32 KiB
32 KiB
iOS 27.2 advisory — all entries
162 CVEs across 67 components. Source: Apple security advisory 149230 (iOS 27.2 / iPadOS 27.2, 2026-10-26).
| CVE | Component | Impact | Description | Binary candidate |
|---|---|---|---|---|
| CVE-2026-112466 | AVEVideoEncoder | An app may be able to cause unexpected system termination or read kernel memory | An out-of-bounds read was addressed with improved input validation. | com.apple.driver.AppleAVE2 / VideoToolbox AVE plugin |
| CVE-2026-112468 | AVEVideoEncoder | An app may be able to cause unexpected system termination or corrupt kernel memory | An out-of-bounds write issue was addressed with improved bounds checking. | com.apple.driver.AppleAVE2 / VideoToolbox AVE plugin |
| CVE-2026-112469 | AVEVideoEncoder | An app may be able to cause unexpected system termination or corrupt kernel memory | An out-of-bounds write issue was addressed with improved bounds checking. | com.apple.driver.AppleAVE2 / VideoToolbox AVE plugin |
| CVE-2026-112470 | AVEVideoEncoder | An app may be able to cause unexpected system termination or corrupt kernel memory | An out-of-bounds write issue was addressed with improved bounds checking. | com.apple.driver.AppleAVE2 / VideoToolbox AVE plugin |
| CVE-2026-112689 | AVEVideoEncoder | An app may be able to cause unexpected system termination or corrupt kernel memory | An out-of-bounds write issue was addressed with improved input validation. | com.apple.driver.AppleAVE2 / VideoToolbox AVE plugin |
| CVE-2026-112705 | AVEVideoEncoder | An app may be able to cause unexpected system termination | An out-of-bounds write issue was addressed with improved bounds checking. | com.apple.driver.AppleAVE2 / VideoToolbox AVE plugin |
| CVE-2026-86971 | Accelerate Framework | Processing a maliciously crafted image may lead to unexpected app termination | An out-of-bounds write issue was addressed with improved bounds checking. | Accelerate |
| CVE-2026-84493 | AccessorySetupKit | A malicious app may be able to access Bluetooth without user consent | An authentication issue was addressed with improved state management. | AccessorySetupKit |
| CVE-2026-112446 | Accounts | An app may be able to access sensitive user data | This issue was addressed with additional entitlement checks. | Accounts |
| CVE-2026-112612 | Accounts | An attacker with physical access to a trust-paired device may be able to read and write arbitrary files | A path handling issue was addressed with improved validation. | Accounts |
| CVE-2026-113898 | Accounts | A malicious application may be able to bypass Privacy preferences | A logging issue was addressed with improved data redaction. | Accounts |
| CVE-2026-112692 | App Intents | An app may be able to access sensitive user data | This issue was addressed with additional entitlement checks. | AppIntents |
| CVE-2026-112690 | App Store | A remote attacker may be able to break out of the WebContent sandbox | This issue was addressed with improved input validation. | AppStore |
| CVE-2026-113914 | App Store | An app may be able to access sensitive user data | An authorization issue was addressed with improved state management. | AppStore |
| CVE-2026-86987 | Apple Intelligence | A remote attacker may be able to access sensitive user data | An authorization issue was addressed with improved entitlement checks. | AppleIntelligence |
| CVE-2026-112696 | Apple Neural Engine | An app may be able to cause unexpected system termination or corrupt kernel memory | An out-of-bounds write issue was addressed with improved bounds checking. | AppleH16ANEInterface / AppleNeuralEngine.framework |
| CVE-2026-84494 | Apple Neural Engine | An app may be able to cause unexpected system termination or write kernel memory | An out-of-bounds write issue was addressed with improved bounds checking. | AppleH16ANEInterface / AppleNeuralEngine.framework |
| CVE-2026-112415 | AppleAVD | An app may be able to cause unexpected system termination or corrupt process memory | An out-of-bounds write was addressed with improved input validation. | ? |
| CVE-2026-112416 | AppleAVD | Processing a maliciously crafted video file may lead to unexpected app termination | An out-of-bounds write issue was addressed with improved bounds checking. | ? |
| CVE-2026-112454 | AppleAVD | Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory | The issue was addressed with improved memory handling. | ? |
| CVE-2026-112546 | Audio | Processing a maliciously crafted file may lead to unexpected app termination | An out-of-bounds read was addressed with improved bounds checking. | AudioToolbox / AudioCodecs |
| CVE-2026-112566 | Bluetooth | An attacker in physical proximity may be able to cause a denial-of-service | A null pointer dereference was addressed with improved validation. | Bluetooth.framework / IOBluetooth kexts |
| CVE-2026-113906 | Bluetooth | An attacker in physical proximity may be able to cause a denial-of-service | A null pointer dereference was addressed with improved validation. | Bluetooth.framework / IOBluetooth kexts |
| CVE-2026-112619 | Calendar | Processing a maliciously crafted calendar invitation may lead to memory corruption | An out-of-bounds write issue was addressed with improved bounds checking. | CalendarFoundation |
| CVE-2026-112678 | Calendar | An app may be able to access sensitive user data | A permissions issue was addressed with additional restrictions. | CalendarFoundation |
| CVE-2026-112701 | CloudKit | An app may be able to access sensitive user data | An authorization issue was addressed with improved state management. | CloudKit |
| CVE-2026-86988 | ColorSync | Processing a maliciously crafted image may result in disclosure of process memory | The issue was addressed with improved checks. | ColorSync |
| CVE-2026-113910 | Compression | An app may be able to disclose kernel memory | A memory initialization issue was addressed with improved memory handling. | libcompression.dylib |
| CVE-2026-113908 | Contacts | An app may be able to access sensitive user data | A privacy issue was addressed by removing sensitive data. | Contacts |
| CVE-2026-112638 | CoreAudio | An attacker in radio range may be able to cause unexpected system termination | A heap buffer overflow was addressed with improved bounds checking. | CoreAudio.framework / AudioToolbox |
| CVE-2026-113907 | CoreAudio | An app may be able to cause unexpected system termination or corrupt process memory | A buffer overflow issue was addressed with improved memory handling. | CoreAudio.framework / AudioToolbox |
| CVE-2026-113912 | CoreAudio | Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory | An out-of-bounds access issue was addressed with improved bounds checking. | CoreAudio.framework / AudioToolbox |
| CVE-2026-86969 | CoreAudio | An app may be able to cause unexpected system termination or corrupt kernel memory | An out-of-bounds write was addressed with improved input validation. | CoreAudio.framework / AudioToolbox |
| CVE-2026-86972 | CoreAudio | Processing a maliciously crafted audio file may lead to memory corruption | A buffer overflow was addressed with improved size validation. | CoreAudio.framework / AudioToolbox |
| CVE-2026-112610 | CoreGraphics | Processing a maliciously crafted PDF file may lead to memory corruption | An out-of-bounds write issue was addressed with improved bounds checking. | CoreGraphics.framework |
| CVE-2026-112611 | CoreGraphics | Processing a maliciously crafted PDF file may lead to memory corruption | An out-of-bounds write issue was addressed with improved bounds checking. | CoreGraphics.framework |
| CVE-2026-113950 | CoreGraphics | Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory | An out-of-bounds write issue was addressed with improved bounds checking. | CoreGraphics.framework |
| CVE-2026-112688 | CoreMedia | Parsing a file may lead to an unexpected app termination or arbitrary code execution | A memory corruption issue was addressed with improved memory handling. | CoreMedia.framework / mediaplaybackd |
| CVE-2026-112706 | CoreMedia | An app may be able to access sensitive user data | A permissions issue was addressed with additional restrictions. | CoreMedia.framework / mediaplaybackd |
| CVE-2026-86990 | CoreMedia | A malicious app may be able to access the camera without user permission | An access issue was addressed with improved access restrictions. | CoreMedia.framework / mediaplaybackd |
| CVE-2026-86992 | CoreMedia | Processing a maliciously crafted video file may lead to unexpected app termination | The issue was addressed with improved memory handling. | CoreMedia.framework / mediaplaybackd |
| CVE-2026-112656 | CoreText | Processing a maliciously crafted font may result in the disclosure of process memory | An out-of-bounds read was addressed with improved bounds checking. | CoreText.framework |
| CVE-2026-113896 | FileProvider | An app may be able to access sensitive user data | A race condition was addressed with additional validation. | FileProvider |
