Threat database

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.

A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An attacker may be able to cause unexpected app termination.

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to cause unexpected system termination.

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.4. An app may be able to gain root privileges.

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, iOS 26.7 and iPadOS 26.7, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. Processing a maliciously crafted image may corrupt process memory.

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2026-28987 is a vulnerability in Apple iOS and iPadOS where an app may be able to leak sensitive kernel state due to a logging issue. This issue was addressed by Apple through improved data redaction in multiple OS versions including iOS 18.7.9 and iPadOS 18.7.9, among others. The vulnerability has a high severity rating with a CVSS score of 7.5. No known exploits are reported in the wild. The vulnerability relates to improper handling of sensitive information in logs, categorized under CWE-532 (Information Exposure Through Log Files).

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause a denial-of-service.

CVE-2026-28929 is a logic vulnerability in Apple Mail on iOS and iPadOS that could cause remote images to be displayed when replying to an email in Lockdown Mode. This behavior bypasses the intended restrictions of Lockdown Mode, potentially exposing users to unwanted remote content. The issue is addressed by improved checks in Apple software updates. A fix is available in iOS 18.7.9, iPadOS 18.7.9, and several macOS versions. The vulnerability has a high severity score of 7.5 and does not require user interaction to be exploited.

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2026-28964 is a high-severity vulnerability in Apple iOS and iPadOS where an inconsistent user interface issue could allow an app to access sensitive user data. The issue is related to improper state management in the UI. Apple addressed this vulnerability in iOS 26.5, iPadOS 26.5, and visionOS 26.5. There are no known exploits in the wild at this time.

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination or write kernel memory.

The issue was addressed with improved input validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. A local attacker may be able to modify the state of the Keychain.

CVE-2026-28925 is a high-severity buffer overflow vulnerability in Apple macOS that could allow an application to cause unexpected system termination or write to kernel memory. This issue has been addressed by Apple with improved bounds checking and is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, and macOS Tahoe 26.5. The vulnerability does not require user interaction or privileges to exploit and has a CVSS score of 7.5. There are no known exploits in the wild at this time.

CVE-2026-28924 is a race condition vulnerability in Apple macOS that could allow an application to access the user's Contacts without obtaining user consent. The issue was addressed by improving the handling of symbolic links. Fixes for this vulnerability are included in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, and macOS Tahoe 26.5. The vulnerability has a high severity rating with a CVSS score of 7.5, indicating a significant confidentiality impact without requiring user interaction or privileges.

CVE-2026-28965 is a privacy vulnerability in Apple iOS and iPadOS that could allow a user to view restricted content from the lock screen. The issue was addressed by Apple with improved checks and fixed in iOS 26.5 and iPadOS 26.5. The vulnerability has a high severity rating with a CVSS score of 7.5, indicating a significant confidentiality impact without requiring user interaction or privileges. There are no known exploits in the wild at this time.

CVE-2026-43656 is a high-severity vulnerability in Apple iOS and iPadOS where parsing a maliciously crafted file may cause an unexpected app termination due to an out-of-bounds write issue. Apple addressed this vulnerability with improved input validation in iOS 18.7.9, iPadOS 18.7.9, and corresponding macOS versions. The vulnerability has a CVSS score of 7.3, indicating significant impact on confidentiality, integrity, and availability. No known exploits are reported in the wild. Patch status is not explicitly confirmed in the provided data, so users should verify with official Apple advisories for remediation guidance.