GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Organization

Vulnerability Disclosure Archive

GNA-1988
GNA identifier
GNA-1988 GCVE registry Recent publications
Registered on 2026-09-04, last updated on 2026-09-10.

Recent vulnerabilities

387 GCVE records assigned by this organization as GNA-1988

GCVE-1988-2026-0187

Vulnerability from gna-1988 – Published: 2026-09-08 07:57 – Updated: 2026-09-09 10:11
VLAI
Title
[Full Disclosure] CVE-2025-69690 & CVE-2025-69691 — Authenticated RCE in Netgate pfSense CE 2.7.2 and 2.8.0
Summary
Advisory: Authenticated Remote Code Execution in pfSense CECVEs: CVE-2025-69690, CVE-2025-69691 Researcher: Nelson Adhepeau (privexploits () protonmail com) Date: February 2026 == RESPONSIBLE DISCLOSURE NOTICE == This advisory is published in accordance with responsible disclosure practices.  The vendor was notified on December 2, 2025, acknowledged the reports, and indicated no patches would be issued. Publication follows standard 90-day disclosure guidelines. ------------------------------------------------------------- == OVERVIEW == Two independent authenticated Remote Code Execution vulnerabilities were discovered in Netgate pfSense Community Edition. Both were reproduced on clean installations. Vendor was contacted and acknowledged the reports but classified both as expected behavior for authenticated administrators. ------------------------------------------------------------- == CVE-2025-69690 == Authenticated RCE via Unsafe Deserialization (pfSense CE 2.7.2) CVSS v3.1: 8.8 (High) Vector: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CWE-502: Deserialization of Untrusted Data CWE-915: Improperly Controlled Dynamic Code Evaluation -- Description -- The pfSense configuration restore mechanism invokes unserialize() on user-controlled data without class whitelisting, input validation, or sandboxing. A crafted backup file containing a malicious serialized PHP object can inject arbitrary commands via the post_reboot_commands property, executed through mwexec() with full root privileges. -- Affected Component -- backup/restore mechanism, config.php, pfsense_module_installer class, unserialize() handling -- Attack Vector -- 1. Attacker authenticates as administrator 2. Uploads malicious configuration backup file 3. Triggers restore operation 4. pfSense unserializes attacker-controlled data 5. Commands execute as root via mwexec() -- PoC Payload -- O:23:"pfsense_module_installer":1:{   s:17:"*post_reboot_commands";   a:1:{i:0;s:40:"/usr/local/bin/php -r 'system(\"id\");'";}} -- Impact -- - Arbitrary command execution as root - Persistent compromise - Complete firewall takeover - Credential and configuration exfiltration -- Vendor Response -- Netgate acknowledged the report. Classified as "authenticated administrative abuse". No patch issued. Vendor does not assign CVEs directly. ------------------------------------------------------------- == CVE-2025-69691 == Authenticated RCE via XMLRPC exec_php (pfSense CE 2.8.0) CVSS v3.1: 9.9 (Critical) Vector: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CWE-284: Improper Access Control CWE-915: Improperly Controlled Dynamic Code Evaluation -- Description -- pfSense CE 2.8.0 exposes an XMLRPC API method pfsense.exec_php that executes arbitrary PHP code as root without validation, sandboxing, or restrictions. The endpoint is enabled by default, accessible over HTTPS via Basic Authentication, and executes supplied code immediately with full system privileges. Default credentials (admin:pfsense) are widely deployed, significantly lowering the exploitation barrier. -- Affected Component -- xmlrpc.php, pfsense.exec_php method, XMLRPC API handler, BasicAuth authentication layer -- Attack Vector -- curl -k -u admin:pfsense \   -d '<methodCall>     <methodName>pfsense.exec_php</methodName>     <params><param><value><string>       system("id");     </string></value></param></params>   </methodCall>' \   https://<target>/xmlrpc.php -- Impact -- - Full remote root compromise - Arbitrary file read/write - Backdoor deployment - Firewall rule manipulation - Extraction of secrets and configurations -- Vendor Response -- Netgate acknowledged the report. Classified as expected behavior for authenticated users. No patch in pfSense CE 2.8.0. Still exploitable as of latest version at time of disclosure. ------------------------------------------------------------- == TIMELINE == - November 2025: Vulnerabilities discovered - December 2, 2025: Initial report sent to Netgate - Netgate acknowledged, no patch planned - January 28, 2026: CVEs assigned by MITRE - February 2026: Public disclosure ------------------------------------------------------------- == REFERENCES == CVE-2025-69690: https://cve.org/CVERecord?id=CVE-2025-69690 CVE-2025-69691: https://cve.org/CVERecord?id=CVE-2025-69691 Researcher: https://github.com/privlabs https://linkedin.com/in/nelson-adhepeau ------------------------------------------------------------- Nelson Adhepeau Independent Security Researcherprivexploits () protonmail com Envoyé avec un e-mail sécurisé Proton Mail._______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
References
Impacted products
Credits
privexploits via Fulldisclosure
Relationships
analysis GCVE-1988-2026-0187 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CVE-2025-69690 \u0026 CVE-2025-69691",
          "vendor": "Cve",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "privexploits via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory: Authenticated Remote Code Execution in pfSense CECVEs: CVE-2025-69690, CVE-2025-69691\nResearcher: Nelson Adhepeau (privexploits () protonmail com)\nDate: February 2026\n\n\n== RESPONSIBLE DISCLOSURE NOTICE ==\n\nThis advisory is published in accordance with responsible disclosure practices.\u00a0\n\nThe vendor was notified on December 2, 2025, acknowledged the reports, and indicated no patches would be issued. \nPublication follows standard 90-day disclosure guidelines.\n\n-------------------------------------------------------------\n\n== OVERVIEW ==\n\nTwo independent authenticated Remote Code Execution\nvulnerabilities were discovered in Netgate pfSense Community\nEdition. Both were reproduced on clean installations. Vendor\nwas contacted and acknowledged the reports but classified both\nas expected behavior for authenticated administrators.\n\n-------------------------------------------------------------\n\n== CVE-2025-69690 ==\nAuthenticated RCE via Unsafe Deserialization (pfSense CE 2.7.2)\n\nCVSS v3.1: 8.8 (High)\nVector: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\nCWE-502: Deserialization of Untrusted Data\nCWE-915: Improperly Controlled Dynamic Code Evaluation\n\n-- Description --\n\nThe pfSense configuration restore mechanism invokes\nunserialize() on user-controlled data without class\nwhitelisting, input validation, or sandboxing.\n\nA crafted backup file containing a malicious serialized PHP\nobject can inject arbitrary commands via the\npost_reboot_commands property, executed through mwexec()\nwith full root privileges.\n\n-- Affected Component --\n\nbackup/restore mechanism, config.php,\npfsense_module_installer class, unserialize() handling\n\n-- Attack Vector --\n\n1. Attacker authenticates as administrator\n2. Uploads malicious configuration backup file\n3. Triggers restore operation\n4. pfSense unserializes attacker-controlled data\n5. Commands execute as root via mwexec()\n\n-- PoC Payload --\n\nO:23:\"pfsense_module_installer\":1:{\n\u00a0 s:17:\"*post_reboot_commands\";\n\u00a0 a:1:{i:0;s:40:\"/usr/local/bin/php -r \u0027system(\\\"id\\\");\u0027\";}}\n\n-- Impact --\n\n- Arbitrary command execution as root\n- Persistent compromise\n- Complete firewall takeover\n- Credential and configuration exfiltration\n\n-- Vendor Response --\n\nNetgate acknowledged the report. Classified as\n\"authenticated administrative abuse\". No patch issued.\nVendor does not assign CVEs directly.\n\n-------------------------------------------------------------\n\n== CVE-2025-69691 ==\nAuthenticated RCE via XMLRPC exec_php (pfSense CE 2.8.0)\n\nCVSS v3.1: 9.9 (Critical)\nVector: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\nCWE-284: Improper Access Control\nCWE-915: Improperly Controlled Dynamic Code Evaluation\n\n-- Description --\n\npfSense CE 2.8.0 exposes an XMLRPC API method\npfsense.exec_php that executes arbitrary PHP code as root\nwithout validation, sandboxing, or restrictions.\n\nThe endpoint is enabled by default, accessible over HTTPS\nvia Basic Authentication, and executes supplied code\nimmediately with full system privileges. Default credentials\n(admin:pfsense) are widely deployed, significantly lowering\nthe exploitation barrier.