For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.
Apple security documents reference vulnerabilities by CVE-ID when possible.
For more information about security, see the Apple Product Security page.
Impact: An app may be able to access sensitive user data
Description: An access issue was addressed with additional sandbox restrictions.
Impact: An app may be able to gain root privileges
Description: A parsing issue in the handling of directory paths was addressed with improved path validation.
CVE-2026-43749: Adam Franke, Ashish Kunwar, Trung Nguyen (@everping) of CyStack
Impact: An app may be able to fingerprint the user
Description: This issue was addressed with improved data protection.
CVE-2026-64733: Rosyna Keller of Totally Not Malicious Software (paradisefacade.com)
Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory
Description: A buffer overflow was addressed with improved bounds checking.
Impact: A remote attacker may be able to cause a denial-of-service
Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2026-23918: Юлия Мерцалова
Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory
Description: The issue was addressed with improved memory handling.
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved checks.
Impact: An app may be able to access sensitive user data
Description: A race condition was addressed with improved state handling.
Impact: A malicious app may be able to break out of its sandbox
Description: An authorization issue was addressed with improved state management.
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-43748: an anonymous researcher, tamdao, Franco Belman at Blackwing Intelligence
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory management.
Impact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution
Description: A buffer overflow was addressed with improved bounds checking.
CVE-2026-43776: Irvin Wang, Peter Malone, Nicolas Rabrenovic
Impact: A local user may be able to read kernel memory
Description: A buffer overflow was addressed with improved bounds checking.
CVE-2026-43681: impost0r (ret2plt), David Ige – Beryllium Security
Impact: A malicious application may be able to bypass Privacy preferences
Description: An authorization issue was addressed with improved state management.
Impact: An app may be able to read files outside of its sandbox
Description: A permissions issue was addressed by removing the vulnerable code.
CVE-2026-43763: Pavan Nallamothu, Jared Reyes
Impact: An app may be able to break out of its sandbox
Description: An access issue was addressed with additional sandbox restrictions.
Impact: An app may be able to cause a denial-of-service
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)
Impact: An app may be able to fingerprint the user
Description: A permissions issue was addressed with additional restrictions.
CVE-2026-43730: David Strnadel
Impact: An app may be able to execute arbitrary code with kernel privileges
Description: A buffer overflow was addressed with improved size validation.
CVE-2026-64747: Franco Belman at Blackwing Intelligence
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds read was addressed with improved bounds checking.
CVE-2026-64762: Dun, Franco Belman at Blackwing Intelligence
Impact: An app may be able to delete files for which it does not have permission
Description: A permissions issue was addressed with improved validation.
CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab
Impact: An app may be able to cause unexpected system termination or read kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64698: an anonymous researcher, Richard Zana, Nathaniel Oh (@calysteon), Peter Malone
Impact: A maliciously crafted app may be able to bypass code signing enforcement
Description: A validation issue was addressed with improved input sanitization.
CVE-2026-43813: Anton Pakhunov
Impact: An app may be able to add contacts without user authorization
Description: An authorization issue was addressed with improved validation.
CVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel Febrero
Impact: Processing a maliciously crafted contact may leak sensitive data
Description: The issue was addressed with improved checks.
CVE-2026-64734: Daniel Williams
Impact: An app may be able to access information about a user's contacts
Description: This issue was addressed with improved checks.
CVE-2026-43797: Arni Hardarson (Neonix Security)
Impact: An app may be able to access user-sensitive data
Description: A logic issue was addressed with improved validation.
Impact: An app may be able to gain root privileges
Description: A race condition was addressed with improved state handling.
CVE-2026-43693: Gergely Kalman (@gergely_kalman)
Impact: Processing a maliciously crafted audio file may corrupt process memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative
Impact: Processing an audio stream in a maliciously crafted media file may terminate the process
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-43744: Mathis Mansière, an anonymous researcher
Impact: A remote attacker may be able to cause unexpected system termination
Description: An out-of-bounds write issue was addressed with improved bounds checking.
