Threat database

A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An attacker in a privileged network position may be able to cause a denial-of-service.

CVE-2026-86944 is an out-of-bounds write vulnerability in Apple iOS and iPadOS that could allow an app to cause unexpected system termination. The issue was addressed with improved bounds checking and fixed in iOS 26.7 and iPadOS 26.7, as well as macOS Sequoia 15.8 and macOS Tahoe 26.7.

CVE-2026-28960 is a denial-of-service vulnerability in Apple iOS and iPadOS that allows a remote attacker to cause a denial-of-service condition. The issue was addressed by improved validation and is fixed in iOS and iPadOS version 18.7.10.

A path handling issue was addressed with improved validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access user-sensitive data.

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted 3D model may lead to memory corruption.

An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted font may result in the disclosure of process memory.

A privacy issue was addressed with improved handling of user preferences. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to identify what other apps a user has installed.

CVE-2026-84626 is an information disclosure vulnerability in Apple iOS and iPadOS that allowed an app to identify other installed apps on a user's device. The issue was addressed by improved state management and fixed in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and related Apple operating systems. The vulnerability has a low severity score and requires local privileges with user interaction not needed.

This issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27, watchOS 27. An app may be able to access sensitive user data.

CVE-2026-84636 is an authorization vulnerability in Apple iOS and iPadOS that could allow an app to access sensitive user data. The issue was addressed by improved state management and fixed in iOS 27 and iPadOS 27. The vulnerability has a medium severity rating with a CVSS score of 5.5.

A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A malicious application may be able to determine a user's current location.

An authentication issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account.

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to access sensitive user data.

CVE-2026-86869 is an out-of-bounds write vulnerability in Apple iOS and iPadOS that could cause unexpected app termination when processing a maliciously crafted image. The issue is addressed by improved bounds checking and fixed in iOS 26.7 and iPadOS 26.7, as well as macOS Golden Gate 27. The vulnerability has a CVSS score of 6.5, indicating medium severity, and does not impact confidentiality or integrity but affects availability by causing app crashes.

A path traversal issue was addressed with improved path validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An attacker with physical access to a trust-paired device may be able to read and write arbitrary files.

A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27, watchOS 27. An app may be able to fingerprint the user.

A privacy issue was addressed by moving sensitive data. This issue is fixed in iOS 26.6 and iPadOS 26.6. An app may be able to fingerprint the user.

The issue was addressed with improved checks. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6. An app may be able to access user-sensitive data.

CVE-2025-43455 is a privacy vulnerability in Apple iOS and iPadOS where a malicious app could capture screenshots of sensitive information displayed in embedded views. This issue was addressed by Apple with improved checks and fixed in iOS 26.1 and iPadOS 26.1. The vulnerability has a medium severity rating with a CVSS score of 5.5. It requires local access with user interaction to exploit and impacts confidentiality without affecting integrity or availability.

A path handling issue was addressed with improved validation. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5, tvOS 18.4, watchOS 11.4. A malicious app may be able to access private information.