\n\n-- Affected Component --\n\nxmlrpc.php, pfsense.exec_php method, XMLRPC API handler,\nBasicAuth authentication layer\n\n-- Attack Vector --\n\ncurl -k -u admin:pfsense \\\n\u00a0 -d \u0027\u003cmethodCall\u003e\n\u00a0 \u00a0 \u003cmethodName\u003epfsense.exec_php\u003c/methodName\u003e\n\u00a0 \u00a0 \u003cparams\u003e\u003cparam\u003e\u003cvalue\u003e\u003cstring\u003e\n\u00a0 \u00a0 \u00a0 system(\"id\");\n\u00a0 \u00a0 \u003c/string\u003e\u003c/value\u003e\u003c/param\u003e\u003c/params\u003e\n\u00a0 \u003c/methodCall\u003e\u0027 \\\n\u00a0 https://\u003ctarget\u003e/xmlrpc.php\n\n-- Impact --\n\n- Full remote root compromise\n- Arbitrary file read/write\n- Backdoor deployment\n- Firewall rule manipulation\n- Extraction of secrets and configurations\n\n-- Vendor Response --\n\nNetgate acknowledged the report. Classified as expected\nbehavior for authenticated users. No patch in pfSense CE\n2.8.0. Still exploitable as of latest version at time\nof disclosure.\n\n-------------------------------------------------------------\n\n== TIMELINE ==\n\n- November 2025: Vulnerabilities discovered\n- December 2, 2025: Initial report sent to Netgate\n- Netgate acknowledged, no patch planned\n- January 28, 2026: CVEs assigned by MITRE\n- February 2026: Public disclosure\n\n-------------------------------------------------------------\n\n== REFERENCES ==\n\nCVE-2025-69690:\nhttps://cve.org/CVERecord?id=CVE-2025-69690\n\nCVE-2025-69691:\nhttps://cve.org/CVERecord?id=CVE-2025-69691\n\nResearcher:\nhttps://github.com/privlabs\nhttps://linkedin.com/in/nelson-adhepeau\n\n-------------------------------------------------------------\nNelson Adhepeau\nIndependent Security Researcherprivexploits () protonmail com\n\n\nEnvoy\u00e9 avec un e-mail s\u00e9curis\u00e9 Proton Mail._______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-502",
              "description": "CWE-502",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-915",
              "description": "CWE-915",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:11:47Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/16"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/16"
        },
        {
          "url": "https://cve.org/CVERecord?id=CVE-2025-69690"
        },
        {
          "url": "https://cve.org/CVERecord?id=CVE-2025-69691"
        },
        {
          "url": "https://github.com/privlabs"
        },
        {
          "url": "https://linkedin.com/in/nelson-adhepeau"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/16"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[Full Disclosure] CVE-2025-69690 \u0026 CVE-2025-69691 \u2014 Authenticated RCE in Netgate pfSense CE 2.7.2 and 2.8.0",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2025-69690",
              "type": "related"
            },
            {
              "destId": "CVE-2025-69691",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0187",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/16",
            "automated": true,
            "contentSha256": "a3a7e23d245c41605776753f9e09c79964dff2ba5b758a5485a90b64609442fd",
            "evidenceScore": 10,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/16",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-16T14:09:25Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0187"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-09T10:11:47Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0187"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0283

Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-09 10:11
VLAI
Title
APPLE-SA-08-17-2026-1 iOS 26.6.1 and iPadOS 26.6.1
Summary
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-17-2026-1 iOS 26.6.1 and iPadOS 26.6.1 iOS 26.6.1 and iPadOS 26.6.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/148282. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Audio Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to leak sensitive user information Description: A logic issue was addressed with improved checks. CVE-2026-65339: Meta Red Team X - Nik Tsytsarkin ImageIO Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing an image may lead to a denial-of-service Description: The issue was addressed with improved checks. CVE-2026-65347: Geonha Lee (@leegn4a) ImageIO Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing an image may lead to arbitrary code execution Description: An integer overflow was addressed with improved input validation. CVE-2026-65346: Meta Red Team X - Nik Tsytsarkin IOGPUFamily Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to memory corruption Description: The issue was addressed with improved memory handling. CVE-2026-64788: f00l (@PPPF00L) and 3ndy1(@_3ndy1) and Minghao Lin@Y1nkoc and 云散花折, Arjanit Isufi Kernel Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: A remote attacker may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-65343: Drinor Selmanaj (Sentry), Surya Narayan Kushwaha Kernel Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2026-65349: an anonymous researcher Kernel Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-65330: Bhaswanth Chigurupati, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Telephony Available for: iPhone 11 and later Impact: An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic Description: An authentication issue was addressed with improved state management. CVE-2026-65329: Bedran Karakoc, Tobias Funke, Jacopo Clark, Katharina Kohls of Ruhr University Bochum WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: An out-of-bounds access issue was addressed with improved bounds checking. WebKit Bugzilla: 317632 CVE-2026-64784: Janggoon Lee of Out of Bounds, OpenAI Codex Security - Amy Burnett WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 313452 CVE-2026-43795: wwwlk WebKit Bugzilla: 318348 CVE-2026-65338: OpenAI Codex Security - Amy Burnett WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to memory corruption Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 318405 CVE-2026-65341: Henock Habte WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A memory corruption vulnerability was addressed with improved locking. WebKit Bugzilla: 321480 CVE-2026-64782: Seonwook Kim, Shubham Chaskar, lattice, Josef Korbel WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved input validation. WebKit Bugzilla: 321484 CVE-2026-64781: Thomas Guillem WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: This issue was addressed through improved state management. WebKit Bugzilla: 321517 CVE-2026-65351: Niels Hofmans WebKit Bugzilla: 316996 CVE-2026-65340: Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Josef Korbel (Citadelo) WebKit Bugzilla: 317142 CVE-2026-65337: OpenAI Codex Security - Amy Burnett WebKit Bugzilla: 317349 CVE-2026-65336: Josef Korbel WebKit Bugzilla: 316723 CVE-2026-65335: OpenAI Codex Security - Amy Burnett WebKit Bugzilla: 317603 CVE-2026-65333: OpenAI Codex Security - Amy Burnett WebKit Bugzilla: 317450 CVE-2026-65332: OpenAI Codex Security - Amy Burnett WebKit Bugzilla: 317611 CVE-2026-65331: OpenAI Codex Security - Amy Burnett WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 316347 CVE-2026-64715: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved checks. WebKit Bugzilla: 316918 CVE-2026-64780: OpenAI Codex Security - Amy Burnett WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A memory corruption issue was addressed with improved state management. WebKit Bugzilla: 316791 CVE-2026-65334: OpenAI Codex Security - Amy Burnett WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to memory corruption Description: A memory corruption issue was addressed with improved memory handling. WebKit Bugzilla: 317317 CVE-2026-43794: Dung Do (@_piers2) of Calif.io WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected process termination Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 313703 CVE-2026-64787: 杉山 壮太, Shubham Chaskar WebKit History Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Visiting a maliciously crafted website may leak sensitive data Description: The issue was addressed with improved checks. WebKit Bugzilla: 315528 CVE-2026-64778: Mohit Negi WebKit Storage Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A memory corruption vulnerability was addressed with improved locking. WebKit Bugzilla: 321485 CVE-2026-64779: Shubham Chaskar, Tommy DeVoss from Braze Security Team (@thedawgyg) Additional recognition Compression We would like to acknowledge Tommy DeVoss from Braze Security Team (@thedawgyg) for their assistance. libcryptex We would like to acknowledge Ashish Kunwar for their assistance. WebKit We would like to acknowledge Henock Habte for their assistance. This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated:
Severity
No CVSS data available.
Assigner
References
Impacted products
Credits
Apple Product Security via Fulldisclosure
Relationships
reference GCVE-1988-2026-0283 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "APPLE-SA-08-17-2026-1 iOS",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-08-17-2026-1 iOS 26.6.1 and iPadOS 26.6.1\n\niOS 26.6.1 and iPadOS 26.6.1 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/148282.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAudio\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to leak sensitive user information\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-65339: Meta Red Team X - Nik Tsytsarkin\n\nImageIO\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing an image may lead to a denial-of-service\nDescription: The issue was addressed with improved checks.\nCVE-2026-65347: Geonha Lee (@leegn4a)\n\nImageIO\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing an image may lead to arbitrary code execution\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-65346: Meta Red Team X - Nik Tsytsarkin\n\nIOGPUFamily\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64788: f00l (@PPPF00L) and 3ndy1(@_3ndy1) and Minghao\nLin@Y1nkoc and \u4e91\u6563\u82b1\u6298, Arjanit Isufi\n\nKernel\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-65343: Drinor Selmanaj (Sentry), Surya Narayan Kushwaha\n\nKernel\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to cause unexpected system termination or\nread kernel memory\nDescription: An out-of-bounds read was addressed with improved input\nvalidation.\nCVE-2026-65349: an anonymous researcher\n\nKernel\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-65330: Bhaswanth Chigurupati, Billy Jheng Bing Jhong and Pan\nZhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nTelephony\nAvailable for: iPhone 11 and later\nImpact: An attacker in a privileged network position may be able to\nbypass IPSec authentication and intercept network traffic\nDescription: An authentication issue was addressed with improved state\nmanagement.\nCVE-2026-65329: Bedran Karakoc, Tobias Funke, Jacopo Clark, Katharina\nKohls of Ruhr University Bochum\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nWebKit Bugzilla: 317632\nCVE-2026-64784: Janggoon Lee of Out of Bounds, OpenAI Codex Security -\nAmy Burnett\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 313452\nCVE-2026-43795: wwwlk\nWebKit Bugzilla: 318348\nCVE-2026-65338: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 318405\nCVE-2026-65341: Henock Habte\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nWebKit Bugzilla: 321480\nCVE-2026-64782: Seonwook Kim, Shubham Chaskar, lattice, Josef Korbel\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 321484\nCVE-2026-64781: Thomas Guillem\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: This issue was addressed through improved state management.\nWebKit Bugzilla: 321517\nCVE-2026-65351: Niels Hofmans\nWebKit Bugzilla: 316996\nCVE-2026-65340: Claudio Bozzato and Francesco Benvenuto of Cisco Talos,\nJosef Korbel (Citadelo)\nWebKit Bugzilla: 317142\nCVE-2026-65337: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317349\nCVE-2026-65336: Josef Korbel\nWebKit Bugzilla: 316723\nCVE-2026-65335: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317603\nCVE-2026-65333: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317450\nCVE-2026-65332: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317611\nCVE-2026-65331: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 316347\nCVE-2026-64715: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved checks.\nWebKit Bugzilla: 316918\nCVE-2026-64780: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption issue was addressed with improved state\nmanagement.\nWebKit Bugzilla: 316791\nCVE-2026-65334: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nWebKit Bugzilla: 317317\nCVE-2026-43794: Dung Do (@_piers2) of Calif.io\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process termination\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313703\nCVE-2026-64787: \u6749\u5c71 \u58ee\u592a, Shubham Chaskar\n\nWebKit History\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Visiting a maliciously crafted website may leak sensitive data\nDescription: The issue was addressed with improved checks.\nWebKit Bugzilla: 315528\nCVE-2026-64778: Mohit Negi\n\nWebKit Storage\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nWebKit Bugzilla: 321485\nCVE-2026-64779: Shubham Chaskar, Tommy DeVoss from Braze Security Team\n(@thedawgyg)\n\nAdditional recognition\n\nCompression\nWe would like to acknowledge Tommy DeVoss from Braze Security Team\n(@thedawgyg) for their assistance.\n\nlibcryptex\nWe would like to acknowledge Ashish Kunwar for their assistance.\n\nWebKit\nWe would like to acknowledge Henock Habte for their assistance.\n\nThis update is available through iTunes and Software Update on your iOS\ndevice, and will not appear in your computer\u0027s Software Update\napplication, or in the Apple Downloads site. Make sure you have an\nInternet connection and have installed the latest version of iTunes from\nhttps://www.apple.com/itunes/\n\niTunes and Software Update on the device will automatically check\nApple\u0027s update server on its weekly schedule. When an update is\ndetected, it is downloaded and the option to be installed is presented\nto the user when the iOS device is docked. We recommend applying the\nupdate immediately if possible. Selecting Don\u0027t Install will present the\noption the next time you connect your iOS device.\n\nThe automatic update process may take up to a week depending on the day\nthat iTunes or the device checks for updates. You may manually obtain\nthe update via the Check for Updates button within iTunes, or the\nSoftware Update on your device.\n\nTo check that the iPhone, iPod touch, or iPad has been updated:"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:11:43Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/41"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/41"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/148282"
        },
        {
          "url": "https://www.apple.com/itunes/"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/41"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-08-17-2026-1 iOS 26.6.1 and iPadOS 26.6.1",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-43794",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43795",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64715",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64778",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64779",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64780",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64781",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64782",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64784",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64787",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64788",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65329",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65330",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65331",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65332",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65333",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65334",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65335",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65336",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65337",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65338",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65339",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65340",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65341",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65343",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65346",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65347",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65349",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65351",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0283",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/41",
            "automated": true,
            "contentSha256": "fef4f0e04fa1c7ef7f6c35f80d6fc92b29be4043d82b8b213f6395f3569485cf",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/41",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-17T22:00:29Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0283"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:44Z",
    "dateUpdated": "2026-09-09T10:11:43Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0283"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0032

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-09 10:11
VLAI
Title
APPLE-SA-08-17-2026-1 iOS 26.6.1 and iPadOS 26.6.1
Summary
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-17-2026-1 iOS 26.6.1 and iPadOS 26.6.1 iOS 26.6.1 and iPadOS 26.6.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/148282. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Audio Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to leak sensitive user information Description: A logic issue was addressed with improved checks. CVE-2026-65339: Meta Red Team X - Nik Tsytsarkin ImageIO Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing an image may lead to a denial-of-service Description: The issue was addressed with improved checks. CVE-2026-65347: Geonha Lee (@leegn4a) ImageIO Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing an image may lead to arbitrary code execution Description: An integer overflow was addressed with improved input validation. CVE-2026-65346: Meta Red Team X - Nik Tsytsarkin IOGPUFamily Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to memory corruption Description: The issue was addressed with improved memory handling. CVE-2026-64788: f00l (@PPPF00L) and 3ndy1(@_3ndy1) and Minghao Lin@Y1nkoc and 云散花折, Arjanit Isufi Kernel Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: A remote attacker may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-65343: Drinor Selmanaj (Sentry), Surya Narayan Kushwaha Kernel Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2026-65349: an anonymous researcher Kernel Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-65330: Bhaswanth Chigurupati, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Telephony Available for: iPhone 11 and later Impact: An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic Description: An authentication issue was addressed with improved state management. CVE-2026-65329: Bedran Karakoc, Tobias Funke, Jacopo Clark, Katharina Kohls of Ruhr University Bochum WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: An out-of-bounds access issue was addressed with improved bounds checking. WebKit Bugzilla: 317632 CVE-2026-64784: Janggoon Lee of Out of Bounds, OpenAI Codex Security - Amy Burnett WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 313452 CVE-2026-43795: wwwlk WebKit Bugzilla: 318348 CVE-2026-65338: OpenAI Codex Security - Amy Burnett WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to memory corruption Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 318405 CVE-2026-65341: Henock Habte WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A memory corruption vulnerability was addressed with improved locking. WebKit Bugzilla: 321480 CVE-2026-64782: Seonwook Kim, Shubham Chaskar, lattice, Josef Korbel WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved input validation. WebKit Bugzilla: 321484 CVE-2026-64781: Thomas Guillem WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: This issue was addressed through improved state management. WebKit Bugzilla: 321517 CVE-2026-65351: Niels Hofmans WebKit Bugzilla: 316996 CVE-2026-65340: Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Josef Korbel (Citadelo) WebKit Bugzilla: 317142 CVE-2026-65337: OpenAI Codex Security - Amy Burnett WebKit Bugzilla: 317349 CVE-2026-65336: Josef Korbel WebKit Bugzilla: 316723 CVE-2026-65335: OpenAI Codex Security - Amy Burnett WebKit Bugzilla: 317603 CVE-2026-65333: OpenAI Codex Security - Amy Burnett WebKit Bugzilla: 317450 CVE-2026-65332: OpenAI Codex Security - Amy Burnett WebKit Bugzilla: 317611 CVE-2026-65331: OpenAI Codex Security - Amy Burnett WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 316347 CVE-2026-64715: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved checks. WebKit Bugzilla: 316918 CVE-2026-64780: OpenAI Codex Security - Amy Burnett WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A memory corruption issue was addressed with improved state management. WebKit Bugzilla: 316791 CVE-2026-65334: OpenAI Codex Security - Amy Burnett WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to memory corruption Description: A memory corruption issue was addressed with improved memory handling. WebKit Bugzilla: 317317 CVE-2026-43794: Dung Do (@_piers2) of Calif.io WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected process termination Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 313703 CVE-2026-64787: 杉山 壮太, Shubham Chaskar WebKit History Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Visiting a maliciously crafted website may leak sensitive data Description: The issue was addressed with improved checks. WebKit Bugzilla: 315528 CVE-2026-64778: Mohit Negi WebKit Storage Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A memory corruption vulnerability was addressed with improved locking. WebKit Bugzilla: 321485 CVE-2026-64779: Shubham Chaskar, Tommy DeVoss from Braze Security Team (@thedawgyg) Additional recognition Compression We would like to acknowledge Tommy DeVoss from Braze Security Team (@thedawgyg) for their assistance. libcryptex We would like to acknowledge Ashish Kunwar for their assistance. WebKit We would like to acknowledge Henock Habte for their assistance. This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated:
Severity
No CVSS data available.