Impact: An app may be able to access sensitive user data
Description: An authorization issue was addressed with improved state management.
CVE-2026-43775: Csaba Fitzl (@theevilbit) of Iru
CVE-2026-43759: 이재영, Rajdip Dey Sarkar, Arni Hardarson (Neonix Security)
Impact: Processing a maliciously crafted video file may lead to unexpected app termination
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2026-43711: James Duffy (@0x4A616D657344)
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-43802: an anonymous researcher
Impact: An app may be able to leak sensitive user information
Description: A privacy issue was addressed by removing sensitive data.
CVE-2026-64710: Matthew Schneider
Impact: A malicious app may be able to gain root privileges
Description: A permissions issue was addressed with additional restrictions.
CVE-2026-39875: Dallas Dubs, Aaron Grattafiori – NVIDIA AI Red Team, XBreach.ai, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
Impact: An app may be able to gain root privileges
Description: An injection issue was addressed with improved validation.
CVE-2026-43698: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
Impact: Authentication credentials may be sent to a server on another origin
Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.
Impact: An app may be able to access sensitive user data
Description: An authorization issue was addressed with improved state management.
Impact: An app may bypass Gatekeeper checks
Description: A file quarantine bypass was addressed with additional checks.
CVE-2026-64708: Lance Cain – Offensive Security Engineer, SpecterOps Inc.
Impact: An app may be able to disclose kernel memory
Description: The issue was addressed with improved bounds checks.
CVE-2026-64776: Hyunwoo Kim (@v4bel)
Impact: An app may be able to cause unexpected system termination
Description: An integer overflow was addressed with improved input validation.
CVE-2026-64694: Gil Portnoy & Henry
Impact: Parsing a maliciously crafted file may lead to an unexpected app termination
Description: An out-of-bounds read was addressed with improved bounds checking.
CVE-2026-43747: Anthony Laou Hine Tsuei (@anarcheuz)
Impact: An app may be able to bypass network restrictions
Description: A permissions issue was addressed with additional sandbox restrictions.
Impact: An app may be able to cause unexpected system termination
Description: An issue existed in the handling of environment variables. This issue was addressed with improved validation.
CVE-2026-43793: erdene-och Byambabayar
Impact: An attacker with physical access to a locked device may be able to view sensitive user information
Description: An out-of-bounds read was addressed with improved bounds checking.
Impact: A malicious app may be able to access protected user data
Description: The issue was addressed with improved input sanitization.
CVE-2026-43714: an anonymous researcher
Impact: A malicious app may be able to break out of its sandbox
Description: A parsing issue in the handling of directory paths was addressed with improved path validation.
CVE-2026-64740: Manuel Fernandez (Stackhopper Security)
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved data protection.
CVE-2026-43796: Ilya Andr (andrd3v) of Positive Technologies, Stanislav Jelezoglo
Impact: An app may be able to cause unexpected system termination
Description: A buffer overflow was addressed with improved size validation.
CVE-2026-64691: Somair Ansar, Josh Maine of Calif.io, Johnny Franks (@zeroxjf), hxr1, Alexandre Soleiman, Alexander Tarasikov and Ruslan Dautov, Ruslan Dautov
Impact: An app may be able to cause a denial-of-service
Description: An out-of-bounds read was addressed with improved bounds checking.
Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43682: Trung Nguyen (@everping) of CyStack, Dave G., Nicolas Rabrenovic, Atul R V & Ashmit Sharma, Peter Malone
Impact: Processing a maliciously crafted image may lead to arbitrary code execution
Description: A buffer overflow was addressed with improved bounds checking.
CVE-2026-28981: Hcamael and 章鱼哥@aipy （aipyaipy.com）, Aswin Kumar Gokulakannan, Surya Narayan Kushwaha, Dun
Impact: Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory
Description: An out-of-bounds read was addressed with improved bounds checking.
CVE-2026-43773: Richard Zana, Peter Malone, Surya Narayan Kushwaha, Hyunwoo Kim (@v4bel), Cem Onat Karagun
Impact: An app may be able to cause unexpected system termination
Description: The issue was addressed with improved memory handling.
