory handling during web content processing. Local attackers without authentication can trigger this vulnerability via crafted web content to cause application crashes. Vendor-released patches are available across all affected platforms; EPSS score of 0.02% indicates minimal real-world exploitation likelihood despite the moderate CVSS 6.2 rating.
Out-of-bounds write vulnerability in WebKit across Apple's entire operating system ecosystem allows remote code execution via maliciously crafted web content without user interaction or authentication. Affects iOS, iPadOS, macOS (Ventura through Sequoia), tvOS, visionOS, and watchOS prior to July 2025 security updates. Despite a critical 9.8 CVSS score indicating maximum severity, EPSS probability remains low at 0.14% (34th percentile), and no public exploit identified at time of analysis, suggesting limited observed exploitation attempts despite the theoretical remote attack surface.
Buffer overflow memory corruption in Apple file parsing components allows remote code execution across iOS 18.6, iPadOS 18.6, macOS (Sequoia 15.6, Sonoma 14.7.7, Ventura 13.7.7), tvOS 18.6, visionOS 2.6, and watchOS 11.6. Unauthenticated attackers can trigger arbitrary code execution by delivering a maliciously crafted file requiring no user interaction beyond parsing. Despite CVSS 9.8 critical severity, EPSS score of 0.16% (37th percentile) indicates low observed exploitation probability. No public exploit identified at time of analysis and not listed in CISA KEV, suggesting theoretical risk exceeds current real-world threat activity.
Memory corruption in Apple's WebKit browser engine across Safari 18.x, iOS/iPadOS 18.x, macOS Sequoia 15.x, and other Apple operating systems allows remote attackers to achieve arbitrary code execution via maliciously crafted web content requiring only user interaction (visiting a malicious webpage). With CVSS 8.8 (High), the vulnerability enables complete system compromise (high confidentiality, integrity, and availability impact) but carries relatively low real-world exploitation probability (EPSS 0.10%, 27th percentile). No public exploit identified at time of analysis, and vendor-released patches are available across all affected platforms as of July-August 2025.
Memory corruption in WebKit browser engine allows remote code execution across Apple's ecosystem (Safari 18.6, iOS/iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6) when users interact with maliciously crafted web content. The vulnerability stems from improper memory handling (CWE-119 buffer overflow) and requires no authentication but user interaction to trigger. EPSS score of 0.10% (26th percentile) indicates low observed exploitation probability, and no public exploit identified at time of analysis, though the CVSS 8.8 rating reflects the potential for complete system compromise if successfully exploited.
Remote denial-of-service in Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) allows unauthenticated network attackers to trigger unexpected system termination via improved checks bypass. Affects multiple OS versions prior to their respective May 2025 updates (iOS/iPadOS 18.5/17.7.9, macOS Sequoia 15.5/Ventura 13.7.7, tvOS 18.5, visionOS 2.5, watchOS 11.5). No public exploit identified at time of analysis. EPSS probability of 0.27% (51st percentile) suggests relatively low observed exploitation activity, though the network-accessible attack vector and lack of authentication requirements (CVSS AV:N/PR:N) create broad exposure surface across Apple's ecosystem.
The issue was addressed with improved checks. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Processing web content may lead to arbitrary code execution. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
A denial-of-service issue was addressed with improved input validation. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved memory handling. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
This issue was addressed with improved checks. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
The issue was addressed with improved checks. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
The issue was addressed with improved checks. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A permissions issue was addressed with additional restrictions. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
A race condition was addressed with improved locking. Rated medium severity (CVSS 5.1), this vulnerability is no authentication required. No vendor patch available.
A type confusion issue was addressed with improved memory handling. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved checks. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved checks. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved checks. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
A race condition was addressed with additional validation. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
The issue was addressed with improved checks. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The issue was addressed with improved checks. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
This issue was addressed with improved redaction of sensitive information. Rated low severity (CVSS 3.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A logic issue was addressed with improved checks. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A cookie management issue was addressed with improved state management. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved bounds checks. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved bounds checks. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved bounds checks. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved checks. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An incorrect-authorization flaw in Apple's Bluetooth state management allows an already-installed app to obtain Bluetooth access it was never granted, undermining the platform's per-app permission model on iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27 - but only on versions prior to those releases. Apple fixed the issue through improved state handling and published coordinated advisories for every affected platform; a local attacker or malicious app is required, so this is not remotely reachable without code execution already on the device. No public exploit code has been identified and EPSS is very low (0.20%, 10th percentile), so this rates as a patching-hygiene item rather than an emergency.