| CVE-2026-112618 | Files | An app may be able to access sensitive user data | An access issue was addressed with improved access restrictions. | Files |
| CVE-2026-112432 | FontParser | An app may be able to access sensitive user data | A logging issue was addressed with improved data redaction. | FontParser.framework |
| CVE-2026-112642 | FontParser | Processing a maliciously crafted font may result in the disclosure of process memory | An out-of-bounds read was addressed with improved bounds checking. | FontParser.framework |
| CVE-2026-112683 | FontParser | Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory | An out-of-bounds write issue was addressed with improved bounds checking. | FontParser.framework |
| CVE-2026-86970 | FontParser | Processing a maliciously crafted font may result in the disclosure of process memory | An out-of-bounds read was addressed with improved input validation. | FontParser.framework |
| CVE-2026-112456 | HFS | Processing a maliciously crafted file may lead to heap corruption | An out-of-bounds write issue was addressed with improved input validation. | com.apple.filesystems.hfs.kext |
| CVE-2026-112518 | Heimdal | An attacker in a privileged network position may be able to impersonate a Kerberos KDC | An issue with signature validation was addressed with improved checks. | Heimdal (Kerberos) |
| CVE-2026-112596 | HomeKit | Processing a maliciously crafted video file may lead to unexpected system termination | An integer overflow was addressed with improved bounds checking. | HomeKit |
| CVE-2026-86978 | HomeKit | An app may be able to access sensitive user data | This issue was addressed with improved checks. | HomeKit |
| CVE-2026-112515 | IOHIDFamily | An attacker may be able to cause unexpected system termination or read kernel memory | An out-of-bounds read was addressed with improved bounds checking. | com.apple.iokit.IOHIDFamily |
| CVE-2026-65385 | IOKit | A buffer overflow may result in memory corruption and unexpected app termination | An out-of-bounds write issue was addressed with improved bounds checking. | IOKit.framework / IOKit kexts |
| CVE-2026-112459 | IOMobileFrameBuffer | An app may be able to cause unexpected system termination or corrupt kernel memory | A race condition was addressed with improved state handling. | com.apple.driver.IOMobileFrameBuffer |
| CVE-2026-112554 | IOStorageFamily | An app may be able to cause unexpected system termination or read kernel memory | An out-of-bounds read was addressed with improved bounds checking. | com.apple.iokit.IOStorageFamily |
| CVE-2026-112477 | IOSurface | An app may be able to cause unexpected system termination or corrupt kernel memory | A race condition was addressed with improved locking. | IOSurface.framework / IOSurface kext |
| CVE-2026-112488 | ImageIO | Processing a maliciously crafted image may corrupt process memory | A buffer overflow issue was addressed with improved memory handling. | ImageIO.framework |
| CVE-2026-112561 | ImageIO | Processing a maliciously crafted image may result in disclosure of process memory | An out-of-bounds read was addressed with improved bounds checking. | ImageIO.framework |
| CVE-2026-112571 | ImageIO | Processing a maliciously crafted image may result in disclosure of process memory | A memory initialization issue was addressed with improved memory handling. | ImageIO.framework |
| CVE-2026-112614 | ImageIO | Processing a maliciously crafted image may lead to unexpected app termination | An out-of-bounds write issue was addressed with improved bounds checking. | ImageIO.framework |
| CVE-2026-112625 | ImageIO | Processing a maliciously crafted image may result in memory corruption | An integer underflow was addressed with improved input validation. | ImageIO.framework |
| CVE-2026-112627 | ImageIO | Processing a maliciously crafted image may result in disclosure of process memory | An out-of-bounds read was addressed with improved bounds checking. | ImageIO.framework |
| CVE-2026-112629 | ImageIO | Processing a maliciously crafted image may lead to unexpected app termination | An out-of-bounds read was addressed with improved bounds checking. | ImageIO.framework |
| CVE-2026-112630 | ImageIO | Processing a maliciously crafted image may result in disclosure of process memory | An uninitialized memory issue was addressed with improved memory handling. | ImageIO.framework |
| CVE-2026-112632 | ImageIO | Processing a maliciously crafted image may result in disclosure of process memory | An uninitialized memory issue was addressed with improved memory handling. | ImageIO.framework |
