SB2026081827 - Multiple vulnerabilities in iOS 18 and iPadOS 18

Description

This security bulletin contains information about 122 vulnerabilities.

1) Out-of-bounds write (CVE-ID: CVE-2026-64770)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds write in Model I/O. A remote attacker can trick the victim into opening a specially crafted file and cause unexpected application termination or heap corruption.

2) Memory corruption (CVE-ID: CVE-2026-28984)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected Safari crash.

3) State Issues (CVE-ID: CVE-2026-65335)

CWE-ID: CWE-371 - State Issues

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to a state issue when processing untrusted web content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser. 

4) State Issues (CVE-ID: CVE-2026-65331)

CWE-ID: CWE-371 - State Issues

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to a state issue when processing untrusted web content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser. 

5) Memory corruption (CVE-ID: CVE-2026-43676)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected Safari crash.

6) Memory corruption (CVE-ID: CVE-2026-64784)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected Safari crash.

7) Buffer overflow (CVE-ID: CVE-2026-64757)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to memory corruption in WebKit when processing maliciously crafted web content. A remote attacker can send maliciously crafted web content to cause a denial of service.

User interaction is required to process the crafted web content.

8) Buffer overflow (CVE-ID: CVE-2026-65334)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to a boundary error in WebKit when processing untrusted web content. A remote attacker can trick the victim into visiting a malicious website and crash the browser.

9) Memory corruption (CVE-ID: CVE-2026-43663)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected process crash.

10) Memory corruption (CVE-ID: CVE-2026-39872)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected process crash.

11) Improper input validation (CVE-ID: CVE-2026-43735)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:/VI:/VA:/SC:N/SI:N/SA:N]

12) Use after free (CVE-ID: CVE-2026-43727)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error in WebKit. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected Safari crash.

13) Use after free (CVE-ID: CVE-2026-28947)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error in WebKit. A remote attacker can trick the victim into opening a specially crafted website and perform an unexpected Safari crash.

14) Exposure of sensitive information to an unauthorized actor (CVE-ID: CVE-2026-28958)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to excessive data output in WebKit. A local application can access sensitive user data.

15) Memory corruption (CVE-ID: CVE-2026-43795)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected Safari crash.

16) State Issues (CVE-ID: CVE-2026-65333)

CWE-ID: CWE-371 - State Issues

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to a state issue when processing untrusted web content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser. 

17) Memory corruption (CVE-ID: CVE-2026-65338)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected Safari crash.

18) Memory corruption (CVE-ID: CVE-2026-43658)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into opening a specially crafted website and perform an unexpected Safari crash.

19) Improper access control (CVE-ID: CVE-2026-28996)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in Storage when handling local application access. A local user can access sensitive information to disclose sensitive information.

20) Improper input validation (CVE-ID: CVE-2026-43800)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to insufficient input validation in Siri. A local application can access sensitive user data.

21) Improper input validation (CVE-ID: CVE-2026-64765)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation in SceneKit. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination or arbitrary code execution.

22) Improper input validation (CVE-ID: CVE-2026-64766)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation in SceneKit. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination or arbitrary code execution.

23) Out-of-bounds write (CVE-ID: CVE-2026-64763)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds write in SceneKit. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination or arbitrary code execution.

24) Out-of-bounds write (CVE-ID: CVE-2026-64764)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error in SceneKit. A remote attacker can create a specially crafted file, trick the victim into opening it using the affected software, trigger an out-of-bounds write and execute arbitrary code on the target system.

25) Use after free (CVE-ID: CVE-2026-43812)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error in Pro Res. A local application can cause unexpected system termination.

26) Memory corruption (CVE-ID: CVE-2026-64771)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in Model I/O. A remote attacker can trick the victim into opening a specially crafted file and cause unexpected application termination or heap corruption.

27) Improper input validation (CVE-ID: CVE-2026-64768)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation in Model I/O. A local application can trick the victim into opening a specially crafted file and perform a denial of service (DoS) attack.

