Threat database

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. An app may be able to determine kernel memory layout.

A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5. A maliciously crafted ZIP archive may bypass Gatekeeper checks.

CVE-2026-43666 is an out-of-bounds write vulnerability in Apple iOS and iPadOS that could allow an attacker on the local network to cause a denial-of-service condition. The issue was addressed by Apple through improved bounds checking and fixed in multiple Apple operating system versions including iOS 18.7.9 and iPadOS 18.7.9. The vulnerability has a CVSS score of 6.2, indicating medium severity, and does not impact confidentiality or integrity but affects availability. There are no known exploits in the wild. Patch status is not explicitly confirmed in the provided data, so users should verify with official Apple advisories for remediation guidance.

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to access private information.

A race condition was addressed with additional validation. This issue is fixed in macOS Tahoe 26.4. An app may be able to access sensitive user data.

A privacy issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26.5 and iPadOS 26.5. An attacker with physical access may be able to use Visual Intelligence to access sensitive user data during iPhone Mirroring.

CVE-2026-28918 is a medium severity vulnerability in Apple iOS and iPadOS where parsing a maliciously crafted file may cause an unexpected app termination due to an out-of-bounds access issue. This issue has been addressed with improved bounds checking and fixed in iOS 26.5 and iPadOS 26.5. The vulnerability does not impact confidentiality or integrity but affects availability by causing app crashes. There are no known exploits in the wild at this time.

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. Processing a maliciously crafted image may corrupt process memory.

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination.

CVE-2026-28909 is a vulnerability in Apple macOS where users connecting to malicious registries with hostnames that match certain bypass patterns may have their registry credentials exposed in plaintext. This issue affects container version 0.12.1 and is fixed in version 0.12.3. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. There are no known exploits in the wild at this time.

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 15.8.8 and iPadOS 15.8.8, iOS 16.7.16 and iPadOS 16.7.16, iOS 18.7.8 and iPadOS 18.7.8, iOS 26.4.2 and iPadOS 26.4.2, iPadOS 17.7.11. Notifications marked for deletion could be unexpectedly retained on the device.

CVE-2026-28815 is a high-severity vulnerability in Apple macOS where a remote attacker can supply a short X-Wing HPKE encapsulated key, triggering an out-of-bounds read in the C decapsulation path. This can cause a crash or potentially disclose memory depending on runtime protections. The issue affects swift-crypto version 4.0.0 and is fixed in version 4.3.1. There are no known exploits in the wild at this time.

CVE-2025-43236 is a type confusion vulnerability in Apple macOS that could allow an attacker to cause unexpected application termination. The issue was addressed by Apple through improved memory handling and is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, and macOS Ventura 13.7.7. The vulnerability has a low severity rating with a CVSS score of 3.3, indicating limited impact primarily resulting in denial of service via app crashes. There are no known exploits in the wild for this vulnerability.

CVE-2025-43257 is a high-severity vulnerability in Apple macOS that allows an application to potentially break out of its sandbox due to improper handling of symbolic links. This issue has been addressed with improved symlink handling and fixed in macOS Sequoia 15.6. The vulnerability has a CVSS score of 8.7, indicating a significant risk if exploited. There are no known exploits in the wild at this time.

CVE-2024-40849 is a high-severity vulnerability in Apple macOS where a race condition could allow an application to break out of its sandbox. The issue was addressed by adding additional validation and is fixed in macOS Sequoia 15.1. The vulnerability has a CVSS score of 7.5, indicating significant impact on confidentiality if exploited. There are no known exploits in the wild at this time.

CVE-2024-44303 is a high-severity vulnerability in Apple macOS where a malicious application may be able to modify protected parts of the file system. This issue has been addressed with improved checks and fixed in macOS Sequoia 15.1. The vulnerability allows unauthorized modification of critical system files without requiring user interaction or privileges. There are no known exploits in the wild at this time.

CVE-2025-43210 is an out-of-bounds access vulnerability in Apple iOS and iPadOS that could be triggered by processing a maliciously crafted media file. This flaw may cause unexpected application termination or corrupt process memory. Apple has addressed the issue with improved bounds checking in iOS 18.6, iPadOS 18.6 and 17.7.9, as well as several macOS, tvOS, visionOS, and watchOS versions. The vulnerability has a CVSS score of 6.3, indicating medium severity. There are no known exploits in the wild at this time.