Improper access control in Apple watchOS prior to 26.4 allows a person with physical possession of a locked Apple Watch to view the device owner's contacts without authentication. The flaw, classified as CWE-284 (Improper Access Control), stems from insufficient permissions checking on a code path accessible from the lock screen. Apple has confirmed the fix in watchOS 26.4; no active exploitation has been identified per CISA SSVC assessment.
Information disclosure in Apple iOS and iPadOS 26.6, along with macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6, allows a local app to access sensitive user data due to a state management flaw. The vulnerability was addressed with improved state handling, and no public exploit code or active exploitation has been identified; EPSS indicates a low likelihood of real-world attacks.
Unauthorized reading of a persistent device identifier in Apple iOS, iPadOS, tvOS, watchOS, and visionOS allows a malicious app to access a unique identifier without user consent. The issue originates from a permissions enforcement weakness fixed in iOS 26.6, iPadOS 26.6, tvOS 26.6, watchOS 26.6, and visionOS 26.6. No active exploitation or public exploit code is known, and EPSS predicts a very low exploitation probability (0.16%).
UI spoofing in Apple Safari 26.5 and earlier allows attackers using cross-origin framing to misrepresent website identity. The vulnerability requires user interaction (visiting a malicious page) and could lead to phishing or deceptive actions. No active exploitation or public exploit code identified; patch is available.
Unauthorized file read via a sandbox escape vulnerability in Apple iOS, iPadOS, macOS, tvOS, watchOS, and visionOS allows a malicious app to access files outside its designated sandbox. Exploitation requires user interaction to install and launch a malicious app, but no active exploitation or public exploit code is currently known. CVSS medium severity (6.5) is offset by a very low EPSS score (0.17%), indicating low real-world exploitation probability.
A local denial-of-service vulnerability in Apple's operating systems allows a malicious app to cause unexpected system termination by triggering an out-of-bounds read. Fixes are available in version 26.6 for iOS, iPadOS, macOS, tvOS, visionOS, and watchOS; no active exploitation or public exploit has been identified, and EPSS indicates a low probability of exploitation.
We need to generate a comprehensive JSON synthesis based on provided CVE data. The output must be plain text strings, each field a coherent paragraph, following strict rules. Let's analyze the given data. CVE-2026-43801: Description: "This issue was addressed with improved checks. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to access sensitive user data." CVSS: 5.5, vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. CWE-200: Information Exposure. Multi-source intelligence: EPSS 0.17% (6 percentile), Patch: Available from vendor, Reported by: apple. CPEs: many Apple operating systems. Tags: Apple, Information Disclosure, etc. EUVD affected versions list. References: Apple support pages. We need to fill out the JSON fields: product_name: 1-3 words ONLY. Affected product is Apple's operating systems across multiple platforms. The specific product? "Apple iOS" or "Apple macOS"? The vulnerability affects multiple products, but choose primary. Since iOS is listed first, maybe "Apple iOS". Or maybe "Apple iOS and macOS"? It's an app that can access sensitive user data across all these OSs. The product name should be the primary affected product. The CPE includes ios_and_ipados, macos, tvos, visionos, watchos. So it's essentially all Apple OS platforms. Could we say "Apple Operating Systems"? That's not 1-3 words, it's 3 words: "Apple Operating Systems"? Or "Apple OS". The description says "This issue is fixed in iOS 26.6 ..." So the primary product might be the general OS. I'll go with "Apple iOS/macOS" but that's two. I'll say "Apple OS". The rule: "1-3 words ONLY. The specific product or service name affected." If multiple products, pick the primary one. The primary might be "iOS" as it's the first listed. So I'll put "Apple iOS". But it's not just iOS; it's all Apple platforms. However, the CVE description typically picks one platform. I'