28) Memory corruption (CVE-ID: CVE-2026-64722)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a boundary error in Model I/O. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.

29) Out-of-bounds write (CVE-ID: CVE-2026-64769)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds write in Model I/O. A remote attacker can trick the victim into opening a specially crafted file and cause unexpected application termination or heap corruption.

30) State Issues (CVE-ID: CVE-2026-65332)

CWE-ID: CWE-371 - State Issues

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to a state issue when processing untrusted web content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser. 

31) State Issues (CVE-ID: CVE-2026-65337)

CWE-ID: CWE-371 - State Issues

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to a state issue when processing untrusted web content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser. 

32) Improper input validation (CVE-ID: CVE-2026-64774)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation in Model I/O. A remote attacker can trick the victim into opening a specially crafted file and cause unexpected application termination or heap corruption.

33) Information disclosure (CVE-ID: CVE-2026-43708)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to improper input validation in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and exfiltrate data cross-origin.

34) State issues (CVE-ID: CVE-2026-64755)

CWE-ID: CWE-371 - State Issues

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a state management issue in WorkoutKit. A local application can access sensitive user data.

35) Memory corruption (CVE-ID: CVE-2026-64726)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to the system to escalate privileges on the system.

The vulnerability exists due to a boundary error in Wi-Fi. An attacker with physical access to the system can corrupt process memory.

36) Out-of-bounds write (CVE-ID: CVE-2026-64719)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds access in WebRTC when processing maliciously crafted web content. A remote attacker can send maliciously crafted web content to cause a denial of service.

User interaction is required to process the crafted web content.

37) Memory corruption (CVE-ID: CVE-2026-28979)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in WebRTC. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected process crash.

38) Use after free (CVE-ID: CVE-2026-43717)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error in WebRTC. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected Safari crash.

39) Buffer overflow (CVE-ID: CVE-2026-64779)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to a boundary error in WebKit Storage. A remote attacker can trick the victim into visiting a specially crafted website and  rash the browser.

40) Improper access control (CVE-ID: CVE-2026-43821)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read files outside of its sandbox.

The vulnerability exists due to improper access control in WebKit when an app accesses sandbox-restricted files. A local user can read files outside of its sandbox to read files outside of its sandbox.

41) Information disclosure (CVE-ID: CVE-2026-64778)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output in WebKit History. A remote attacker can gain unauthorized access to sensitive information.

42) Use after free (CVE-ID: CVE-2026-43720)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error in WebKit Canvas. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected Safari crash.

43) Out-of-bounds write (CVE-ID: CVE-2026-43745)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds write in WebKit. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected Safari crash.

44) Improper access control (CVE-ID: CVE-2026-43701)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper access control in WebKit when rendering content. A local user can trigger the vulnerable WebKit behavior to escalate privileges on the system.

45) Improper access control (CVE-ID: CVE-2026-43700)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 2.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in WebKit when rendering content. A local user can trigger processing of crafted content to disclose sensitive information.

46) Improper access control (CVE-ID: CVE-2026-43705)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass security restrictions.

The vulnerability exists due to improper access control in WebKit when rendering content. A remote attacker can craft malicious web content to bypass security restrictions.

47) State Issues (CVE-ID: CVE-2026-65336)

CWE-ID: CWE-371 - State Issues

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to a state issue when processing untrusted web content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser. 

48) Use-after-free (CVE-ID: CVE-2026-43731)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in WebKit when rendering web content. A remote attacker can trick the victim into opening a crafted webpage to execute arbitrary code.

49) Improper input validation (CVE-ID: CVE-2026-43725)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper input validation in WebKit when rendering content. A local user can trigger the vulnerable behavior to escalate privileges on the system.

50) Buffer overflow (CVE-ID: CVE-2026-43794)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code on the target system.

51) Input validation error (CVE-ID: CVE-2026-64780)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in WebKit. A remote attacker can trick the victim into visiting a malicious website and crash the browser.

52) Use after free (CVE-ID: CVE-2026-43742)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error in WebKit. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected process crash.

53) Use after free (CVE-ID: CVE-2026-43699)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error in WebKit. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected process crash.

54) Use after free (CVE-ID: CVE-2026-43726)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error in WebKit. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected process crash.

55) Use after free (CVE-ID: CVE-2026-43734)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error in WebKit. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected process crash.

56) Use-after-free (CVE-ID: CVE-2026-64715)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to a use-after-free error when processing untrusted web content in WebKit. A remote attacker can trick the victim into visiting a malicious website and crash the browser.

57) Memory corruption (CVE-ID: CVE-2026-65341)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to memory corruption in WebKit when rendering web content. A remote attacker can craft malicious web content to execute arbitrary code.

58) Improper input validation (CVE-ID: CVE-2026-64782)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in WebKit when handling web content. A remote attacker can send specially crafted content to cause a denial of service.

59) Improper input validation (CVE-ID: CVE-2026-64781)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation in WebKit. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected Safari crash.

60) State Issues (CVE-ID: CVE-2026-65340)

CWE-ID: CWE-371 - State Issues

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to a state issue when processing untrusted web content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser. 

61) State issues (CVE-ID: CVE-2026-64732)

CWE-ID: CWE-371 - State Issues

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to the system to gain access to sensitive information.

The vulnerability exists due to a state management issue in Accessibility. An attacker with physical access to the system can access sensitive user data during iPhone Mirroring.

62) Out-of-bounds write (CVE-ID: CVE-2026-64772)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds write in Model I/O. A remote attacker can trick the victim into opening a specially crafted file and cause unexpected application termination or heap corruption.

63) Improper access control (CVE-ID: CVE-2026-64693)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper access restrictions in ImageIO. A remote attacker can trick the victim into opening a specially crafted file and perform a denial-of-service.

64) Memory corruption (CVE-ID: CVE-2026-43711)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in CoreMedia. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.

65) Memory corruption (CVE-ID: CVE-2026-43661)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to a boundary error in ImageIO. A remote attacker can trick the victim into opening a specially crafted file and escalate privileges on the system.

66) Memory corruption (CVE-ID: CVE-2026-28990)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to a boundary error in ImageIO. A remote attacker can trick the victim into opening a specially crafted file and escalate privileges on the system.

67) Memory corruption (CVE-ID: CVE-2026-64716)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to a boundary error in ImageIO. A remote attacker can trick the victim into opening a specially crafted file and escalate privileges on the system.

68) Memory corruption (CVE-ID: CVE-2026-64692)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in Heimdal. A local application can cause a denial-of-service.

69) Exposure of sensitive information to an unauthorized actor (CVE-ID: CVE-2026-43796)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to excessive data output in Game Center. A local application can access sensitive user data.

70) Improper limitation of a pathname to a restricted directory ('path traversal') (CVE-ID: CVE-2026-64740)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to incorrect handling of path names in Game Center. A local application can trick the victim into opening a specially crafted file and break out of its sandbox.

71) Improper access control (CVE-ID: CVE-2026-64742)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in FrontBoard when handling requests from a local application. A local user can send a crafted request to disclose sensitive information.

72) Improper access control (CVE-ID: CVE-2026-43714)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in Foundation when handling requests from a local application. A local user can invoke the vulnerable functionality to disclose sensitive information.

73) Insufficiently protected credentials (CVE-ID: CVE-2026-3783)

CWE-ID: CWE-522 - Insufficiently Protected Credentials

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information on the system.

The vulnerability exists due to insufficiently protected credentials When the OAuth2 bearer token is used for an HTTP(S) transfer. A remote attacker can gain access to sensitive information on the system.

74) Authentication Bypass by Primary Weakness (CVE-ID: CVE-2026-3784)

CWE-ID: CWE-305 - Authentication Bypass by Primary Weakness

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to wrong proxy connection reuse with credentials. A remote attacker can bypass authentication and gain access to the target system.

75) Out-of-bounds write (CVE-ID: CVE-2026-43802)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds write in CoreVideo. A local application can cause unexpected system termination.

76) Memory corruption (CVE-ID: CVE-2026-43738)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a boundary error in CoreUI. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.

77) Out-of-bounds write (CVE-ID: CVE-2026-43803)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds write in CoreAudio. A remote attacker can trick the victim into opening a specially crafted file and cause unexpected system termination.

78) Memory corruption (CVE-ID: CVE-2026-43729)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to a boundary error in Model I/O. A remote attacker can trick the victim into opening a specially crafted file and escalate privileges on the system.

79) Out-of-bounds write (CVE-ID: CVE-2026-43744)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds write in CoreAudio. A remote attacker can trick the victim into opening a specially crafted file and perform a denial of service (DoS) attack.

80) Memory corruption (CVE-ID: CVE-2026-43673)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to a boundary error in CoreAudio. A remote attacker can trick the victim into opening a specially crafted file and escalate privileges on the system.

81) Improper access control (CVE-ID: CVE-2026-43797)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in Contacts. A local application can access information about a user\'s contacts.

82) Improper access control (CVE-ID: CVE-2026-64734)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass access restrictions.

The vulnerability exists due to improper access control in contacts when handling requests. A remote attacker can send a crafted request to bypass access restrictions.

83) Improper input validation (CVE-ID: CVE-2026-64746)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in contacts when processing input from a local application. A local user can provide crafted input to cause a denial of service.

84) Improper access control (CVE-ID: CVE-2026-43811)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improper access restrictions in Books. A local application can modify protected parts of the file system.

85) Improper input validation (CVE-ID: CVE-2026-64707)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise the affected component.

The vulnerability exists due to improper input validation in BackgroundAssets when handling input from a local application. A local user can provide crafted input to compromise the affected component.

86) Memory corruption (CVE-ID: CVE-2026-64762)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in AVEVideoEncoder. A local application can cause unexpected system termination.

87) Improper access control (CVE-ID: CVE-2026-64747)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper access control in AVEVideoEncoder when accessed by a local application. A local user can interact with the vulnerable component to escalate privileges.

88) Out-of-bounds write (CVE-ID: CVE-2026-64725)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds write in Audio. A local application can cause a denial-of-service.

89) Memory corruption (CVE-ID: CVE-2026-43776)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in AppleDouble. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination or arbitrary code execution.

90) Improper access control (CVE-ID: CVE-2026-43801)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in App Store. A local application can access sensitive user data.

91) Improper input validation (CVE-ID: CVE-2026-43818)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to insufficient input validation in ImageIO. A remote attacker can trick the victim into opening a specially crafted file and perform arbitrary code execution.

92) Memory corruption (CVE-ID: CVE-2026-39877)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a boundary error in IOSkywalkFamily. A local application can disclose kernel memory.

93) Improper input validation (CVE-ID: CVE-2026-43667)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in AirDrop when handling requests. A remote attacker can send a specially crafted request to cause a denial of service.

94) Improper access control (CVE-ID: CVE-2026-64723)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in Kernel. A local application can access sensitive user data.

95) Memory corruption (CVE-ID: CVE-2026-43733)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to a boundary error in Model I/O. A remote attacker can trick the victim into opening a specially crafted file and escalate privileges on the system.

96) Memory corruption (CVE-ID: CVE-2026-43807)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to memory corruption in MobileAccessoryUpdater when handling input. A local attacker can trigger the vulnerable condition to cause a denial of service.

97) Improper limitation of a pathname to a restricted directory ('path traversal') (CVE-ID: CVE-2026-43723)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to incorrect handling of path names in MediaRemote. A local application can gain root privileges.