CVE-2026-43767: Hyunwoo Kim (@v4bel)
Impact: An app may be able to cause unexpected system termination
Description: An integer overflow was addressed with improved input validation.
CVE-2026-43764: Tristan Madani (@TristanInSec) from Talence Security
Impact: An app may be able to cause unexpected system termination or corrupt kernel memory
Description: The issue was addressed with improved memory handling.
Impact: An attacker may be able to cause unexpected system termination or corrupt kernel memory
Description: The issue was addressed with improved memory handling.
Impact: Processing a maliciously crafted texture may lead to unexpected app termination
Description: An integer overflow was addressed with improved input validation.
CVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative
Impact: Processing a maliciously crafted image may lead to arbitrary code execution
Description: An integer overflow was addressed with improved input validation.
CVE-2026-43818: an anonymous researcher
Impact: Processing a maliciously crafted image may corrupt process memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64716: Arni Hardarson, Jonathan Alush-Aben, Peter Malone
Impact: Processing a maliciously crafted file may lead to unexpected app termination
Description: The issue was addressed with improved bounds checks.
CVE-2026-64758: 진규정 (Gyujeong Jin, @G1uN4sh)
Impact: Processing a maliciously crafted file may lead to a denial-of-service
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-64754: PETOWORKS의 Bugeun Choi (@Bugeun), Rahul Raj
Impact: Processing a maliciously crafted image may lead to a denial-of-service
Description: A type confusion issue was addressed with improved checks.
CVE-2026-64693: Geonha Lee (@leegn4a)
Impact: An app may be able to cause unexpected system termination or write kernel memory
Description: A race condition was addressed with improved state handling.
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved checks.
Impact: An app may be able to cause unexpected system termination or corrupt kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64749: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ashish Kunwar, Hiroki Imai (LAC Co., Ltd.), hxr1
Impact: An app may be able to disclose kernel memory
Description: An information leakage was addressed with additional validation.
CVE-2026-64744: Ryan Hileman via Xint Code (xint.io)
Impact: An app may be able to cause unexpected system termination or corrupt kernel memory
Description: A use after free issue was addressed with improved memory management.
CVE-2026-43778: f0r of MurphySec, Feng Xue and XGPT of ThreatBook, Mahmoud Abdelmoniem, an anonymous researcher, Wang Yu, Lyutoon, Hiroki Imai (LAC Co., Ltd.), DARKNAVY (@DarkNavyOrg), Fábio Luís @scanpt, Nicolas Rabrenovic
Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory
Description: A race condition was addressed with improved locking.
CVE-2026-28982: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Adam Doupé of ASU SEFCOM
Impact: An app may be able to disclose kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64709: Pasquale Scola, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.
Impact: A remote attacker may be able to bypass network filters
Description: An inconsistent user interface issue was addressed with improved state management.
CVE-2026-64735: Gor Aleksanyan
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-43739: impost0r (ret2plt), Ruslan Dautov, Aleksandr Tarasikov, jay, Dhiyanesh Selvaraj (@redroot97), Vinay Kumar Rasala (Xplo8E) from Appknox, Lyutoon, DongJun Kim (smlijun) with UIUC, Hwiwon Lee (hwiwonl) with UIUC, Jongseong Kim (nevul37) with UIUC, Younggi Park (grill66) with UIUC, Peter Malone, an anonymous researcher, Hari Shanmugam (The Hxr1), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Marco Grassi, Dun, Daniele Castronovo, Michal Kosiorek
CVE-2026-43816: Josh Maine of Calif.io, Ruslan Dautov, 재영 정, @rootxran (Rao Ali Nawaz), Chanwit Muenprakoddee (ChemIndy), an anonymous researcher, Ye Zhang (@VAR10CK) of Baidu Security, Franco Belman at Blackwing Intelligence, Christian Figueroa, Johnny Franks (@zeroxjf), Ashmit Sharma & Atul RV, Peter Malone, Muhamad Syaiful, Muneeb Amin Bhat, Dhiyanesh Selvaraj (@redroot97), Ali Marzouq, Bountyy Oy – Mihalis Haatainen, Huy Nguyen (@34306) of Calif.io
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory management.