We need to analyze CVE-2026-64709 and produce a JSON with the specified fields. Let's gather all input data: - CVE ID: CVE-2026-64709 - Description: "The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to disclose kernel memory." - CVSS Score: 5.5 - CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - CWE: CWE-200 (Information Exposure) - EPSS: 0.17% (percentile 7%), so low. - Patch: Available from vendor - Reported by: apple - CPEs: apple:ios_and_ipados:* (all versions), apple:macos:* (all versions), apple:tvos:*, apple:visionos:*, apple:watchos:* - Tags: Apple, Information Disclosure, Ios And Ipados, Tvos, Visionos, Watchos - SSVC: Exploitation: none, Automatable: no, Technical Impact: partial -> so not currently exploited, not automatable, partial impact. - ENISA EUVD ID: EUVD-2026-49513 - Affected versions list: macOS <14.8.8, macOS <15.7.8, visionOS <26.6, macOS <26.6 (this might be Tahoe, version 26.6?), watchOS <26.6, iOS and iPadOS <26.6, tvOS <26.6. Note the "macOS 0 <26.6" probably refers to macOS Tahoe (version 26.6), but they list macOS 0 <14.8.8 (Sonoma), macOS 0 <15.7.8 (Sequoia), and macOS 0 <26.6 (Tahoe). So three macOS branches. - References: 7 support.apple.com URLs. Now we need to produce a JSON object with the fields. All fields are plain text strings, no arrays, no objects. Let's step through each field: 1. "product_name": 1-3 words ONLY. The primary product. This vulnerability affects multiple Apple operating systems, but the description mentions "An app may be able to disclose kernel memory." The core product is the kernel, but we need to pick one product name that represents the family. The CPEs list iOS and iPadOS, macOS, tvOS, visionOS, watchOS. So the primary product is "Apple iOS" or "Apple macOS"? The description lists multiple, but it says "An app may be ab
Denial-of-service via out-of-bounds write in Apple CoreAudio when processing malicious audio streams. Affected iOS, iPadOS, macOS, tvOS, watchOS, and visionOS versions are vulnerable. No known active exploitation or public exploit code exists at time of analysis, and EPSS probability is low (0.17%).
Information disclosure in Apple iOS/iPadOS versions prior to 26.6 allows a locally installed app to access sensitive user data without proper permissions. Apple has released patches in iOS/iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, and watchOS 26.6. No public exploit or active exploitation has been reported, and the EPSS score indicates a low likelihood of exploitation.
An out-of-bounds write vulnerability in Apple iOS 26.6 and earlier allows a malicious app to cause unexpected system termination (kernel panic). No public exploit or active exploitation has been reported; patch available from Apple.
Denial-of-service in multiple Apple operating systems allows a local network attacker to cause resource exhaustion and system unavailability. The vulnerability is addressed in iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No public exploit or active exploitation has been identified at this time, and the EPSS score is low (0.17%).
Bypass of iframe sandboxing policy in Apple Safari and all Apple operating systems through version 26.5 allows malicious web content to violate sandbox restrictions. Affected users include anyone running Safari on iOS, iPadOS, macOS Tahoe, tvOS, visionOS, or watchOS prior to version 26.6. An attacker can cause integrity violations, such as injecting or modifying content within sandboxed iframes, but requires user interaction (clicking a link or visiting a malicious page) and no public exploit or active exploitation has been identified at this time.
A malicious app can access sensitive user
An inconsistent user interface state management in multiple Apple operating systems allows remote attackers to bypass network filters, potentially leading to unauthorized actions on the system. The vulnerability requires user interaction (e.g., clicking a link) and affects iOS and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No active exploitation has been reported at this time, and the EPSS score (0.27%, 20th percentile) indicates a low immediate threat.
Protected user data exposure in Apple operating systems allows a malicious app with on-device access to read sensitive information through insufficient input sanitization. This CVE-2026-43714 affects iOS and iPadOS before 26.6, macOS Sequoia before 15.7.8, Sonoma before 14.8.8, Tahoe before 26.6, visionOS before 26.6, and watchOS before 26.6. No public exploit has been identified and the low EPSS score
Denial-of-service via type confusion in Apple ImageIO affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Processing a maliciously crafted image can crash an application, with no code execution. No active exploitation or public exploit is known; EPSS 0.17% indicates low likelihood of widespread attacks.
Cleartext transmission of sensitive data in Apple iOS 26.6 and earlier allows an app to access sensitive user data over the network. The issue is fixed by enforcing HTTPS in iOS and iPadOS 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No public exploit has been identified and EPSS risk is low (0.16%).
Local information disclosure in macOS Tahoe and watchOS allows an installed app to access sensitive user data without proper authorization. The vulnerability requires user interaction and is fixed in macOS Tahoe 26.6 and watchOS 26.6. No active exploitation or public exploit has been reported, and EPSS probability is low at 0.15%.
We are tasked with synthesizing data from multiple intelligence sources about CVE-2026-64754 into a comprehensive analysis, returning a JSON object with specific fields. All fields must be plain text strings (paragraphs). We must use all provided data and cross-reference to add value. The output must be grounded in the input data, not invented. Let's extract and analyze the provided data: - CVE ID: CVE-2026-64754 - Description: "An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to a denial-of-service." - CVSS Score: 5.5, Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CWE: CWE-787 (Out-of-bounds Write) - EPSS: 0.16% (percentile 5%) — low exploitation probability. - Patch: Available from vendor (Yes). The fix is listed in the versions above. - Reported by: apple - CPE: apple:ios_and_ipados, apple:macos, apple:tvos, apple:visionos, apple:watchos — all with *:*:*:*:*:*:*. Specific version ranges given by EUVD: macOS 0 <15.7.8, macOS 0 <14.8.8, iOS and iPadOS 0 <26.6, macOS 0 <26.6, watchOS 0 <26.6, tvOS 0 <26.6, visionOS 0 <26.6. Note the macOS versions include Sequoia 15.7.8 fix, Sonoma 14.8.8, Tahoe 26.6. "macOS 0 <26.6" likely means macOS Tahoe (version 26.x). So affected products: all Apple operating systems before these fixed versions. - Tags: Apple, Buffer Overflow, Ios And Ipados, Tvos, Visionos, Watchos, Memory Corruption. Also "Memory Corruption" tag is relevant. - References: All are Apple support pages: 128066, 128067, 128068, 128069, 128070, 128071, 128072. Also ENISA EUVD ID: EUVD-2026-49465, with link to NVD. Now, we need to produce each field as a paragraph. 1. product_name: "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'. NOT
Sensitive user data can be accessed by unauthorized apps on macOS and watchOS due to an authorization flaw in state management. Apple released patches in macOS Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.6, and watchOS 26.6. No public exploit or active exploitation is known; EPSS indicates a low likelihood of exploitation.
An authorization bypass in Apple iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS versions before 26.6 allows an app to access sensitive user data without proper permission. The vulnerability requires user interaction (opening a malicious app) and has not been actively exploited, with no CISA KEV listing and a low EPSS probability of 0.16%.
Unexpected Safari crash via use-after-free when processing maliciously crafted web content affects Safari 26.6 and earlier on all Apple platforms. This denial-of-service condition requires user interaction to open a malicious webpage; no public exploit identified and EPSS probability is low (0.14%).
Information disclosure in Apple Contacts across iOS, iPadOS, macOS, visionOS, and watchOS allows a local attacker to leak sensitive data by processing a maliciously crafted contact. Apple has released patches in iOS 26.6 and other updates. No public exploit is identified, and EPSS indicates
Denial of service in Apple operating systems via out-of-bounds write allows a local app to cause unexpected system termination. Affected versions include iOS/iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS prior to 26.6. No active exploitation has been reported, EPSS risk is low at 0.16%, and no public exploit code identified at time of analysis.
Process crash vulnerability in Apple's web content processing stack affects iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS across both the legacy 18.x and new 26.x release trains. An unauthenticated remote attacker (per CVSS PR:N) can trigger an unexpected rendering process crash by delivering maliciously crafted web content to a user who visits or interacts with attacker-controlled material. The impact is limited to availability (denial of service via process crash) with no confidentiality or integrity consequences; no public exploit code exists and CISA has not listed this in KEV, consistent with the 0.03% EPSS score.
Process termination via buffer overflow in Apple's audio stream parser affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS across all supported release lines. Opening a maliciously crafted media file triggers a CWE-120 buffer copy without bounds checking during audio stream processing, crashing the media-handling process. No active exploitation is confirmed (not in CISA KEV), EPSS sits at 0.02% (7th percentile), and SSVC classifies this as non-automatable with partial technical impact - placing it firmly in the patch-on-schedule tier rather than emergency response.
Improper memory handling in Apple's web content processing engine triggers an unexpected process crash when a user visits or renders maliciously crafted web content, affecting every current Apple platform. The vulnerability is confirmed patched in iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5, and the presence of multiple Red Hat errata references suggests the underlying component (likely WebKitGTK) also carries impact into Linux distributions. No public exploit code and no active exploitation have been identified; EPSS sits at the 5th percentile and CISA SSVC rates exploitation as none.