Assigner
References
Impacted products
Credits
Apple Product Security via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "APPLE-SA-08-17-2026-1 iOS",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-08-17-2026-1 iOS 26.6.1 and iPadOS 26.6.1\n\niOS 26.6.1 and iPadOS 26.6.1 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/148282.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAudio\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to leak sensitive user information\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-65339: Meta Red Team X - Nik Tsytsarkin\n\nImageIO\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing an image may lead to a denial-of-service\nDescription: The issue was addressed with improved checks.\nCVE-2026-65347: Geonha Lee (@leegn4a)\n\nImageIO\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing an image may lead to arbitrary code execution\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-65346: Meta Red Team X - Nik Tsytsarkin\n\nIOGPUFamily\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64788: f00l (@PPPF00L) and 3ndy1(@_3ndy1) and Minghao\nLin@Y1nkoc and \u4e91\u6563\u82b1\u6298, Arjanit Isufi\n\nKernel\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-65343: Drinor Selmanaj (Sentry), Surya Narayan Kushwaha\n\nKernel\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to cause unexpected system termination or\nread kernel memory\nDescription: An out-of-bounds read was addressed with improved input\nvalidation.\nCVE-2026-65349: an anonymous researcher\n\nKernel\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-65330: Bhaswanth Chigurupati, Billy Jheng Bing Jhong and Pan\nZhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nTelephony\nAvailable for: iPhone 11 and later\nImpact: An attacker in a privileged network position may be able to\nbypass IPSec authentication and intercept network traffic\nDescription: An authentication issue was addressed with improved state\nmanagement.\nCVE-2026-65329: Bedran Karakoc, Tobias Funke, Jacopo Clark, Katharina\nKohls of Ruhr University Bochum\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nWebKit Bugzilla: 317632\nCVE-2026-64784: Janggoon Lee of Out of Bounds, OpenAI Codex Security -\nAmy Burnett\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 313452\nCVE-2026-43795: wwwlk\nWebKit Bugzilla: 318348\nCVE-2026-65338: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 318405\nCVE-2026-65341: Henock Habte\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nWebKit Bugzilla: 321480\nCVE-2026-64782: Seonwook Kim, Shubham Chaskar, lattice, Josef Korbel\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 321484\nCVE-2026-64781: Thomas Guillem\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: This issue was addressed through improved state management.\nWebKit Bugzilla: 321517\nCVE-2026-65351: Niels Hofmans\nWebKit Bugzilla: 316996\nCVE-2026-65340: Claudio Bozzato and Francesco Benvenuto of Cisco Talos,\nJosef Korbel (Citadelo)\nWebKit Bugzilla: 317142\nCVE-2026-65337: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317349\nCVE-2026-65336: Josef Korbel\nWebKit Bugzilla: 316723\nCVE-2026-65335: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317603\nCVE-2026-65333: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317450\nCVE-2026-65332: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317611\nCVE-2026-65331: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 316347\nCVE-2026-64715: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved checks.\nWebKit Bugzilla: 316918\nCVE-2026-64780: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption issue was addressed with improved state\nmanagement.\nWebKit Bugzilla: 316791\nCVE-2026-65334: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nWebKit Bugzilla: 317317\nCVE-2026-43794: Dung Do (@_piers2) of Calif.io\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process termination\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313703\nCVE-2026-64787: \u6749\u5c71 \u58ee\u592a, Shubham Chaskar\n\nWebKit History\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Visiting a maliciously crafted website may leak sensitive data\nDescription: The issue was addressed with improved checks.\nWebKit Bugzilla: 315528\nCVE-2026-64778: Mohit Negi\n\nWebKit Storage\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nWebKit Bugzilla: 321485\nCVE-2026-64779: Shubham Chaskar, Tommy DeVoss from Braze Security Team\n(@thedawgyg)\n\nAdditional recognition\n\nCompression\nWe would like to acknowledge Tommy DeVoss from Braze Security Team\n(@thedawgyg) for their assistance.\n\nlibcryptex\nWe would like to acknowledge Ashish Kunwar for their assistance.\n\nWebKit\nWe would like to acknowledge Henock Habte for their assistance.\n\nThis update is available through iTunes and Software Update on your iOS\ndevice, and will not appear in your computer\u0027s Software Update\napplication, or in the Apple Downloads site. Make sure you have an\nInternet connection and have installed the latest version of iTunes from\nhttps://www.apple.com/itunes/\n\niTunes and Software Update on the device will automatically check\nApple\u0027s update server on its weekly schedule. When an update is\ndetected, it is downloaded and the option to be installed is presented\nto the user when the iOS device is docked. We recommend applying the\nupdate immediately if possible. Selecting Don\u0027t Install will present the\noption the next time you connect your iOS device.\n\nThe automatic update process may take up to a week depending on the day\nthat iTunes or the device checks for updates. You may manually obtain\nthe update via the Check for Updates button within iTunes, or the\nSoftware Update on your device.\n\nTo check that the iPhone, iPod touch, or iPad has been updated:"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:11:43Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/41"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/41"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/148282"
        },
        {
          "url": "https://www.apple.com/itunes/"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/41"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-08-17-2026-1 iOS 26.6.1 and iPadOS 26.6.1",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0032",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/41",
            "automated": true,
            "contentSha256": "fef4f0e04fa1c7ef7f6c35f80d6fc92b29be4043d82b8b213f6395f3569485cf",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/41",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-17T22:00:29Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-09T10:11:43Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0032"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0284

Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-09 10:11
VLAI
Title
APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10
Summary
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10 iOS 18.7.10 and iPadOS 18.7.10 addresses the following issues. Information about the security content is also available at https://support.apple.com/148287. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accessibility Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An attacker with physical access may be able to access sensitive user data during iPhone Mirroring Description: This issue was addressed through improved state management. CVE-2026-64732: Jorge Welch (@jorgwelch) AirDrop Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An attacker in a privileged network position may be able to cause a denial-of-service Description: A reachable assertion was addressed with improved input validation. CVE-2026-43667: Arash Ale Ebrahim from SCy-Phy research group of CISPA Helmholtz Center for Information Security APFS Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64695: Narendra Singh (@_3P1C), Peter Malone App Store Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved checks. CVE-2026-43801: Rahul Raj AppleDouble Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-43776: Peter Malone, Nicolas Rabrenovic, Irvin Wang Audio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/) AVEVideoEncoder Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to execute arbitrary code with kernel privileges Description: A buffer overflow was addressed with improved size validation. CVE-2026-64747: Franco Belman at Blackwing Intelligence AVEVideoEncoder Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun BackgroundAssets Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to delete files for which it does not have permission Description: A permissions issue was addressed with improved validation. CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab Books Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to modify protected parts of the file system Description: A race condition was addressed with improved checks. CVE-2026-43811: Rodolphe Brunetti (@eisw0lf) of Lupus Nova Contacts Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to add contacts without user authorization Description: An authorization issue was addressed with improved validation. CVE-2026-64746: Rodolphe Brunetti (@eisw0lf) of Lupus Nova, Daniel Febrero Contacts Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted contact may leak sensitive data Description: The issue was addressed with improved checks. CVE-2026-64734: Daniel Williams Contacts Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to access information about a user's contacts Description: This issue was addressed with improved checks. CVE-2026-43797: Arni Hardarson (Neonix Security) CoreAudio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted audio file may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative CoreAudio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43744: ret2happy, Mathis Mansière, an anonymous researcher CoreAudio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A remote attacker may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43803: Rahul Raj CoreMedia Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: A memory corruption issue was addressed with improved memory handling. CVE-2026-43711: James Duffy (@0x4A616D657344) CoreUI Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted asset catalog may result in disclosure of process memory Description: The issue was addressed with improved memory handling. CVE-2026-43738: Peter Malone CoreVideo Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43802: an anonymous researcher curl Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Authentication credentials may be sent to a server on another origin Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2026-3784 CVE-2026-3783 Foundation Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A malicious app may be able to access protected user data Description: The issue was addressed with improved input sanitization. CVE-2026-43714: an anonymous researcher FrontBoard Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to access sensitive user data Description: This issue was addressed by using HTTPS when sending information over the network. CVE-2026-64742: Huỳnh Tấn Ngàn Game Center Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A malicious app may be able to break out of its sandbox Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-64740: Manuel Fernandez (Stackhopper Security) Game Center Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to read a persistent device identifier Description: This issue was addressed with improved data protection. CVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive Technologies Heimdal Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64692: Redon Gashi ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-64716: Peter Malone, Jonathan Alush-Aben, Arni Hardarson CVE-2026-28990: Jiri Ha, Arni Hardarson ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may corrupt process memory Description: A buffer overflow issue was addressed with improved memory handling. CVE-2026-43661: Gandalf4a of PKU-ICODE, Anton Pakhunov, an anonymous researcher ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An integer overflow was addressed with improved input validation. CVE-2026-43818: an anonymous researcher ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may lead to a denial-of-service Description: A type confusion issue was addressed with improved checks. CVE-2026-64693: Geonha Lee (@leegn4a) IOSkywalkFamily Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to disclose kernel memory Description: A memory corruption issue was addressed with improved memory handling. CVE-2026-39877: Richard Zana, Dhiyanesh Selvaraj (@redroot97) IOSurfaceAccelerator Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to leak sensitive kernel state Description: An information leakage was addressed with additional validation. CVE-2026-64760: Seiji Sakurai (@HeapSmasher), Franco Belman at Blackwing Intelligence, an anonymous researcher Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64749: hxr1, Hiroki Imai (LAC Co., Ltd.), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ashish Kunwar Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to disclose kernel memory Description: An information leakage was addressed with additional validation. CVE-2026-64744: Ryan Hileman via Xint Code (xint.io) Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2026-43778: Ashish Kunwar, f0r of MurphySec, Mahmoud Abdelmoniem, Feng Xue and XGPT of ThreatBook, Wang Yu, Nicolas Rabrenovic, Lyutoon, Hiroki Imai (LAC Co., Ltd.), Fábio Luís @scanpt, DARKNAVY (@DarkNavyOrg), an anonymous researcher Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A remote attacker may be able to bypass network filters Description: An inconsistent user interface issue was addressed with improved state management. CVE-2026-64735: Gor Aleksanyan Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-43822: Michal Kosiorek, Eddy Tsalolikhin CVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. CVE-2026-64700: Asjid Kalam (@odinshell) Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination or write kernel memory Description: The issue was addressed with improved input sanitization. CVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel) Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: An integer overflow was addressed with improved input validation. CVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR L
Severity
No CVSS data available.
Assigner
References
Impacted products
Credits
Apple Product Security via Fulldisclosure
Relationships
reference GCVE-1988-2026-0284 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "APPLE-SA-08-17-2026-2 iOS",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10\n\niOS 18.7.10 and iPadOS 18.7.10 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/148287.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccessibility\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An attacker with physical access may be able to access sensitive\nuser data during iPhone Mirroring\nDescription: This issue was addressed through improved state management.\nCVE-2026-64732: Jorge Welch (@jorgwelch)\n\nAirDrop\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An attacker in a privileged network position may be able to\ncause a denial-of-service\nDescription: A reachable assertion was addressed with improved input\nvalidation.\nCVE-2026-43667: Arash Ale Ebrahim from SCy-Phy research group of CISPA\nHelmholtz Center for Information Security\n\nAPFS\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote user may be able to cause unexpected system termination\nor corrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64695: Narendra Singh (@_3P1C), Peter Malone\n\nApp Store\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved checks.\nCVE-2026-43801: Rahul Raj\n\nAppleDouble\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination or arbitrary code execution\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-43776: Peter Malone, Nicolas Rabrenovic, Irvin Wang\n\nAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\nAVEVideoEncoder\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges\nDescription: A buffer overflow was addressed with improved size\nvalidation.\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\nAVEVideoEncoder\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun\n\nBackgroundAssets\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to delete files for which it does not have\npermission\nDescription: A permissions issue was addressed with improved validation.\nCVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity\u0027s WeBin lab\n\nBooks\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to modify protected parts of the file system\nDescription: A race condition was addressed with improved checks.\nCVE-2026-43811: Rodolphe Brunetti (@eisw0lf) of Lupus Nova\n\nContacts\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to add contacts without user authorization\nDescription: An authorization issue was addressed with improved\nvalidation.\nCVE-2026-64746: Rodolphe Brunetti (@eisw0lf) of Lupus Nova, Daniel\nFebrero\n\nContacts\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted contact may leak sensitive data\nDescription: The issue was addressed with improved checks.\nCVE-2026-64734: Daniel Williams\n\nContacts\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access information about a user\u0027s contacts\nDescription: This issue was addressed with improved checks.\nCVE-2026-43797: Arni Hardarson (Neonix Security)\n\nCoreAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted audio file may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\nCoreAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43744: ret2happy, Mathis Mansi\u00e8re, an anonymous researcher\n\nCoreAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43803: Rahul Raj\n\nCoreMedia\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\nCoreUI\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted asset catalog may result in\ndisclosure of process memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43738: Peter Malone\n\nCoreVideo\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43802: an anonymous researcher\n\ncurl\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Authentication credentials may be sent to a server on another\norigin\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-3784\nCVE-2026-3783\n\nFoundation\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A malicious app may be able to access protected user data\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43714: an anonymous researcher\n\nFrontBoard\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed by using HTTPS when sending\ninformation over the network.\nCVE-2026-64742: Hu\u1ef3nh T\u1ea5n Ng\u00e0n\n\nGame Center\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\nGame Center\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to read a persistent device identifier\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive\nTechnologies\n\nHeimdal\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64692: Redon Gashi\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64716: Peter Malone, Jonathan Alush-Aben, Arni Hardarson\nCVE-2026-28990: Jiri Ha, Arni Hardarson\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: A buffer overflow issue was addressed with improved memory\nhandling.\nCVE-2026-43661: Gandalf4a of PKU-ICODE, Anton Pakhunov, an anonymous\nresearcher\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may lead to arbitrary\ncode execution\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43818: an anonymous researcher\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may lead to a\ndenial-of-service\nDescription: A type confusion issue was addressed with improved checks.\nCVE-2026-64693: Geonha Lee (@leegn4a)\n\nIOSkywalkFamily\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to disclose kernel memory\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-39877: Richard Zana, Dhiyanesh Selvaraj (@redroot97)\n\nIOSurfaceAccelerator\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to leak sensitive kernel state\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-64760: Seiji Sakurai (@HeapSmasher), Franco Belman at Blackwing\nIntelligence, an anonymous researcher\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64749: hxr1, Hiroki Imai (LAC Co., Ltd.), Billy Jheng Bing\nJhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ashish\nKunwar\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to disclose kernel memory\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-64744: Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43778: Ashish Kunwar, f0r of MurphySec, Mahmoud Abdelmoniem,\nFeng Xue and XGPT of ThreatBook, Wang Yu, Nicolas Rabrenovic, Lyutoon,\nHiroki Imai (LAC Co., Ltd.), F\u00e1bio Lu\u00eds @scanpt, DARKNAVY\n(@DarkNavyOrg), an anonymous researcher\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote attacker may be able to bypass network filters\nDescription: An inconsistent user interface issue was addressed with\nimproved state management.\nCVE-2026-64735: Gor Aleksanyan\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43822: Michal Kosiorek, Eddy Tsalolikhin\nCVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\nCVE-2026-64700: Asjid Kalam (@odinshell)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR L"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:11:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/38"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/38"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/148287"
        },
        {
          "url": "https://www.apple.com/itunes/"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/38"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-28947",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28958",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28973",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28979",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28984",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28990",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28996",
              "type": "related"
            },
            {
              "destId": "CVE-2026-3783",
              "type": "related"
            },
            {
              "destId": "CVE-2026-3784",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39868",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39872",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39877",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43658",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43661",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43663",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43667",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43673",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43676",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43699",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43700",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43701",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43705",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43708",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43711",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43714",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43717",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43720",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43722",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43723",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43724",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43725",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43726",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43727",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43729",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43731",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43733",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43734",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43735",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43738",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43742",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43744",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43745",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43754",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43757",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43769",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43776",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43778",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43794",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43795",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43796",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43797",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43799",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43800",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43801",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43802",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43803",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43807",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43809",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43810",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43811",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43812",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43818",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43821",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43822",
              "type": "related"
            },
            {
              "destId": "CVE-2026-4424",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64692",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64693",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64695",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64700",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64707",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64709",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64715",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64716",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64719",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64721",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64722",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64723",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64724",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64725",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64726",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64732",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64734",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64735",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64738",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64739",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64740",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64742",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64743",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64744",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64746",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64747",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64749",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64755",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64757",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64760",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64762",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64763",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64764",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64765",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64766",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64768",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64769",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64770",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64771",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64772",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64774",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64778",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64779",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64780",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64781",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64782",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64784",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65331",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65332",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65333",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65334",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65335",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65336",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65337",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65338",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65340",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65341",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0284",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/38",
            "automated": true,
            "contentSha256": "4f94a9072b82830135f0c238c7ec5b4f85054d563fda541bcdc667d3f5f62d48",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/38",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-17T22:00:58Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0284"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:45Z",
    "dateUpdated": "2026-09-09T10:11:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0284"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0033

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-09 10:11
VLAI
Title
APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10
Summary
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10 iOS 18.7.10 and iPadOS 18.7.10 addresses the following issues. Information about the security content is also available at https://support.apple.com/148287. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accessibility Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An attacker with physical access may be able to access sensitive user data during iPhone Mirroring Description: This issue was addressed through improved state management. CVE-2026-64732: Jorge Welch (@jorgwelch) AirDrop Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An attacker in a privileged network position may be able to cause a denial-of-service Description: A reachable assertion was addressed with improved input validation. CVE-2026-43667: Arash Ale Ebrahim from SCy-Phy research group of CISPA Helmholtz Center for Information Security APFS Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64695: Narendra Singh (@_3P1C), Peter Malone App Store Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved checks. CVE-2026-43801: Rahul Raj AppleDouble Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-43776: Peter Malone, Nicolas Rabrenovic, Irvin Wang Audio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/) AVEVideoEncoder Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to execute arbitrary code with kernel privileges Description: A buffer overflow was addressed with improved size validation. CVE-2026-64747: Franco Belman at Blackwing Intelligence AVEVideoEncoder Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun BackgroundAssets Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to delete files for which it does not have permission Description: A permissions issue was addressed with improved validation. CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab Books Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to modify protected parts of the file system Description: A race condition was addressed with improved checks. CVE-2026-43811: Rodolphe Brunetti (@eisw0lf) of Lupus Nova Contacts Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to add contacts without user authorization Description: An authorization issue was addressed with improved validation. CVE-2026-64746: Rodolphe Brunetti (@eisw0lf) of Lupus Nova, Daniel Febrero Contacts Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted contact may leak sensitive data Description: The issue was addressed with improved checks. CVE-2026-64734: Daniel Williams Contacts Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to access information about a user's contacts Description: This issue was addressed with improved checks. CVE-2026-43797: Arni Hardarson (Neonix Security) CoreAudio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted audio file may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative CoreAudio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43744: ret2happy, Mathis Mansière, an anonymous researcher CoreAudio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A remote attacker may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43803: Rahul Raj CoreMedia Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: A memory corruption issue was addressed with improved memory handling. CVE-2026-43711: James Duffy (@0x4A616D657344) CoreUI Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted asset catalog may result in disclosure of process memory Description: The issue was addressed with improved memory handling. CVE-2026-43738: Peter Malone CoreVideo Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43802: an anonymous researcher curl Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Authentication credentials may be sent to a server on another origin Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2026-3784 CVE-2026-3783 Foundation Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A malicious app may be able to access protected user data Description: The issue was addressed with improved input sanitization. CVE-2026-43714: an anonymous researcher FrontBoard Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to access sensitive user data Description: This issue was addressed by using HTTPS when sending information over the network. CVE-2026-64742: Huỳnh Tấn Ngàn Game Center Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A malicious app may be able to break out of its sandbox Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-64740: Manuel Fernandez (Stackhopper Security) Game Center Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to read a persistent device identifier Description: This issue was addressed with improved data protection. CVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive Technologies Heimdal Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64692: Redon Gashi ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-64716: Peter Malone, Jonathan Alush-Aben, Arni Hardarson CVE-2026-28990: Jiri Ha, Arni Hardarson ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may corrupt process memory Description: A buffer overflow issue was addressed with improved memory handling. CVE-2026-43661: Gandalf4a of PKU-ICODE, Anton Pakhunov, an anonymous researcher ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An integer overflow was addressed with improved input validation. CVE-2026-43818: an anonymous researcher ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may lead to a denial-of-service Description: A type confusion issue was addressed with improved checks. CVE-2026-64693: Geonha Lee (@leegn4a) IOSkywalkFamily Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to disclose kernel memory Description: A memory corruption issue was addressed with improved memory handling. CVE-2026-39877: Richard Zana, Dhiyanesh Selvaraj (@redroot97) IOSurfaceAccelerator Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to leak sensitive kernel state Description: An information leakage was addressed with additional validation. CVE-2026-64760: Seiji Sakurai (@HeapSmasher), Franco Belman at Blackwing Intelligence, an anonymous researcher Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64749: hxr1, Hiroki Imai (LAC Co., Ltd.), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ashish Kunwar Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to disclose kernel memory Description: An information leakage was addressed with additional validation. CVE-2026-64744: Ryan Hileman via Xint Code (xint.io) Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2026-43778: Ashish Kunwar, f0r of MurphySec, Mahmoud Abdelmoniem, Feng Xue and XGPT of ThreatBook, Wang Yu, Nicolas Rabrenovic, Lyutoon, Hiroki Imai (LAC Co., Ltd.), Fábio Luís @scanpt, DARKNAVY (@DarkNavyOrg), an anonymous researcher Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A remote attacker may be able to bypass network filters Description: An inconsistent user interface issue was addressed with improved state management. CVE-2026-64735: Gor Aleksanyan Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-43822: Michal Kosiorek, Eddy Tsalolikhin CVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. CVE-2026-64700: Asjid Kalam (@odinshell) Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination or write kernel memory Description: The issue was addressed with improved input sanitization. CVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel) Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: An integer overflow was addressed with improved input validation. CVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR L
Severity
No CVSS data available.
Assigner
References
Impacted products
Credits
Apple Product Security via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "APPLE-SA-08-17-2026-2 iOS",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10\n\niOS 18.7.10 and iPadOS 18.7.10 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/148287.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccessibility\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An attacker with physical access may be able to access sensitive\nuser data during iPhone Mirroring\nDescription: This issue was addressed through improved state management.\nCVE-2026-64732: Jorge Welch (@jorgwelch)\n\nAirDrop\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An attacker in a privileged network position may be able to\ncause a denial-of-service\nDescription: A reachable assertion was addressed with improved input\nvalidation.\nCVE-2026-43667: Arash Ale Ebrahim from SCy-Phy research group of CISPA\nHelmholtz Center for Information Security\n\nAPFS\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote user may be able to cause unexpected system termination\nor corrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64695: Narendra Singh (@_3P1C), Peter Malone\n\nApp Store\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved checks.\nCVE-2026-43801: Rahul Raj\n\nAppleDouble\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination or arbitrary code execution\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-43776: Peter Malone, Nicolas Rabrenovic, Irvin Wang\n\nAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\nAVEVideoEncoder\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges\nDescription: A buffer overflow was addressed with improved size\nvalidation.\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\nAVEVideoEncoder\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun\n\nBackgroundAssets\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to delete files for which it does not have\npermission\nDescription: A permissions issue was addressed with improved validation.\nCVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity\u0027s WeBin lab\n\nBooks\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to modify protected parts of the file system\nDescription: A race condition was addressed with improved checks.\nCVE-2026-43811: Rodolphe Brunetti (@eisw0lf) of Lupus Nova\n\nContacts\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to add contacts without user authorization\nDescription: An authorization issue was addressed with improved\nvalidation.\nCVE-2026-64746: Rodolphe Brunetti (@eisw0lf) of Lupus Nova, Daniel\nFebrero\n\nContacts\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted contact may leak sensitive data\nDescription: The issue was addressed with improved checks.\nCVE-2026-64734: Daniel Williams\n\nContacts\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access information about a user\u0027s contacts\nDescription: This issue was addressed with improved checks.\nCVE-2026-43797: Arni Hardarson (Neonix Security)\n\nCoreAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted audio file may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\nCoreAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43744: ret2happy, Mathis Mansi\u00e8re, an anonymous researcher\n\nCoreAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43803: Rahul Raj\n\nCoreMedia\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\nCoreUI\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted asset catalog may result in\ndisclosure of process memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43738: Peter Malone\n\nCoreVideo\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43802: an anonymous researcher\n\ncurl\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Authentication credentials may be sent to a server on another\norigin\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-3784\nCVE-2026-3783\n\nFoundation\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A malicious app may be able to access protected user data\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43714: an anonymous researcher\n\nFrontBoard\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed by using HTTPS when sending\ninformation over the network.\nCVE-2026-64742: Hu\u1ef3nh T\u1ea5n Ng\u00e0n\n\nGame Center\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\nGame Center\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to read a persistent device identifier\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive\nTechnologies\n\nHeimdal\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64692: Redon Gashi\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64716: Peter Malone, Jonathan Alush-Aben, Arni Hardarson\nCVE-2026-28990: Jiri Ha, Arni Hardarson\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: A buffer overflow issue was addressed with improved memory\nhandling.\nCVE-2026-43661: Gandalf4a of PKU-ICODE, Anton Pakhunov, an anonymous\nresearcher\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may lead to arbitrary\ncode execution\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43818: an anonymous researcher\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may lead to a\ndenial-of-service\nDescription: A type confusion issue was addressed with improved checks.\nCVE-2026-64693: Geonha Lee (@leegn4a)\n\nIOSkywalkFamily\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to disclose kernel memory\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-39877: Richard Zana, Dhiyanesh Selvaraj (@redroot97)\n\nIOSurfaceAccelerator\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to leak sensitive kernel state\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-64760: Seiji Sakurai (@HeapSmasher), Franco Belman at Blackwing\nIntelligence, an anonymous researcher\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64749: hxr1, Hiroki Imai (LAC Co., Ltd.), Billy Jheng Bing\nJhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ashish\nKunwar\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to disclose kernel memory\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-64744: Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43778: Ashish Kunwar, f0r of MurphySec, Mahmoud Abdelmoniem,\nFeng Xue and XGPT of ThreatBook, Wang Yu, Nicolas Rabrenovic, Lyutoon,\nHiroki Imai (LAC Co., Ltd.), F\u00e1bio Lu\u00eds @scanpt, DARKNAVY\n(@DarkNavyOrg), an anonymous researcher\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote attacker may be able to bypass network filters\nDescription: An inconsistent user interface issue was addressed with\nimproved state management.\nCVE-2026-64735: Gor Aleksanyan\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43822: Michal Kosiorek, Eddy Tsalolikhin\nCVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\nCVE-2026-64700: Asjid Kalam (@odinshell)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR L"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:11:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/38"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/38"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/148287"
        },
        {
          "url": "https://www.apple.com/itunes/"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/38"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0033",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/38",
            "automated": true,
            "contentSha256": "4f94a9072b82830135f0c238c7ec5b4f85054d563fda541bcdc667d3f5f62d48",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/38",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-17T22:00:58Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-09T10:11:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0033"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0285

Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-09 10:11
VLAI
Title
APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10
Summary
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10 iOS 18.7.10 and iPadOS 18.7.10 addresses the following issues. Information about the security content is also available at https://support.apple.com/148287. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accessibility Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An attacker with physical access may be able to access sensitive user data during iPhone Mirroring Description: This issue was addressed through improved state management. CVE-2026-64732: Jorge Welch (@jorgwelch) AirDrop Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An attacker in a privileged network position may be able to cause a denial-of-service Description: A reachable assertion was addressed with improved input validation. CVE-2026-43667: Arash Ale Ebrahim from SCy-Phy research group of CISPA Helmholtz Center for Information Security APFS Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64695: Narendra Singh (@_3P1C), Peter Malone App Store Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved checks. CVE-2026-43801: Rahul Raj AppleDouble Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-43776: Peter Malone, Nicolas Rabrenovic, Irvin Wang Audio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/) AVEVideoEncoder Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to execute arbitrary code with kernel privileges Description: A buffer overflow was addressed with improved size validation. CVE-2026-64747: Franco Belman at Blackwing Intelligence AVEVideoEncoder Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun BackgroundAssets Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to delete files for which it does not have permission Description: A permissions issue was addressed with improved validation. CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab Books Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to modify protected parts of the file system Description: A race condition was addressed with improved checks. CVE-2026-43811: Rodolphe Brunetti (@eisw0lf) of Lupus Nova Contacts Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to add contacts without user authorization Description: An authorization issue was addressed with improved validation. CVE-2026-64746: Rodolphe Brunetti (@eisw0lf) of Lupus Nova, Daniel Febrero Contacts Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted contact may leak sensitive data Description: The issue was addressed with improved checks. CVE-2026-64734: Daniel Williams Contacts Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to access information about a user's contacts Description: This issue was addressed with improved checks. CVE-2026-43797: Arni Hardarson (Neonix Security) CoreAudio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted audio file may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative CoreAudio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43744: ret2happy, Mathis Mansière, an anonymous researcher CoreAudio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A remote attacker may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43803: Rahul Raj CoreMedia Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: A memory corruption issue was addressed with improved memory handling. CVE-2026-43711: James Duffy (@0x4A616D657344) CoreUI Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted asset catalog may result in disclosure of process memory Description: The issue was addressed with improved memory handling. CVE-2026-43738: Peter Malone CoreVideo Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43802: an anonymous researcher curl Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Authentication credentials may be sent to a server on another origin Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2026-3784 CVE-2026-3783 Foundation Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A malicious app may be able to access protected user data Description: The issue was addressed with improved input sanitization. CVE-2026-43714: an anonymous researcher FrontBoard Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to access sensitive user data Description: This issue was addressed by using HTTPS when sending information over the network. CVE-2026-64742: Huỳnh Tấn Ngàn Game Center Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A malicious app may be able to break out of its sandbox Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-64740: Manuel Fernandez (Stackhopper Security) Game Center Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to read a persistent device identifier Description: This issue was addressed with improved data protection. CVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive Technologies Heimdal Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64692: Redon Gashi ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-64716: Peter Malone, Jonathan Alush-Aben, Arni Hardarson CVE-2026-28990: Jiri Ha, Arni Hardarson ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may corrupt process memory Description: A buffer overflow issue was addressed with improved memory handling. CVE-2026-43661: Gandalf4a of PKU-ICODE, Anton Pakhunov, an anonymous researcher ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An integer overflow was addressed with improved input validation. CVE-2026-43818: an anonymous researcher ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may lead to a denial-of-service Description: A type confusion issue was addressed with improved checks. CVE-2026-64693: Geonha Lee (@leegn4a) IOSkywalkFamily Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to disclose kernel memory Description: A memory corruption issue was addressed with improved memory handling. CVE-2026-39877: Richard Zana, Dhiyanesh Selvaraj (@redroot97) IOSurfaceAccelerator Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to leak sensitive kernel state Description: An information leakage was addressed with additional validation. CVE-2026-64760: Seiji Sakurai (@HeapSmasher), Franco Belman at Blackwing Intelligence, an anonymous researcher Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64749: hxr1, Hiroki Imai (LAC Co., Ltd.), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ashish Kunwar Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to disclose kernel memory Description: An information leakage was addressed with additional validation. CVE-2026-64744: Ryan Hileman via Xint Code (xint.io) Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2026-43778: Ashish Kunwar, f0r of MurphySec, Mahmoud Abdelmoniem, Feng Xue and XGPT of ThreatBook, Wang Yu, Nicolas Rabrenovic, Lyutoon, Hiroki Imai (LAC Co., Ltd.), Fábio Luís @scanpt, DARKNAVY (@DarkNavyOrg), an anonymous researcher Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A remote attacker may be able to bypass network filters Description: An inconsistent user interface issue was addressed with improved state management. CVE-2026-64735: Gor Aleksanyan Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-43822: Michal Kosiorek, Eddy Tsalolikhin CVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. CVE-2026-64700: Asjid Kalam (@odinshell) Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination or write kernel memory Description: The issue was addressed with improved input sanitization. CVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel) Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: An integer overflow was addressed with improved input validation. CVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR L
Severity
No CVSS data available.
Assigner
References
Impacted products
Credits
Apple Product Security via Fulldisclosure
Relationships
reference GCVE-1988-2026-0285 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "APPLE-SA-08-17-2026-2 iOS",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10\n\niOS 18.7.10 and iPadOS 18.7.10 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/148287.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccessibility\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An attacker with physical access may be able to access sensitive\nuser data during iPhone Mirroring\nDescription: This issue was addressed through improved state management.\nCVE-2026-64732: Jorge Welch (@jorgwelch)\n\nAirDrop\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An attacker in a privileged network position may be able to\ncause a denial-of-service\nDescription: A reachable assertion was addressed with improved input\nvalidation.\nCVE-2026-43667: Arash Ale Ebrahim from SCy-Phy research group of CISPA\nHelmholtz Center for Information Security\n\nAPFS\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote user may be able to cause unexpected system termination\nor corrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64695: Narendra Singh (@_3P1C), Peter Malone\n\nApp Store\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved checks.\nCVE-2026-43801: Rahul Raj\n\nAppleDouble\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination or arbitrary code execution\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-43776: Peter Malone, Nicolas Rabrenovic, Irvin Wang\n\nAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\nAVEVideoEncoder\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges\nDescription: A buffer overflow was addressed with improved size\nvalidation.\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\nAVEVideoEncoder\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun\n\nBackgroundAssets\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to delete files for which it does not have\npermission\nDescription: A permissions issue was addressed with improved validation.\nCVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity\u0027s WeBin lab\n\nBooks\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to modify protected parts of the file system\nDescription: A race condition was addressed with improved checks.\nCVE-2026-43811: Rodolphe Brunetti (@eisw0lf) of Lupus Nova\n\nContacts\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to add contacts without user authorization\nDescription: An authorization issue was addressed with improved\nvalidation.\nCVE-2026-64746: Rodolphe Brunetti (@eisw0lf) of Lupus Nova, Daniel\nFebrero\n\nContacts\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted contact may leak sensitive data\nDescription: The issue was addressed with improved checks.\nCVE-2026-64734: Daniel Williams\n\nContacts\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access information about a user\u0027s contacts\nDescription: This issue was addressed with improved checks.\nCVE-2026-43797: Arni Hardarson (Neonix Security)\n\nCoreAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted audio file may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\nCoreAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43744: ret2happy, Mathis Mansi\u00e8re, an anonymous researcher\n\nCoreAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43803: Rahul Raj\n\nCoreMedia\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\nCoreUI\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted asset catalog may result in\ndisclosure of process memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43738: Peter Malone\n\nCoreVideo\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43802: an anonymous researcher\n\ncurl\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Authentication credentials may be sent to a server on another\norigin\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-3784\nCVE-2026-3783\n\nFoundation\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A malicious app may be able to access protected user data\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43714: an anonymous researcher\n\nFrontBoard\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed by using HTTPS when sending\ninformation over the network.\nCVE-2026-64742: Hu\u1ef3nh T\u1ea5n Ng\u00e0n\n\nGame Center\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\nGame Center\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to read a persistent device identifier\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive\nTechnologies\n\nHeimdal\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64692: Redon Gashi\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64716: Peter Malone, Jonathan Alush-Aben, Arni Hardarson\nCVE-2026-28990: Jiri Ha, Arni Hardarson\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: A buffer overflow issue was addressed with improved memory\nhandling.\nCVE-2026-43661: Gandalf4a of PKU-ICODE, Anton Pakhunov, an anonymous\nresearcher\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may lead to arbitrary\ncode execution\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43818: an anonymous researcher\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may lead to a\ndenial-of-service\nDescription: A type confusion issue was addressed with improved checks.\nCVE-2026-64693: Geonha Lee (@leegn4a)\n\nIOSkywalkFamily\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to disclose kernel memory\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-39877: Richard Zana, Dhiyanesh Selvaraj (@redroot97)\n\nIOSurfaceAccelerator\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to leak sensitive kernel state\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-64760: Seiji Sakurai (@HeapSmasher), Franco Belman at Blackwing\nIntelligence, an anonymous researcher\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64749: hxr1, Hiroki Imai (LAC Co., Ltd.), Billy Jheng Bing\nJhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ashish\nKunwar\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to disclose kernel memory\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-64744: Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43778: Ashish Kunwar, f0r of MurphySec, Mahmoud Abdelmoniem,\nFeng Xue and XGPT of ThreatBook, Wang Yu, Nicolas Rabrenovic, Lyutoon,\nHiroki Imai (LAC Co., Ltd.), F\u00e1bio Lu\u00eds @scanpt, DARKNAVY\n(@DarkNavyOrg), an anonymous researcher\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote attacker may be able to bypass network filters\nDescription: An inconsistent user interface issue was addressed with\nimproved state management.\nCVE-2026-64735: Gor Aleksanyan\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43822: Michal Kosiorek, Eddy Tsalolikhin\nCVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\nCVE-2026-64700: Asjid Kalam (@odinshell)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR L"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:11:41Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/42"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/42"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/148287"
        },
        {
          "url": "https://www.apple.com/itunes/"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/42"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-28947",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28958",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28973",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28979",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28984",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28990",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28996",
              "type": "related"
            },
            {
              "destId": "CVE-2026-3783",
              "type": "related"
            },
            {
              "destId": "CVE-2026-3784",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39868",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39872",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39877",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43658",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43661",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43663",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43667",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43673",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43676",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43699",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43700",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43701",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43705",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43708",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43711",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43714",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43717",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43720",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43722",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43723",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43724",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43725",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43726",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43727",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43729",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43731",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43733",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43734",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43735",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43738",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43742",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43744",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43745",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43754",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43757",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43769",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43776",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43778",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43794",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43795",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43796",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43797",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43799",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43800",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43801",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43802",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43803",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43807",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43809",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43810",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43811",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43812",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43818",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43821",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43822",
              "type": "related"
            },
            {
              "destId": "CVE-2026-4424",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64692",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64693",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64695",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64700",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64707",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64709",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64715",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64716",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64719",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64721",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64722",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64723",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64724",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64725",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64726",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64732",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64734",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64735",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64738",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64739",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64740",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64742",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64743",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64744",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64746",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64747",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64749",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64755",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64757",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64760",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64762",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64763",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64764",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64765",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64766",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64768",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64769",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64770",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64771",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64772",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64774",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64778",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64779",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64780",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64781",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64782",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64784",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65331",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65332",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65333",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65334",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65335",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65336",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65337",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65338",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65340",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65341",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0285",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/42",