CVE-2026-43822: Eddy Tsalolikhin, Michal Kosiorek
CVE-2026-64729: Josh Maine of Calif.io, beist, Adam Doupé of ASU SEFCOM, Dun, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Johnny Franks (@zeroxjf)
CVE-2026-43814: Somair Ansar, Huy Nguyen (@34306) of Calif.io
CVE-2026-64700: Asjid Kalam (@odinshell)
CVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.
Impact: Connecting to a malicious NFS server may lead to kernel memory corruption
Description: A buffer overflow was addressed with improved bounds checking.
CVE-2026-28931: Redon Gashi, Abhijeet Singh (linkedin.com/in/abhiunix/), Peter Malone, Omar Cerrito
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds read was addressed with improved bounds checking.
CVE-2026-43817: Huy Nguyen (@34306) of Calif.io
CVE-2026-43809: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.
CVE-2026-43757: Wang Yu, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.
Impact: An app may be able to cause unexpected system termination
Description: An integer overflow was addressed with improved input validation.
CVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.
Impact: An app may be able to cause unexpected system termination
Description: A type confusion issue was addressed with improved memory handling.
CVE-2026-64727: Ye Zhang (@VAR10CK) of Baidu Security
Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43810: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.
Impact: An app may be able to cause unexpected system termination
Description: A memory initialization issue was addressed with improved memory handling.
CVE-2026-64775: Ryan Hileman via Xint Code (xint.io)
Impact: An app may be able to access sensitive user data
Description: A logic issue was addressed with improved checks.
CVE-2026-64723: Ji'an Zhou, Mingxuan Yang, Ye Zhang
Impact: An app may be able to cause unexpected system termination
Description: A race condition was addressed with improved state handling.
CVE-2026-64720: an anonymous researcher, Asjid Kalam (@odinshell), Jian Zhou and Ye Zhang
Impact: An app may be able to leak sensitive kernel state
Description: This issue was addressed with improved redaction of sensitive information.
CVE-2026-43754: Calif Research, Ernesto Martínez García
Impact: An app may be able to cause unexpected system termination or write kernel memory
Description: A use after free issue was addressed with improved memory management.
CVE-2026-64751: N.M.Praveen Nawarathne (@zblockrat)
Impact: An app may be able to access sensitive user data
Description: This issue was addressed through improved state management.
Impact: Processing a maliciously crafted file may result in disclosure of process memory
Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.
Impact: A malicious app may be able to break out of its sandbox
Description: An integer overflow was addressed with improved input validation.
CVE-2026-28973: an anonymous researcher
Impact: An attacker may be able to cause unexpected app termination
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-64739: Feng Xue and XGPT of ThreatBook, Dun
Impact: An attacker with physical access to a locked device may be able to view sensitive user information
Description: An authorization issue was addressed with improved state management.
CVE-2026-43766: Amy (amys.website)
Impact: An app may be able to access sensitive user data
Description: An authorization issue was addressed with improved state management.
CVE-2026-64743: Daniel Febrero
Impact: A malicious app may be able to break out of its sandbox
Description: A permissions issue was addressed with additional restrictions.
CVE-2026-64738: Nathaniel Oh (@calysteon), Robert Mindo
Impact: A local attacker may be able to cause a denial of service
Description: A denial of service issue was addressed by removing the vulnerable code.
CVE-2026-43806: He Wei (ギカク), 章鱼哥 (@aipy) of aipyaipy.com, Jex Amro, Cem Onat Karagun
Impact: An attacker on the local network may be able to cause a denial-of-service
Description: The issue was addressed with improved memory handling.
CVE-2026-64724: Daisuke Hatakeyama (@SYZD Research)
Impact: An app may be able to gain root privileges
Description: A path handling issue was addressed with improved validation.