Memory corruption in Apple's WebKit web content processing engine causes an unexpected process crash (denial-of-service) across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS when a victim processes attacker-controlled web content. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H confirms network-reachable, unauthenticated exploitation limited to availability impact within the affected process - no code execution or data exfiltration is indicated. No public exploit code has been identified at time of analysis, and EPSS scoring at 0.03% (10th percentile) combined with SSVC Exploitation status of 'none' signal low current exploitation pressure.
Safari on Apple platforms crashes when processing maliciously crafted web content due to a use-after-free vulnerability in memory management, resulting in denial of service. Affects iOS and iPadOS below 26.5, macOS Tahoe below 26.5, tvOS below 26.5, visionOS below 26.5, and watchOS below 26.5. Exploitation requires user interaction to visit a malicious webpage but does not allow code execution or information disclosure.
Race condition in Apple operating systems allows local apps to access sensitive user data without authorization. Affects iOS and iPadOS versions below 26.5, macOS Sequoia 15.7.7, Sonoma 14.8.7, Tahoe 26.5, tvOS, visionOS, and watchOS versions below 26.5. Requires local app execution and user interaction. CVSS 5.5 reflects high confidentiality impact but low exploitation likelihood (EPSS 0.02%, 7th percentile).
Web content processing across all major Apple platforms is vulnerable to a memory mismanagement flaw (CWE-119) that causes an unexpected process crash when a user visits or renders attacker-controlled web content. Affected platforms include iOS/iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS - all versions prior to the 26.5 release line. The impact is limited to availability (A:H), with no confidentiality or integrity exposure per the CVSS vector, and no active exploitation is confirmed - EPSS sits at 0.02% (5th percentile) and SSVC rates exploitation as none, making this a moderate-priority patch rather than an emergency response item.
Out-of-bounds read (CWE-125) in Apple's file parsing subsystem causes unexpected application termination across all major Apple platforms when a maliciously crafted file is processed. Affected platforms include iOS/iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS - all prior to their respective 26.5 releases. The impact is limited to availability (denial of service via app crash); no confidentiality or integrity impact is indicated. No public exploit code exists and no active exploitation has been confirmed: EPSS stands at 0.02% (6th percentile) and CISA has not added this to KEV.
Out-of-bounds memory access in Apple media processing affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS, allowing remote attackers to trigger unexpected application termination or memory corruption through maliciously crafted media files. The vulnerability requires user interaction (opening/playing the malicious file) but no authentication. Apple has released patched versions for all affected platforms with CVSS 6.3 (moderate severity) and no public exploitation identified at time of analysis.
A sandbox escape vulnerability in Apple's WebKit browser engine allows malicious websites to process restricted web content outside the security sandbox, potentially enabling unauthorized access to protected system resources. The vulnerability affects Safari and all Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Apple has addressed this issue through improved memory handling in Safari 26.4 and corresponding OS updates across all affected platforms.
Denial of service affecting Apple's macOS, iOS, iPadOS, watchOS, tvOS, and visionOS results from a memory handling flaw that crashes processes when parsing malicious web content. An unauthenticated remote attacker can trigger unexpected application termination through crafted web pages, requiring only user interaction to visit a malicious site. A patch is not currently available for this medium-severity vulnerability.
Insufficient validation of environment variables in Apple's macOS, iOS, iPadOS, and visionOS allows local applications to read sensitive user data without user interaction. An attacker with the ability to run code on the affected device could exploit this to access confidential information through improperly sanitized environment variable handling. A patch is not currently available for this medium-severity vulnerability.
Local privilege escalation in Apple operating systems (iOS, iPadOS, macOS Tahoe, visionOS, watchOS) allows authenticated applications to bypass payment token access restrictions and obtain sensitive payment credentials. The vulnerability affects all versions prior to the 26.2 release across affected platforms. CVSS 5.5 with low real-world exploitation risk (EPSS 0.01%), no public exploit identified, not listed in CISA KEV.
