SB2026102747 - Multiple vulnerabilities in Apple iOS 18 and iPadOS 18

Description

This security bulletin contains information about 3 vulnerabilities.

1) Improper access control (CVE-ID: CVE-2026-65339)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper access control in Audio when handling local application access. A local user can access the vulnerable component to escalate privileges.

2) Out-of-bounds write (CVE-ID: CVE-2026-86950) Exploited

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing files within the CoreGraphics component. A remote attacker can trick the victim into opening a specially crated file, trigger memory corruption and execute arbitrary code on the target system.

Note, the vulnerability is being actively exploited in the wild against iPhone users. 

3) Information disclosure (CVE-ID: CVE-2026-86990)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to insufficient protection of sensitive information in the CoreMedia component when accessed by a local application. A local user can use a local application to access sensitive information.

Remediation

Install update from vendor's website.

References

• https://support.apple.com/en-us/149225