Threat database

An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A malicious application may be able to bypass Privacy preferences.

An integer overflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker in a privileged network position may be able to cause a denial-of-service.

CVE-2026-86882 is an out-of-bounds write vulnerability in Apple iOS and iPadOS that could cause unexpected process termination when processing a maliciously crafted image. The issue affects versions prior to iOS and iPadOS 26.7 and 27, as well as certain macOS versions. Apple has fixed this vulnerability with improved bounds checking in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27. The CVSS score is 6.5, indicating a medium severity impact primarily affecting availability due to process termination. No known exploits are reported in the wild.

CVE-2026-84574 is a medium severity vulnerability in Apple macOS where an app may bypass Privacy preferences due to a permissions issue. The issue was addressed with improved state management and fixed in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7.

CVE-2026-43687 is a vulnerability in Apple iOS and iPadOS where connecting to a malicious NFS server may lead to disclosure of kernel memory. The issue has been addressed with improved memory handling and fixed in iOS and iPadOS versions 26.7 and later, as well as other Apple operating systems. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. An app may be able to cause a denial of service.

CVE-2026-84523 is an out-of-bounds write vulnerability in Apple iOS and iPadOS that could allow an app to cause unexpected system termination or write to kernel memory. The issue was addressed by improved bounds checking and fixed in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and related Apple operating systems. The vulnerability has a medium severity rating with a CVSS score of 5.5. No known exploits in the wild have been reported.

A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges.

An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to break out of its sandbox.

A privacy issue was addressed with improved handling of user preferences. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to identify what other apps a user has installed.

A race condition was addressed with improved locking. This issue is fixed in macOS Tahoe 26.6. A malicious app may be able to gain root privileges.

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination or corrupt kernel memory.

A race condition was addressed with additional validation. This issue is fixed in macOS Tahoe 26.6. An app may be able to access protected user data.

CVE-2026-84630 is a medium severity vulnerability in Apple iOS and iPadOS where a race condition could allow an app to cause unexpected system termination. The issue affects versions prior to iOS and iPadOS 26.7 and 27, as well as macOS versions prior to 15.8. The vulnerability has been addressed with improved state handling in the specified fixed versions.

A logic issue in Apple Safari related to handling webarchive files could allow universal cross-site scripting (XSS). This vulnerability is fixed in Safari 27, iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27. Opening a maliciously crafted webarchive file may trigger this XSS condition.

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Mounting a disk image with maliciously crafted files may lead to unexpected system termination.

CVE-2026-65371 is a vulnerability in Apple iOS and iPadOS where an app may be able to disclose kernel memory. This issue was addressed by Apple with improved redaction of sensitive information and fixed in iOS 26.6 and iPadOS 26.6, as well as other Apple operating systems. The vulnerability has a low severity rating with a CVSS score of 3.3.

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination.