SB2026051214 - Multiple vulnerabilities in Apple iOS 18 and iPadOS 18
Published: May 12, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 47 vulnerabilities.
1) Out-of-bounds write (CVE-ID: CVE-2026-43666)
The vulnerability allows a remote attacker on the local network to perform a denial of service (DoS) attack.
The vulnerability exists due to an out-of-bounds write in mDNSResponder. A remote attacker on the local network can cause a denial-of-service.
2) Protection Mechanism Failure (CVE-ID: CVE-2026-28907)
The vulnerability allows a remote attacker to prevent CSP enforcement.
The vulnerability exists due to insufficient implementation of security measures in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and prevent Content Security Policy from being enforced.
3) Use after free (CVE-ID: CVE-2026-43668)
The vulnerability allows a remote attacker to escalate privileges on the system.
The vulnerability exists due to a use-after-free error in mDNSResponder. A remote attacker can trick the victim into opening a specially crafted file and cause unexpected system termination or corrupt kernel memory.
4) Improper authorization (CVE-ID: CVE-2026-28877)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper authorization checks in the Accounts component. A local application can gain access to sensitive user information.
5) Memory corruption (CVE-ID: CVE-2026-28940)
The vulnerability allows a remote attacker to escalate privileges on the system.
The vulnerability exists due to a boundary error in Model I/O. A remote attacker can trick the victim into opening a specially crafted file and escalate privileges on the system.
6) Improper access control (CVE-ID: CVE-2026-28941)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper access restrictions in Model I/O. A remote attacker can trick the victim into opening a specially crafted file and perform a denial-of-service or potentially disclose memory contents.
7) State Issues (CVE-ID: CVE-2026-28906)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a state issue in Networking. A remote attacker can track users through their IP address.
8) Out-of-bounds write (CVE-ID: CVE-2026-43656)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to an out-of-bounds write in Quick Look. A local application can trick the victim into opening a specially crafted file and perform an unexpected app termination.
9) Memory corruption (CVE-ID: CVE-2026-28846)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in SceneKit. A remote attacker can trick the victim into opening a specially crafted file and cause unexpected app termination.
10) Improper access control (CVE-ID: CVE-2026-28993)
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper access control in shortcuts when handling local application access. A local user can access the vulnerable component to disclose sensitive information.
11) Protection Mechanism Failure (CVE-ID: CVE-2026-43660)
The vulnerability allows a remote attacker to prevent CSP enforcement.
The vulnerability exists due to insufficient implementation of security measures in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and prevent Content Security Policy from being enforced.
12) Improper access control (CVE-ID: CVE-2026-28882)
The vulnerability allows a local user to escalate privileges and execute arbitrary code.
The vulnerability exists due to improper access control in libxpc when handling local application requests. A local user can exploit this to escalate privileges and execute arbitrary code.
Exploitation requires local access and the ability to execute a local application.
13) Memory corruption (CVE-ID: CVE-2026-28847)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into opening a specially crafted website and perform an unexpected process crash.
14) Memory corruption (CVE-ID: CVE-2026-28904)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into opening a specially crafted website and perform an unexpected process crash.
15) Memory corruption (CVE-ID: CVE-2026-28903)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into opening a specially crafted website and perform an unexpected process crash.
16) Memory corruption (CVE-ID: CVE-2026-28955)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into opening a specially crafted website and perform an unexpected process crash.
17) Memory corruption (CVE-ID: CVE-2026-28953)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into opening a specially crafted website and perform an unexpected process crash.
18) Improper access control (CVE-ID: CVE-2026-28962)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in WebKit when rendering content. A remote attacker can trick the victim into visiting a specially crafted website and gain access to sensitive information.
19) Improper input validation (CVE-ID: CVE-2026-28917)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation in WebKit. A remote attacker can trick the victim into opening a specially crafted website and perform an unexpected process crash.
20) Out-of-bounds write (CVE-ID: CVE-2026-28819)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to an out-of-bounds write in Wi-Fi. A local application can execute arbitrary code with kernel privileges.
21) Use-after-free (CVE-ID: CVE-2026-28994)
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in Wi-Fi when handling wireless network traffic. A remote attacker can send specially crafted wireless traffic to cause a denial of service.
22) Memory corruption (CVE-ID: CVE-2026-43653)
The vulnerability allows a remote attacker on the local network to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in mDNSResponder. A remote attacker on the local network can cause a denial-of-service.
23) Improper input validation (CVE-ID: CVE-2026-28929)
24) Improper access control (CVE-ID: CVE-2026-28983)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper access restrictions in LaunchServices. A remote attacker can trick the victim into opening a specially crafted file and cause a denial of service.
25) Improper input validation (CVE-ID: CVE-2026-28943)
26) Memory corruption (CVE-ID: CVE-2026-28959)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in APFS. A local application can cause unexpected system termination.
27) Improper access control (CVE-ID: CVE-2026-28995)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to improper access restrictions in App Intents. A local application can break out of its sandbox.
28) Memory corruption (CVE-ID: CVE-2026-39869)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in Audio. A remote attacker can trick the victim into opening a specially crafted file and perform a denial of service (DoS) attack.
29) Improper input validation (CVE-ID: CVE-2026-28894)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation in Calling Framework. A remote attacker can trick the victim into opening a specially crafted file and cause a denial-of-service.
30) Improper access control (CVE-ID: CVE-2026-28936)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to improper access restrictions in CoreServices. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.
31) Improper access control (CVE-ID: CVE-2026-43659)
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper access control in FileProvider when handling file provider operations. A local user can access sensitive information to disclose sensitive information.
32) Information disclosure (CVE-ID: CVE-2026-28870)
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper access controls in GeoServices when handling local application requests. A local user can exploit this to disclose sensitive information.
Access to the local system is required to exploit this vulnerability.
33) Memory corruption (CVE-ID: CVE-2026-28977)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in ImageIO. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.
34) Improper input validation (CVE-ID: CVE-2026-28992)
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper input validation in IOHIDFamily when processing user-supplied input. A local user can send specially crafted input to cause a denial of service.
35) Out-of-bounds read (CVE-ID: CVE-2026-28920)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in zlib. A remote attacker can trick the victim into visiting a specially crafted website, trigger an out-of-bounds read error and read contents of memory on the system.
36) Use after free (CVE-ID: CVE-2026-28969)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a use-after-free error in IOKit. A local application can cause unexpected system termination.
37) Memory corruption (CVE-ID: CVE-2026-43654)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a boundary error in Kernel. A local application can disclose kernel memory.
38) Improper access control (CVE-ID: CVE-2026-28954)
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper access control in kernel when handling local access to kernel resources. A local user can access sensitive kernel-managed information to disclose sensitive information.
39) Improper input validation (CVE-ID: CVE-2026-28897)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation in Kernel. A local user can cause unexpected system termination or read kernel memory.
40) Improper input validation (CVE-ID: CVE-2026-28952)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation in Kernel. A local application can cause unexpected system termination.
41) State issues (CVE-ID: CVE-2026-28951)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a state management issue in Kernel. A local application can gain root privileges.
42) Out-of-bounds write (CVE-ID: CVE-2026-28972)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to an out-of-bounds write in Kernel. A local application can cause unexpected system termination or write kernel memory.
43) Improper access control (CVE-ID: CVE-2026-28986)
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper access control in kernel when handling a local application. A local user can run a local application to cause a denial of service.
44) Improper input validation (CVE-ID: CVE-2026-28987)
45) Resource exhaustion (CVE-ID: CVE-2026-28872)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources in Calendar. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
46) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-28873)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due a possibility to circumvent App Privacy Report logging. A local application can include sensitive information into log files.
47) Protection Mechanism Failure (CVE-ID: CVE-2026-28957)
The vulnerability allows a local application to capture user's screen.
The vulnerability exists due to insufficient implementation of app access to camera metadata in Status Bar. A local application capture user's screen.
Remediation
Install update from vendor's website.