CVE-2026-43723: Richard Zana, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
Impact: A malicious app may be able to corrupt memory of a system process
Description: The issue was addressed with improved memory handling.
CVE-2026-28911: yk lin of @pixiepointsec
Impact: Processing a maliciously crafted image may corrupt process memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43733: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative
CVE-2026-43729: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative
Impact: A remote attacker may be able to cause unexpected application termination or heap corruption
Description: An out-of-bounds write issue was addressed with improved input validation.
CVE-2026-64772: stratan (@5tratan), wh0am1i
Impact: A remote attacker may be able to cause unexpected application termination or heap corruption
Description: A buffer overflow was addressed with improved bounds checking.
Impact: Processing a 3D model may result in disclosure of process memory
Description: A buffer overflow issue was addressed with improved memory handling.
Impact: A remote attacker may be able to cause unexpected application termination or heap corruption
Description: An integer overflow was addressed with improved input validation.
CVE-2026-64774: stratan (@5tratan)
Impact: A remote attacker may be able to cause unexpected application termination or heap corruption
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-64770: stratan (@5tratan)
CVE-2026-64769: stratan (@5tratan)
Impact: A remote attacker may cause an unexpected app termination
Description: An out-of-bounds read issue was addressed with improved input validation.
CVE-2026-64768: stratan (@5tratan)
Impact: An app may be able to cause a denial-of-service
Description: A stack overflow was addressed with improved input validation.
Impact: An app may be able to break out of its sandbox
Description: A path traversal issue was addressed with improved input validation.
CVE-2026-43772: Mickey Jin (@patch1t)
Impact: An app may be able to leak sensitive user information
Description: This issue was addressed with additional entitlement checks.
CVE-2026-64711: Koh M. Nakagawa (@tsunek0h) of FFRI Security, Inc.
Impact: A user may be able to elevate privileges
Description: A logic issue was addressed with improved restrictions.
CVE-2026-28912: Matej Moravec (@MacejkoMoravec)
Impact: An app may be able to modify protected parts of the file system
Description: This issue was addressed with improved handling of symlinks.
CVE-2026-43765: Mickey Jin (@patch1t)
Impact: A malicious app may be able to break out of its sandbox
Description: A path handling issue was addressed with improved validation.
CVE-2026-64731: Sindre Sorhus, Richard Zana
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory management.
CVE-2026-43812: Francisco Knabe
Impact: An app may be able to cause unexpected system termination or write kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43694: Hcamael and 章鱼哥@aipy （aipyaipy.com）, JC Alvarado of Stripe, Jacob Hazak
Impact: A malicious app may be able to gain root privileges
Description: A permissions issue was addressed with additional restrictions.
CVE-2026-39874: @pixiepointsec
Impact: An app may be able to access sensitive user data
Description: An authorization issue was addressed with improved state management.
CVE-2026-43792: Ilya Andr (andrd3v)
Impact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution
Description: An integer overflow was addressed with improved input validation.
CVE-2026-64766: stratan (@5tratan)
CVE-2026-64765: stratan (@5tratan)
Impact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-64764: stratan (@5tratan)
Impact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution
Description: An out-of-bounds write issue was addressed by removing the vulnerable code.
CVE-2026-64763: stratan (@5tratan)
Impact: An app may be able to intercept network connections intended for another process
Description: A logic issue was addressed with improved restrictions.
CVE-2026-43779: Dave G., Asaf Cohen
Impact: A remote attacker may be able to cause a denial of service
Description: This issue was addressed with improved input validation.
CVE-2026-43777: Junming C.(Chapoly1305)
Impact: An app may be able to access user-sensitive data
Description: An access issue was addressed with improved access restrictions.
CVE-2026-43760: Alfredo Pesoli (@__rev) of Bynar.io, wdszzml and Atuin Automated Vulnerability Discovery Engine
Impact: An attacker may be able to modify the state of the Keychain
Description: This issue was addressed through improved state management.