| CVE-2026-112633 | ImageIO | Processing a maliciously crafted image may lead to unexpected app termination | An out-of-bounds write issue was addressed with improved bounds checking. | ImageIO.framework |
| CVE-2026-112634 | ImageIO | Processing a maliciously crafted image may lead to unexpected app termination | An out-of-bounds read was addressed with improved bounds checking. | ImageIO.framework |
| CVE-2026-112474 | Kernel | An app may be able to cause unexpected system termination or write kernel memory | A use-after-free issue was addressed with improved memory management. | kernelcache core (pmap/ipc/vm/bsd) |
| CVE-2026-112476 | Kernel | An app may be able to cause unexpected system termination | An out-of-bounds read was addressed with improved bounds checking. | kernelcache core (pmap/ipc/vm/bsd) |
| CVE-2026-112501 | Kernel | An app may be able to cause unexpected system termination | A race condition was addressed with improved state handling. | kernelcache core (pmap/ipc/vm/bsd) |
| CVE-2026-112507 | Kernel | An app may be able to cause unexpected system termination or write kernel memory | An out-of-bounds write issue was addressed with improved bounds checking. | kernelcache core (pmap/ipc/vm/bsd) |
| CVE-2026-112514 | Kernel | An attacker may be able to cause unexpected system termination or corrupt kernel memory | A use-after-free issue was addressed with improved memory management. | kernelcache core (pmap/ipc/vm/bsd) |
| CVE-2026-112516 | Kernel | An app may be able to cause unexpected system termination | A use-after-free issue was addressed with improved memory management. | kernelcache core (pmap/ipc/vm/bsd) |
| CVE-2026-112517 | Kernel | An app may be able to cause unexpected system termination or corrupt kernel memory | A use after free issue was addressed with improved memory management. | kernelcache core (pmap/ipc/vm/bsd) |
| CVE-2026-112576 | Kernel | An app may be able to cause unexpected changes to copy-on-write memory | A memory integrity issue was addressed with improved handling of copy-on-write pages. | kernelcache core (pmap/ipc/vm/bsd) |
| CVE-2026-112606 | Kernel | An app may be able to cause unexpected system termination | A type confusion issue was addressed with improved memory handling. | kernelcache core (pmap/ipc/vm/bsd) |
| CVE-2026-112624 | Kernel | An app may be able to bypass Privacy preferences | This issue was addressed with improved checks. | kernelcache core (pmap/ipc/vm/bsd) |
| CVE-2026-112665 | Kernel | An app may be able to determine kernel memory layout | An information disclosure issue was addressed with improved state management. | kernelcache core (pmap/ipc/vm/bsd) |
| CVE-2026-112679 | Kernel | An app may be able to cause unexpected system termination or corrupt kernel memory | A use-after-free issue was addressed with improved memory management. | kernelcache core (pmap/ipc/vm/bsd) |
| CVE-2026-112698 | Kernel | An app may be able to cause unexpected system termination | The issue was addressed with improved memory handling. | kernelcache core (pmap/ipc/vm/bsd) |
| CVE-2026-65350 | Kernel | An app may be able to cause unexpected system termination or corrupt kernel memory | A use-after-free issue was addressed with improved memory management. | kernelcache core (pmap/ipc/vm/bsd) |
| CVE-2026-84495 | Kernel | An app may be able to cause unexpected system termination or write kernel memory | A use-after-free issue was addressed with improved memory management. | kernelcache core (pmap/ipc/vm/bsd) |
| CVE-2026-112621 | LinkPresentation | Processing a maliciously crafted image may result in memory corruption | An out-of-bounds write issue was addressed with improved bounds checking. | LinkPresentation.framework |
| CVE-2026-112414 | Processing a maliciously crafted message may lead to a denial-of-service | A stack overflow was addressed with improved input validation. | ||
| CVE-2026-112671 | A remote attacker may be able to cause a denial-of-service | A resource exhaustion issue was addressed with improved input validation. | ||
| CVE-2026-112707 | Maps | An app may be able to identify what other apps a user has installed | A privacy issue was addressed by moving sensitive data to a protected location. | Maps |
| CVE-2026-113915 | MediaAnalysis | An app may be able to access sensitive user data | A race condition was addressed with additional validation. | MediaAnalysis |