Installed app enumeration via permissions bypass in Apple operating systems allows a locally authenticated app to discover what other applications a user has installed through insufficient access controls. Affects iOS 18.7.2 and earlier, iPadOS 18.7.2 and earlier, macOS Tahoe 26.1 and earlier, tvOS 26.1 and earlier, visionOS 26.1 and earlier, and watchOS 26.1 and earlier. The vulnerability has a low CVSS score (3.3) with extremely low exploitation probability (EPSS 0.02%) and no public exploit identified at time of analysis.
Local apps on Apple devices can access a user's Safari browsing history due to insufficient data redaction in system logging, affecting iOS, iPadOS, macOS Tahoe, and watchOS prior to version 26.2. An attacker with local app execution privileges can extract sensitive Safari history from system logs without user interaction. This vulnerability carries a 3.3 CVSS score with minimal real-world exploitation probability (EPSS 0.01%) and no known public exploits.
Safari and Apple operating systems contain a race condition that crashes the rendering process when processing maliciously crafted web content, affecting Safari 26.2 and earlier, iOS 18.7.3 and earlier, iPadOS 18.7.3 and earlier, macOS Tahoe 26.2 and earlier, tvOS 26.2 and earlier, visionOS 26.2 and earlier, and watchOS 26.2 and earlier. The vulnerability requires user interaction (clicking a malicious link or visiting a hostile website) and has high attack complexity, resulting in denial of service through process crash rather than data compromise. No public exploit code has been identified, EPSS exploitation probability is very low at 0.12%, and Apple has released patched versions across all affected platforms.
Mail header parsing flaw in Apple operating systems allows unauthenticated remote attackers to trigger persistent denial-of-service conditions across iOS, iPadOS, macOS, visionOS, and watchOS platforms. The vulnerability affects all major Apple OS releases prior to January 2025 patches (iOS/iPadOS 18.7.2/26.1, macOS Sequoia 15.7.2/Sonoma 14.8.2/Tahoe 26.1, visionOS 26.1, watchOS 26.1). With EPSS exploitation probability at 0.19% (41st percentile) and no public exploit identified at time of analysis, real-world risk appears moderate despite the 7.5 CVSS score.
An authentication issue was addressed with improved state management. Rated medium severity (CVSS 4.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A use-after-free issue was addressed with improved memory management. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A use-after-free issue was addressed with improved memory management. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved memory handling. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Double free memory management vulnerability in Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) allows local apps to trigger unexpected system termination through memory corruption. Affecting iOS 18.5 and earlier, iPadOS 18.5 and earlier, macOS Sequoia 15.5 and earlier, macOS Sonoma 14.7.6 and earlier, macOS Ventura 13.7.6 and earlier, tvOS 18.5 and earlier, visionOS 2.5 and earlier, and watchOS 11.5 and earlier. No public exploit code or active exploitation confirmed; EPSS score of 0.01% indicates minimal real-world exploitation probability despite moderate CVSS rating.
The issue was addressed with improved memory handling. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A correctness issue was addressed with improved checks. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Out-of-bounds read in Apple Safari and system WebKit implementations allows local attackers to disclose internal application state by processing maliciously crafted web content, affecting Safari 18.5 and earlier, iOS 18.5 and earlier, iPadOS 18.5 and earlier, macOS Sequoia 15.5 and earlier, tvOS 18.5 and earlier, visionOS 2.5 and earlier, and watchOS 11.5 and earlier. The vulnerability requires local access and user interaction but poses information disclosure risk with CVSS 4.0 and EPSS 0.02% (very low exploitation probability); no public exploit code or active exploitation has been identified.
Memory corruption vulnerabilities in Apple's graphics texture processing engine across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS allow remote code execution via maliciously crafted texture files. Affects all major Apple platforms prior to July 2025 updates (iOS/iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6). Despite a critical CVSS 9.8 score indicating network-exploitable remote code execution without authentication, EPSS shows only 0.18% exploitation probability (40th percentile), and no public exploit identified at time of analysis. The vulnerability requires processing specially crafted texture data, likely through applications handling untrusted image or 3D content.
Insufficient permission checks in Apple operating systems allow local apps to access user-sensitive data without proper authorization. The vulnerability affects iOS 18.5 and earlier, iPadOS 18.5 and earlier (and iPadOS 17.7.8 and earlier), macOS Sequoia 15.5 and earlier, tvOS 18.5 and earlier, visionOS 2.5 and earlier, and watchOS 11.5 and earlier. An unprivileged local application can exploit this to read sensitive user information by circumventing the permission model. No public exploit code has been identified at time of analysis, and EPSS scoring (0.02%, 4th percentile) indicates very low real-world exploitation probability despite the information disclosure impact.