CVE-2026-43728: Bob Gendler of the National Institute of Standards and Technology
Impact: An app may be able to gain root privileges
Description: A race condition was addressed with improved state management.
CVE-2026-43755: Mickey Jin (@patch1t)
Impact: A person with physical access to a locked device may be able to access contacts and photos
Description: This issue was addressed with additional restrictions on the lock screen.
CVE-2026-64745: Vivek Dhar, ASI (RM) in Border Security Force, FTR HQ BSF Kashmir
Impact: An app may be able to access sensitive user data
Description: An information disclosure issue was addressed by removing the vulnerable code.
CVE-2026-43800: Stanislav Jelezoglo
Impact: Connecting to a malicious SMB server may lead to unexpected system termination
Description: The issue was addressed with improved memory handling.
Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64696: Feng Xue and XGPT of ThreatBook, Peter Malone
Impact: An app may be able to cause unexpected system termination
Description: A type confusion issue was addressed with improved memory handling.
CVE-2026-64704: Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Aswin Kumar Gokulakannan, Kitten Food, Peter Malone, Calif.io in collaboration with Claude and Anthropic Research
Impact: An app may be able to access sensitive user data
Description: An out-of-bounds read was addressed with improved bounds checking.
CVE-2026-43774: Csaba Fitzl (@theevilbit) of Iru
Impact: An app may be able to access sensitive user data
Description: A race condition was addressed with additional validation.
CVE-2026-43770: Tien-Chih Lin of CyCraft Technology
Impact: An app may be able to cause unexpected system termination
Description: The issue was addressed with improved memory handling.
CVE-2026-43768: Hyunwoo Kim (@v4bel)
Impact: An app may be able to cause a denial-of-service
Description: A use after free issue was addressed with improved memory management.
CVE-2026-64703: Bruce Dang of Calif.io in collaboration with Claude and Anthropic Research
Impact: An app may be able to disclose kernel memory
Description: A memory initialization issue was addressed with improved memory handling.
CVE-2026-64699: Bruce Dang of Calif.io
Impact: Processing maliciously crafted web content may result in the disclosure of process memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43740: Arni Hardarson, Nathaniel Oh (@calysteon)
Impact: Websites may know if the user has visited a given link
Description: This issue was addressed with improved checks.
CVE-2026-64713: Kwak Kiyong, Song Nuri
Impact: Visiting a website that frames malicious content may lead to UI spoofing
Description: The issue was addressed with improved UI.
CVE-2026-64730: Kagami Rosylight of Mozilla
Impact: Maliciously crafted web content may violate iframe sandboxing policy
Description: A permissions issue was addressed with improved validation.
CVE-2026-64728: an anonymous researcher
Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash
Description: A use-after-free issue was addressed with improved memory management.
CVE-2026-64783: 杉山 壮太, lattice, Behzad Najjarpour Jabbari (@_G4ru_), Junyeong Lee, Mooth.ai, OGINOME Tomohito, Using GLM From Z.AI, Gia Bui (@yabeow) from Calif.io
Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash
Description: A memory corruption issue was addressed with improved state management.
CVE-2026-64757: Milad Nasr and Nicholas Carlini with Claude, Anthropic
Impact: Visiting a website may lead to an app denial-of-service
Description: This issue was addressed through improved state management.
CVE-2026-43804: Heiko Kiesel of SEEMOO, TU Darmstadt
Impact: An app may be able to read files outside of its sandbox
Description: An access issue was addressed with improved access restrictions.
CVE-2026-43821: Brian Carpenter
Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash
Description: A use-after-free issue was addressed with improved memory management.
CVE-2026-64718: OGINOME Tomohito, an anonymous researcher
Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash
Description: An out-of-bounds access issue was addressed with improved bounds checking.
Impact: An attacker in physical proximity may be able to corrupt process memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64726: Mathis Mansière, Peter Malone
Impact: An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges
Description: A buffer overflow was addressed with improved bounds checking.
CVE-2026-43750: an anonymous researcher
Impact: An app may be able to cause a denial of service
Description: A logic issue existed resulting in memory corruption. This was addressed with improved state management.
CVE-2026-28932: Mathis Mansière
We would like to acknowledge Niels Hofmans for their assistance.
We would like to acknowledge Keisuke Hosoda for their assistance.
We would like to acknowledge Alan Banderas (@creeper4004) for their assistance.
We would like to acknowledge yaohway for their assistance.
We would like to acknowledge Surya Narayan Kushwaha for their assistance.
We would like to acknowledge Jordy Zomer (@pwningsystems), Phillip Groves, Richard Zana for their assistance.
We would like to acknowledge Niels Hofmans for their assistance.
We would like to acknowledge Nick Cook, Sentry Flag for their assistance.
We would like to acknowledge Surya Narayan Kushwaha for their assistance.
We would like to acknowledge Aswin Kumar Gokula Kannan, Surya Narayan Kushwaha, Yatin Taneja for their assistance.
We would like to acknowledge Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Chris Betz, Hiroki Imai (LAC Co., Ltd.), James Duffy ( @0x4A616D657344 ), Mathis Mansière, Tristan Rousseau, Vladislav Shevchenko (Positive Technologies), Yeojin Kim, YingMuo (@YingMuo) of DEVCORE Research Team for their assistance.
We would like to acknowledge Asaf Cohen, Ashish Kunwar for their assistance.
We would like to acknowledge Jacolon Walker ( @call_eax ) for their assistance.
We would like to acknowledge Maliq Barnard, Tommy DeVoss from Braze Security Team (@thedawgyg), Willard Jansen for their assistance.
We would like to acknowledge an anonymous researcher for their assistance.
We would like to acknowledge Alfaz Hossain for their assistance.
We would like to acknowledge Ayaan Ahmad, XlabAI Team of Tencent Xuanwu Lab, Atuin Automated Vulnerability Discovery Engine, Guannan Wang, Zhanpeng Liu, Jiashuo Liang, Guancheng Li for their assistance.
We would like to acknowledge John Lussier, Oleh Konko of 1seal (1seal.org), alick for their assistance.
We would like to acknowledge Ilya Andr (andrd3v) and nkhmelni for their assistance.
We would like to acknowledge Masaki Moriguchi, Omar Cerrito for their assistance.
We would like to acknowledge Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs for their assistance.
We would like to acknowledge Jaya Surya Kommireddy, Jaya surya Kommireddy, Lukas Knittel (@kunte_ctf) of Ruhr-University Bochum, Nikos Fanourakis of Technical University of Crete, Sotiris Ioannidis of Technical University of Crete, Panagiotis Ilia of Cyprus University of Technology, and Kostas Drakonakis of Technical University of Crete, Tony Gorez (@tonygo_) for Reverse Society, Vitaly Simonovich, Youngjoon Kim of Team-Atlanta & sslab at Georgia Tech, s3zer0 for their assistance.
We would like to acknowledge Codex Security – Khai Tran, Daisuke Hatakeyama and Ryohei Ueki (@SYZD Research), David Bors at Snyk Security Labs, Giovanni Vignone and Robert van Eijk of Octane Security (octane.security), Kwak Kiyong, Song nuri, Luat Nguyen (CyberJutsu Academy), Tom Van Goethem, an anonymous researcher, dr3dd for their assistance.
We would like to acknowledge Gurpreet Shergill, Luke Francis, Milad Nasr and Nicholas Carlini with Claude, Anthropic, Oleh Konko of 1seal (1seal.org), Vitaly Simonovich for their assistance.
We would like to acknowledge Anurag Bohra of Microsoft, Cem Onat Karagun, Feng Xue and XGPT of ThreatBook, Kubilay Berk ALKAN, s3zer0 for their assistance.
We would like to acknowledge Ferdous Saljooki (@malwarezoo) of Jamf for their assistance.
Information about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. Contact the vendor for additional information.
Source: Hacker News — This article was automatically imported from the source. Read full article at original source →