| CVE-2026-112687 | MediaRemote | An attacker on the local network may be able to cause unexpected system termination or corrupt process memory | This issue was addressed by removing the vulnerable code. | MediaRemote |
| CVE-2026-112682 | Messages | A remote attacker may be able to cause unexpected app termination | An input validation issue was addressed with improved input validation. | Messages / IMSharedUtilities |
| CVE-2026-86989 | MobileGestalt | An app may be able to fingerprint the user | An authorization issue was addressed with improved state management. | MobileGestalt |
| CVE-2026-112413 | Model I/O | Processing a maliciously crafted file may lead to unexpected app termination | An out-of-bounds read was addressed with improved bounds checking. | ? |
| CVE-2026-112449 | Model I/O | Processing a maliciously crafted 3D model may lead to memory corruption | An integer overflow was addressed with improved input validation. | ? |
| CVE-2026-112461 | Model I/O | Processing a maliciously crafted 3D model may lead to memory corruption | An out-of-bounds write issue was addressed with improved bounds checking. | ? |
| CVE-2026-112485 | Model I/O | Processing a maliciously crafted 3D model may lead to memory corruption | The issue was addressed with improved memory handling. | ? |
| CVE-2026-112486 | Model I/O | Processing a 3D model may lead to unexpected app termination | An out-of-bounds write issue was addressed with improved bounds checking. | ? |
| CVE-2026-112565 | Model I/O | Processing a maliciously crafted 3D model may lead to memory corruption | An integer overflow was addressed with improved input validation. | ? |
| CVE-2026-112660 | Photos Storage | An app may be able to bypass certain Privacy preferences | An authorization issue was addressed with improved state management. | Photos |
| CVE-2026-112676 | Photos Storage | An app may be able to access a user's Photos Library | This issue was addressed with additional entitlement checks. | Photos |
| CVE-2026-65397 | Photos Storage | An app may be able to access sensitive user data | An authorization issue was addressed with improved state management. | Photos |
| CVE-2026-112681 | Power Management | An app may be able to fingerprint the user | This issue was addressed with additional entitlement checks. | com.apple.driver.AppleARMPlatform / PM kexts |
| CVE-2026-86925 | Quick Look | An app may be able to access sensitive user data | An authorization issue was addressed with improved state management. | QuickLook |
| CVE-2026-112491 | RealityKit | Processing a maliciously crafted file may lead to unexpected app termination | An out-of-bounds read was addressed with improved bounds checking. | RealityKit |
| CVE-2026-112547 | ReplayKit | An app may be able to access sensitive user data | A type confusion issue was addressed with improved checks. | ReplayKit |
| CVE-2026-112609 | Safety Check | An app may be able to access sensitive user data | This issue was addressed with improved checks. | SafetyCheck |
| CVE-2026-112423 | SceneKit | Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents | An out-of-bounds read was addressed with improved bounds checking. | SceneKit |
| CVE-2026-112425 | SceneKit | Processing a 3D model may result in disclosure of process memory | An out-of-bounds read was addressed with improved bounds checking. | SceneKit |
| CVE-2026-112464 | SceneKit | Processing a maliciously crafted file may lead to heap corruption | An out-of-bounds write issue was addressed with improved input validation. | SceneKit |
| CVE-2026-86991 | SceneKit | Processing a maliciously crafted file may lead to unexpected process termination | A buffer overflow was addressed with improved bounds checking. | SceneKit |
| CVE-2026-112616 | Screen Time | An app may be able to access sensitive user data | An authorization issue was addressed with improved access control. | ScreenTime |
| CVE-2026-112652 | Security | An malicious app may be able to bypass certificate validation | A logic issue was addressed with improved state management. | Security.framework |
| CVE-2026-113913 | Security | Processing web content may disclose sensitive information | An input validation issue was addressed with improved input validation. | Security.framework |
| CVE-2026-112455 | Shortcuts | An app may be able to access sensitive user data | An authorization issue was addressed with improved state management. | Shortcuts |
| CVE-2026-112559 | Shortcuts | An app may be able to access sensitive user data | An authorization issue was addressed with improved state management. | Shortcuts |