Information disclosure vulnerability in WebKit across Apple's ecosystem allows unauthenticated remote attackers to extract sensitive user information through maliciously crafted web content. The flaw affects Safari 18.x, iOS/iPadOS 18.x, macOS Sequoia 15.x, tvOS 18.x, visionOS 2.x, and watchOS 11.x, stemming from improper state management (CWE-359). Despite a CVSS score of 7.5, real-world exploitation risk remains relatively low with 0.13% EPSS probability and no public exploit identified at time of analysis. Vendor-released patches are available across all affected platforms.
Out-of-bounds memory read in Apple's image processing component allows local attackers without privileges to disclose sensitive process memory by supplying a maliciously crafted image, affecting iOS 18.5 and earlier, iPadOS 17.7.8 and earlier, macOS Sequoia 15.5 and earlier, macOS Sonoma 14.7.6 and earlier, tvOS 18.5 and earlier, visionOS 2.5 and earlier, and watchOS 11.5 and earlier. No public exploit code or active exploitation has been identified; exploitation requires local access and user interaction to process the malicious image. The EPSS score of 0.02% (5th percentile) indicates minimal real-world exploitation likelihood despite the broad platform impact.
Improper input validation in Apple's network configuration subsystem across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS allows unauthenticated remote attackers to trigger denial-of-service conditions and enables non-privileged local users to modify restricted network settings. Fixed in iOS/iPadOS 18.6/17.7.9, macOS Sequoia 15.6, Sonoma 14.7.7, Ventura 13.7.7, tvOS 18.6, visionOS 2.6, and watchOS 11.6. EPSS score of 0.15% (36th percentile) indicates low predicted exploitation probability, and no public exploit identified at time of analysis.
Safari and Apple operating systems contain a use-after-free vulnerability in web content processing that causes unexpected application crashes when users visit maliciously crafted websites. The flaw affects Safari 18.5 and earlier, iOS 18.5 and earlier, iPadOS 18.5 and earlier (also iPadOS 17.7.8 and earlier), macOS Sequoia 15.5 and earlier, tvOS 18.5 and earlier, visionOS 2.5 and earlier, and watchOS 11.5 and earlier. Remote attackers can trigger a denial-of-service condition requiring only user interaction to visit a malicious page, with no elevated privileges required. Apple has released patches for all affected platforms; the EPSS score of 0.10% (28th percentile) indicates low real-world exploitation probability despite the accessibility of the attack vector.
Safari and related Apple platforms crash when processing maliciously crafted web content due to improper memory handling in a buffer overflow condition (CWE-119). The vulnerability affects Safari 18.5 and earlier, iOS 18.5 and earlier, iPadOS 18.5 and earlier, macOS Sequoia 15.5 and earlier, tvOS 18.5 and earlier, visionOS 2.5 and earlier, and watchOS 11.5 and earlier. An unauthenticated remote attacker can trigger denial of service by hosting or injecting malicious web content that causes an unexpected browser crash. No public exploit code or active exploitation has been confirmed at time of analysis, though the low EPSS score (0.15%) suggests minimal real-world exploitation likelihood despite the moderate CVSS 6.5 severity.
Safari and Apple platform web content processing crashes due to a buffer overflow vulnerability when handling maliciously crafted web content. Affects Safari 18.5 and earlier, iOS 18.5 and earlier, iPadOS 18.5 and earlier, macOS Sequoia 15.5 and earlier, tvOS 18.5 and earlier, visionOS 2.5 and earlier, and watchOS 11.5 and earlier. Unauthenticated remote attackers can trigger a denial of service by enticing users to visit a malicious webpage, resulting in application crash with no data theft or code execution capability. No public exploit identified at time of analysis; EPSS score of 0.12% indicates low real-world exploitation probability despite moderate CVSS rating.
Safari and related Apple platforms crash when processing maliciously crafted web content due to a memory handling vulnerability (buffer overflow). Affects Safari 18.5 and earlier, iOS 18.5 and earlier, iPadOS 18.5 and earlier, macOS Sequoia 15.5 and earlier, tvOS 18.5 and earlier, visionOS 2.5 and earlier, and watchOS 11.5 and earlier. An unauthenticated remote attacker can trigger a denial of service by hosting or injecting malicious web content, with user interaction required to visit the affected content. No public exploit code or active exploitation has been confirmed (EPSS 0.08% indicates minimal real-world exploitation activity to date).