98) Memory corruption (CVE-ID: CVE-2026-64724)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in mDNSResponder. A remote attacker on the local network can cause a denial-of-service.

99) Permissions, privileges, and access controls (CVE-ID: CVE-2026-64738)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions in Maps. A local application can break out of its sandbox.

100) State issues (CVE-ID: CVE-2026-64743)

CWE-ID: CWE-371 - State Issues

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a state management issue in Managed Configuration. A local application can access sensitive user data.

101) Out-of-bounds write (CVE-ID: CVE-2026-64739)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds write in libnotify when processing input. A local user can trigger the vulnerable behavior to cause a denial of service.

102) Improper input validation (CVE-ID: CVE-2026-28973)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to insufficient input validation in libc. A local application can break out of its sandbox.

103) Improper input validation (CVE-ID: CVE-2026-4424)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper input validation in libarchive when parsing input. A remote attacker can supply specially crafted archive data to disclose sensitive information.

104) Memory corruption (CVE-ID: CVE-2026-64709)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a boundary error in Kernel. A local application can disclose kernel memory.

105) Memory corruption (CVE-ID: CVE-2026-43810)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error in Kernel. A local user can trick the victim into opening a specially crafted file and cause unexpected system termination or corrupt kernel memory.

106) Improper input validation (CVE-ID: CVE-2026-39868)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to insufficient input validation in Kernel. A local application can cause unexpected system termination or corrupt kernel memory.

107) Information disclosure (CVE-ID: CVE-2026-43754)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper exposure of sensitive information in kernel when running a local application. A local user can execute a local application to disclose sensitive information.

108) Memory corruption (CVE-ID: CVE-2026-43757)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in Kernel. A local application can cause unexpected system termination.

109) Memory corruption (CVE-ID: CVE-2026-43809)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in Kernel. A local application can cause unexpected system termination.

110) State issues (CVE-ID: CVE-2026-64721)

CWE-ID: CWE-371 - State Issues

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a state management issue in Kernel. A local application can access sensitive user data.

111) Information disclosure (CVE-ID: CVE-2026-43722)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to potentially sensitive information.

The vulnerability exists due to improper input validation within the OS kernel. A local application can gain access to sensitive kernel state.

112) Improper input validation (CVE-ID: CVE-2026-43769)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation in Kernel. A local application can cause unexpected system termination.

113) Improper access control (CVE-ID: CVE-2026-43724)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper access control in kernel when handling input from a local application. A local user can run a local application to escalate privileges.

114) Use after free (CVE-ID: CVE-2026-64700)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error in Kernel. A local application can cause unexpected system termination.

115) Use after free (CVE-ID: CVE-2026-43799)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error in Kernel. A local application can cause unexpected system termination.

116) Use after free (CVE-ID: CVE-2026-43822)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error in Kernel. A local application can cause unexpected system termination.

117) State Issues (CVE-ID: CVE-2026-64735)

CWE-ID: CWE-371 - State Issues

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of behavioral workflow in Kernel when handling requests. A remote attacker can send a specially crafted request to cause a denial of service.

118) Use after free (CVE-ID: CVE-2026-43778)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in Kernel. A local application can cause unexpected system termination or corrupt kernel memory.

119) Improper access control (CVE-ID: CVE-2026-64744)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in kernel when handling requests from a local application. A local user can run a local application to disclose sensitive information.

120) Memory corruption (CVE-ID: CVE-2026-64749)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error in Kernel. A local application can cause unexpected system termination or corrupt kernel memory.

121) Memory corruption (CVE-ID: CVE-2026-64695)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error in APFS. A local user can trick the victim into opening a specially crafted file and cause unexpected system termination or corrupt kernel memory.

122) Information disclosure (CVE-ID: CVE-2026-64760)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to potentially sensitive information.

The vulnerability exists due to an error in IOSurfaceAccelerator. A local application can read sensitive kernel state.

Remediation

Install update from vendor's website.

References

• https://support.apple.com/en-us/148287