| CVE-2026-112658 | Siri | An app may be able to access sensitive user data | This issue was addressed with improved input validation. | Siri |
| CVE-2026-112685 | Siri | An app may be able to access sensitive user data | An authorization issue was addressed with improved state management. | Siri |
| CVE-2022-26704 | Spotlight | An app may be able to gain elevated privileges | A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. | Spotlight |
| CVE-2026-112567 | Spotlight | A malicious application may be able to bypass Privacy preferences | This issue was addressed with improved checks. | Spotlight |
| CVE-2026-112628 | Spotlight | An app may be able to access sensitive user data | This issue was addressed with improved data access restriction. | Spotlight |
| CVE-2026-112646 | SpringBoard | An app may be able to cause unexpected system termination or corrupt process memory | An out-of-bounds write issue was addressed with improved bounds checking. | SpringBoard |
| CVE-2026-112691 | SwiftUI | An app may be able to cause unexpected system termination | An out-of-bounds write issue was addressed with improved input validation. | SwiftUI |
| CVE-2026-86968 | System Preferences | A malicious app may be able to access restricted system interfaces or launder launch attribution | An access issue was addressed with improved access control. | SystemPreferences |
| CVE-2026-84605 | TextKit | An app may be able to read the device's name | An authorization issue was addressed with improved state management. | TextKit |
| CVE-2026-112595 | Thread | An attacker in physical proximity may be able to craft malicious network traffic to gain access to a Thread network | This issue was addressed with improved authentication. | ThreadNetwork.framework |
| CVE-2026-112479 | USB | A malicious USB device may be able to cause unexpected system termination or read kernel memory | An out-of-bounds read was addressed with improved bounds checking. | USB kexts |
| CVE-2026-112599 | WebKit | Processing maliciously crafted web content may lead to an unexpected process crash | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
| CVE-2026-112615 | WebKit | Processing maliciously crafted web content may lead to an unexpected process termination | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
| CVE-2026-112623 | WebKit | Processing maliciously crafted web content may lead to arbitrary code execution | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
| CVE-2026-112640 | WebKit | Processing maliciously crafted web content may lead to memory corruption | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
| CVE-2026-112651 | WebKit | Processing maliciously crafted web content may lead to arbitrary code execution | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
| CVE-2026-112653 | WebKit | Processing maliciously crafted web content may lead to an unexpected process termination | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
| CVE-2026-112654 | WebKit | Processing maliciously crafted web content may lead to an unexpected process termination | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
| CVE-2026-112655 | WebKit | Processing maliciously crafted web content may lead to arbitrary code execution | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
| CVE-2026-112659 | WebKit | Processing maliciously crafted web content may lead to arbitrary code execution | A type confusion issue was addressed with improved memory handling. | JavaScriptCore / WebKit / WebCore |
| CVE-2026-112666 | WebKit | Processing maliciously crafted web content may lead to an unexpected process termination | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
| CVE-2026-112669 | WebKit | Processing maliciously crafted web content may lead to an unexpected Safari crash | A race condition was addressed with improved state handling. | JavaScriptCore / WebKit / WebCore |
| CVE-2026-112673 | WebKit | Processing maliciously crafted web content may lead to an unexpected process termination | A type confusion issue was addressed with improved state handling. | JavaScriptCore / WebKit / WebCore |
| CVE-2026-112680 | WebKit | Processing maliciously crafted web content may result in the disclosure of process memory | An out-of-bounds read was addressed with improved bounds checking. | JavaScriptCore / WebKit / WebCore |
| CVE-2026-112684 | WebKit | Processing maliciously crafted web content may lead to an unexpected process crash | This issue was addressed through improved state management. | JavaScriptCore / WebKit / WebCore |