Denial-of-service vulnerability in Apple's WebKit engine affects Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS through improper memory handling during web content processing. Local attackers without authentication can trigger this vulnerability via crafted web content to cause application crashes. Vendor-released patches are available across all affected platforms; EPSS score of 0.02% indicates minimal real-world exploitation likelihood despite the moderate CVSS 6.2 rating.
Out-of-bounds write vulnerability in WebKit across Apple's entire operating system ecosystem allows remote code execution via maliciously crafted web content without user interaction or authentication. Affects iOS, iPadOS, macOS (Ventura through Sequoia), tvOS, visionOS, and watchOS prior to July 2025 security updates. Despite a critical 9.8 CVSS score indicating maximum severity, EPSS probability remains low at 0.14% (34th percentile), and no public exploit identified at time of analysis, suggesting limited observed exploitation attempts despite the theoretical remote attack surface.
Buffer overflow memory corruption in Apple file parsing components allows remote code execution across iOS 18.6, iPadOS 18.6, macOS (Sequoia 15.6, Sonoma 14.7.7, Ventura 13.7.7), tvOS 18.6, visionOS 2.6, and watchOS 11.6. Unauthenticated attackers can trigger arbitrary code execution by delivering a maliciously crafted file requiring no user interaction beyond parsing. Despite CVSS 9.8 critical severity, EPSS score of 0.16% (37th percentile) indicates low observed exploitation probability. No public exploit identified at time of analysis and not listed in CISA KEV, suggesting theoretical risk exceeds current real-world threat activity.
Memory corruption in Apple's WebKit browser engine across Safari 18.x, iOS/iPadOS 18.x, macOS Sequoia 15.x, and other Apple operating systems allows remote attackers to achieve arbitrary code execution via maliciously crafted web content requiring only user interaction (visiting a malicious webpage). With CVSS 8.8 (High), the vulnerability enables complete system compromise (high confidentiality, integrity, and availability impact) but carries relatively low real-world exploitation probability (EPSS 0.10%, 27th percentile). No public exploit identified at time of analysis, and vendor-released patches are available across all affected platforms as of July-August 2025.
Memory corruption in WebKit browser engine allows remote code execution across Apple's ecosystem (Safari 18.6, iOS/iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6) when users interact with maliciously crafted web content. The vulnerability stems from improper memory handling (CWE-119 buffer overflow) and requires no authentication but user interaction to trigger. EPSS score of 0.10% (26th percentile) indicates low observed exploitation probability, and no public exploit identified at time of analysis, though the CVSS 8.8 rating reflects the potential for complete system compromise if successfully exploited.
Remote denial-of-service in Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) allows unauthenticated network attackers to trigger unexpected system termination via improved checks bypass. Affects multiple OS versions prior to their respective May 2025 updates (iOS/iPadOS 18.5/17.7.9, macOS Sequoia 15.5/Ventura 13.7.7, tvOS 18.5, visionOS 2.5, watchOS 11.5). No public exploit identified at time of analysis. EPSS probability of 0.27% (51st percentile) suggests relatively low observed exploitation activity, though the network-accessible attack vector and lack of authentication requirements (CVSS AV:N/PR:N) create broad exposure surface across Apple's ecosystem.
The issue was addressed with improved checks. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Processing web content may lead to arbitrary code execution. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
A denial-of-service issue was addressed with improved input validation. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved memory handling. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
This issue was addressed with improved checks. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
The issue was addressed with improved checks. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
The issue was addressed with improved checks. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A permissions issue was addressed with additional restrictions. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
A race condition was addressed with improved locking. Rated medium severity (CVSS 5.1), this vulnerability is no authentication required. No vendor patch available.
A type confusion issue was addressed with improved memory handling. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved checks. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved checks. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved checks. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
A race condition was addressed with additional validation. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
The issue was addressed with improved checks. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The issue was addressed with improved checks. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
This issue was addressed with improved redaction of sensitive information. Rated low severity (CVSS 3.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A logic issue was addressed with improved checks. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A cookie management issue was addressed with improved state management. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved bounds checks. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved bounds checks. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved bounds checks. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved checks. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.