Threat database

A logic issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An attacker with physical access to a locked device may be able to view sensitive user information.

CVE-2026-84585 is a permissions vulnerability in Apple macOS that allowed an app to access local network devices without user consent. The issue was addressed by improved state management and fixed in macOS Golden Gate 27. The vulnerability has a medium severity score of 5.5 and requires user interaction to exploit.

A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27. Opening a maliciously crafted file may lead to unexpected process termination.

CVE-2026-84602 is a type confusion vulnerability in Apple iOS and iPadOS that may allow an app to cause unexpected system termination. The issue was addressed with improved checks and fixed in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and related Apple operating systems. The vulnerability has a medium severity rating with a CVSS score of 5.5 and does not impact confidentiality or integrity but affects availability.

An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27. Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure.

A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain elevated privileges.

CVE-2026-65355 is an information disclosure vulnerability in Apple iOS and iPadOS where a website may be able to determine a user's IP address despite Private Relay being enabled. This issue has been addressed with improved state management and fixed in iOS 18.7.10, iPadOS 18.7.10, iOS 26.6.1, iPadOS 26.6.1, macOS Tahoe 26.6.2, and visionOS 26.6.1. The vulnerability has a medium severity rating with a CVSS score of 4.3.

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to cause unexpected system termination.

A path traversal issue was addressed with improved path validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An attacker with physical access to a trust-paired device may be able to read and write arbitrary files.

An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27, macOS Tahoe 26.7. An app may be able to bypass sandbox restrictions.

A permissions issue was addressed with improved path validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to modify protected system files.

CVE-2026-43684 is a use-after-free vulnerability in Apple iOS, iPadOS, and macOS that could allow an app to cause unexpected system termination or corrupt kernel memory. The issue is addressed with improved memory management and fixed in iOS 26.7, iPadOS 26.7, macOS Golden Gate 27, and macOS Sequoia 15.8. The vulnerability has a high severity rating with a CVSS score of 7.8.

A buffer overflow was addressed with improved size validation. This issue is fixed in macOS Golden Gate 27. A local attacker may be able to cause unexpected system termination or corrupt kernel memory.

A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A remote user may cause an unexpected app termination or arbitrary code execution.

CVE-2026-84536 is an integer underflow vulnerability in Apple macOS that could cause unexpected system termination when connecting to a malicious SMB server. The issue is addressed by improved input validation and fixed in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. The vulnerability has a medium severity rating with a CVSS score of 6.5.

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to modify protected parts of the file system.

CVE-2026-84561 is a critical double free vulnerability in Apple iOS and iPadOS that could allow an app to cause unexpected system termination or corrupt kernel memory. The issue affects versions prior to iOS and iPadOS 26.7 and 27, as well as certain macOS versions. Apple has fixed this vulnerability in iOS 26.7 and later, iPadOS 26.7 and later, and corresponding macOS, tvOS, visionOS, and watchOS versions.

CVE-2026-28935 is a high-severity vulnerability affecting Apple iOS and iPadOS, as well as related Apple operating systems. It allows an app to cause unexpected system termination or corrupt kernel memory due to improper memory handling. The issue has been addressed with improved memory management and is fixed in iOS 26.6.1, iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, and watchOS 27.

CVE-2026-65364 is a high-severity vulnerability in Apple macOS that allows a remote attacker to cause unexpected system termination due to an out-of-bounds read. The issue was addressed by improved bounds checking and is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7.