| CVE-2026-112686 | WebKit | Processing maliciously crafted web content may lead to an unexpected process termination | A race condition was addressed with improved locking. | JavaScriptCore / WebKit / WebCore |
| CVE-2026-112693 | WebKit | Processing maliciously crafted web content may lead to an unexpected Safari crash | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
| CVE-2026-112695 | WebKit | Processing maliciously crafted web content may lead to an unexpected process termination | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
| CVE-2026-112697 | WebKit | Processing maliciously crafted web content may lead to arbitrary code execution | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
| CVE-2026-112699 | WebKit | Processing maliciously crafted web content may result in the disclosure of process memory | An out-of-bounds read was addressed with improved bounds checking. | JavaScriptCore / WebKit / WebCore |
| CVE-2026-113903 | WebKit | Processing maliciously crafted web content may lead to unexpected memory modification | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
| CVE-2026-113904 | WebKit | Processing maliciously crafted web content may lead to an unexpected process crash | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
| CVE-2026-113949 | WebKit | Processing maliciously crafted web content may lead to memory corruption | A type confusion issue was addressed with improved state management. | JavaScriptCore / WebKit / WebCore |
| CVE-2026-113952 | WebKit | A website may be able to use a media format that should be restricted in Lockdown Mode | A logic issue was addressed with improved checks. | JavaScriptCore / WebKit / WebCore |
| CVE-2026-86974 | WebKit | Processing maliciously crafted web content may lead to memory corruption | A type confusion issue was addressed with improved checks. | JavaScriptCore / WebKit / WebCore |
| CVE-2026-86985 | WebKit | Processing maliciously crafted web content may lead to an unexpected process crash | This issue was addressed with improved input validation. | JavaScriptCore / WebKit / WebCore |
| CVE-2026-86986 | WebKit | Processing maliciously crafted web content may lead to an unexpected Safari crash | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
| CVE-2026-112637 | WebKit Canvas | Processing maliciously crafted web content may lead to arbitrary code execution | A use-after-free issue was addressed with improved memory management. | WebCore (canvas) |
| CVE-2026-112626 | WebKit JavaScript Bindings | Processing maliciously crafted web content may lead to arbitrary code execution | A use-after-free issue was addressed with improved memory management. | JavaScriptCore bindings |
| CVE-2026-112639 | WebKit Process Model | Processing maliciously crafted web content may lead to arbitrary code execution | A use-after-free issue was addressed with improved memory management. | WebKit process model |
| CVE-2026-113897 | WebKit Process Model | A remote attacker may be able to break out of Web Content sandbox | This issue was addressed by removing the vulnerable code. | WebKit process model |
| CVE-2026-113901 | WebRTC | Processing maliciously crafted web content may lead to an unexpected process crash | A use-after-free issue was addressed with improved memory management. | WebRTC.framework |
| CVE-2026-86973 | WebRTC | Processing maliciously crafted web content may lead to an unexpected process crash | An out-of-bounds read was addressed with improved bounds checking. | WebRTC.framework |
| CVE-2026-112620 | Wi-Fi | An attacker in a privileged network position may be able to cause a denial-of-service | A denial-of-service issue was addressed with improved input validation. | WiFi frameworks / IO80211 kext |
| CVE-2026-112622 | Wi-Fi | An attacker in radio range may be able to cause unexpected system termination | An out-of-bounds read was addressed with improved bounds checking. | WiFi frameworks / IO80211 kext |
| CVE-2026-113909 | Wi-Fi | An attacker in physical proximity may be able to corrupt process memory | A memory corruption issue was addressed with improved input validation. | WiFi frameworks / IO80211 kext |
| CVE-2026-112522 | libarchive | Processing a maliciously crafted file may lead to unexpected app termination | An out-of-bounds write issue was addressed with improved bounds checking. | libarchive.2.dylib |
| CVE-2026-112607 | mDNSResponder | A remote attacker may be able to leak memory | An out-of-bounds read was addressed with improved bounds checking. | mDNSResponder |