            "automated": true,
            "contentSha256": "e23ca2444eddcf9fe8571816e5f9871be844a3cf9989741df860b5a103b3a26b",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/42",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-17T22:01:56Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0285"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:45Z",
    "dateUpdated": "2026-09-09T10:11:41Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0285"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0034

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-09 10:11
VLAI
Title
APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10
Summary
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10 iOS 18.7.10 and iPadOS 18.7.10 addresses the following issues. Information about the security content is also available at https://support.apple.com/148287. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accessibility Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An attacker with physical access may be able to access sensitive user data during iPhone Mirroring Description: This issue was addressed through improved state management. CVE-2026-64732: Jorge Welch (@jorgwelch) AirDrop Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An attacker in a privileged network position may be able to cause a denial-of-service Description: A reachable assertion was addressed with improved input validation. CVE-2026-43667: Arash Ale Ebrahim from SCy-Phy research group of CISPA Helmholtz Center for Information Security APFS Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64695: Narendra Singh (@_3P1C), Peter Malone App Store Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved checks. CVE-2026-43801: Rahul Raj AppleDouble Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-43776: Peter Malone, Nicolas Rabrenovic, Irvin Wang Audio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/) AVEVideoEncoder Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to execute arbitrary code with kernel privileges Description: A buffer overflow was addressed with improved size validation. CVE-2026-64747: Franco Belman at Blackwing Intelligence AVEVideoEncoder Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun BackgroundAssets Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to delete files for which it does not have permission Description: A permissions issue was addressed with improved validation. CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab Books Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to modify protected parts of the file system Description: A race condition was addressed with improved checks. CVE-2026-43811: Rodolphe Brunetti (@eisw0lf) of Lupus Nova Contacts Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to add contacts without user authorization Description: An authorization issue was addressed with improved validation. CVE-2026-64746: Rodolphe Brunetti (@eisw0lf) of Lupus Nova, Daniel Febrero Contacts Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted contact may leak sensitive data Description: The issue was addressed with improved checks. CVE-2026-64734: Daniel Williams Contacts Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to access information about a user's contacts Description: This issue was addressed with improved checks. CVE-2026-43797: Arni Hardarson (Neonix Security) CoreAudio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted audio file may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative CoreAudio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43744: ret2happy, Mathis Mansière, an anonymous researcher CoreAudio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A remote attacker may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43803: Rahul Raj CoreMedia Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: A memory corruption issue was addressed with improved memory handling. CVE-2026-43711: James Duffy (@0x4A616D657344) CoreUI Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted asset catalog may result in disclosure of process memory Description: The issue was addressed with improved memory handling. CVE-2026-43738: Peter Malone CoreVideo Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43802: an anonymous researcher curl Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Authentication credentials may be sent to a server on another origin Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2026-3784 CVE-2026-3783 Foundation Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A malicious app may be able to access protected user data Description: The issue was addressed with improved input sanitization. CVE-2026-43714: an anonymous researcher FrontBoard Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to access sensitive user data Description: This issue was addressed by using HTTPS when sending information over the network. CVE-2026-64742: Huỳnh Tấn Ngàn Game Center Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A malicious app may be able to break out of its sandbox Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-64740: Manuel Fernandez (Stackhopper Security) Game Center Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to read a persistent device identifier Description: This issue was addressed with improved data protection. CVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive Technologies Heimdal Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64692: Redon Gashi ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-64716: Peter Malone, Jonathan Alush-Aben, Arni Hardarson CVE-2026-28990: Jiri Ha, Arni Hardarson ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may corrupt process memory Description: A buffer overflow issue was addressed with improved memory handling. CVE-2026-43661: Gandalf4a of PKU-ICODE, Anton Pakhunov, an anonymous researcher ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An integer overflow was addressed with improved input validation. CVE-2026-43818: an anonymous researcher ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may lead to a denial-of-service Description: A type confusion issue was addressed with improved checks. CVE-2026-64693: Geonha Lee (@leegn4a) IOSkywalkFamily Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to disclose kernel memory Description: A memory corruption issue was addressed with improved memory handling. CVE-2026-39877: Richard Zana, Dhiyanesh Selvaraj (@redroot97) IOSurfaceAccelerator Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to leak sensitive kernel state Description: An information leakage was addressed with additional validation. CVE-2026-64760: Seiji Sakurai (@HeapSmasher), Franco Belman at Blackwing Intelligence, an anonymous researcher Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64749: hxr1, Hiroki Imai (LAC Co., Ltd.), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ashish Kunwar Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to disclose kernel memory Description: An information leakage was addressed with additional validation. CVE-2026-64744: Ryan Hileman via Xint Code (xint.io) Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2026-43778: Ashish Kunwar, f0r of MurphySec, Mahmoud Abdelmoniem, Feng Xue and XGPT of ThreatBook, Wang Yu, Nicolas Rabrenovic, Lyutoon, Hiroki Imai (LAC Co., Ltd.), Fábio Luís @scanpt, DARKNAVY (@DarkNavyOrg), an anonymous researcher Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A remote attacker may be able to bypass network filters Description: An inconsistent user interface issue was addressed with improved state management. CVE-2026-64735: Gor Aleksanyan Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-43822: Michal Kosiorek, Eddy Tsalolikhin CVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. CVE-2026-64700: Asjid Kalam (@odinshell) Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination or write kernel memory Description: The issue was addressed with improved input sanitization. CVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel) Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: An integer overflow was addressed with improved input validation. CVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR L
Severity
No CVSS data available.
Assigner
References
Impacted products
Credits
Apple Product Security via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "APPLE-SA-08-17-2026-2 iOS",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10\n\niOS 18.7.10 and iPadOS 18.7.10 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/148287.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccessibility\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An attacker with physical access may be able to access sensitive\nuser data during iPhone Mirroring\nDescription: This issue was addressed through improved state management.\nCVE-2026-64732: Jorge Welch (@jorgwelch)\n\nAirDrop\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An attacker in a privileged network position may be able to\ncause a denial-of-service\nDescription: A reachable assertion was addressed with improved input\nvalidation.\nCVE-2026-43667: Arash Ale Ebrahim from SCy-Phy research group of CISPA\nHelmholtz Center for Information Security\n\nAPFS\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote user may be able to cause unexpected system termination\nor corrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64695: Narendra Singh (@_3P1C), Peter Malone\n\nApp Store\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved checks.\nCVE-2026-43801: Rahul Raj\n\nAppleDouble\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination or arbitrary code execution\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-43776: Peter Malone, Nicolas Rabrenovic, Irvin Wang\n\nAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\nAVEVideoEncoder\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges\nDescription: A buffer overflow was addressed with improved size\nvalidation.\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\nAVEVideoEncoder\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun\n\nBackgroundAssets\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to delete files for which it does not have\npermission\nDescription: A permissions issue was addressed with improved validation.\nCVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity\u0027s WeBin lab\n\nBooks\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to modify protected parts of the file system\nDescription: A race condition was addressed with improved checks.\nCVE-2026-43811: Rodolphe Brunetti (@eisw0lf) of Lupus Nova\n\nContacts\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to add contacts without user authorization\nDescription: An authorization issue was addressed with improved\nvalidation.\nCVE-2026-64746: Rodolphe Brunetti (@eisw0lf) of Lupus Nova, Daniel\nFebrero\n\nContacts\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted contact may leak sensitive data\nDescription: The issue was addressed with improved checks.\nCVE-2026-64734: Daniel Williams\n\nContacts\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access information about a user\u0027s contacts\nDescription: This issue was addressed with improved checks.\nCVE-2026-43797: Arni Hardarson (Neonix Security)\n\nCoreAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted audio file may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\nCoreAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43744: ret2happy, Mathis Mansi\u00e8re, an anonymous researcher\n\nCoreAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43803: Rahul Raj\n\nCoreMedia\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\nCoreUI\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted asset catalog may result in\ndisclosure of process memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43738: Peter Malone\n\nCoreVideo\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43802: an anonymous researcher\n\ncurl\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Authentication credentials may be sent to a server on another\norigin\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-3784\nCVE-2026-3783\n\nFoundation\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A malicious app may be able to access protected user data\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43714: an anonymous researcher\n\nFrontBoard\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed by using HTTPS when sending\ninformation over the network.\nCVE-2026-64742: Hu\u1ef3nh T\u1ea5n Ng\u00e0n\n\nGame Center\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\nGame Center\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to read a persistent device identifier\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive\nTechnologies\n\nHeimdal\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64692: Redon Gashi\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64716: Peter Malone, Jonathan Alush-Aben, Arni Hardarson\nCVE-2026-28990: Jiri Ha, Arni Hardarson\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: A buffer overflow issue was addressed with improved memory\nhandling.\nCVE-2026-43661: Gandalf4a of PKU-ICODE, Anton Pakhunov, an anonymous\nresearcher\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may lead to arbitrary\ncode execution\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43818: an anonymous researcher\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may lead to a\ndenial-of-service\nDescription: A type confusion issue was addressed with improved checks.\nCVE-2026-64693: Geonha Lee (@leegn4a)\n\nIOSkywalkFamily\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to disclose kernel memory\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-39877: Richard Zana, Dhiyanesh Selvaraj (@redroot97)\n\nIOSurfaceAccelerator\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to leak sensitive kernel state\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-64760: Seiji Sakurai (@HeapSmasher), Franco Belman at Blackwing\nIntelligence, an anonymous researcher\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64749: hxr1, Hiroki Imai (LAC Co., Ltd.), Billy Jheng Bing\nJhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ashish\nKunwar\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to disclose kernel memory\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-64744: Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43778: Ashish Kunwar, f0r of MurphySec, Mahmoud Abdelmoniem,\nFeng Xue and XGPT of ThreatBook, Wang Yu, Nicolas Rabrenovic, Lyutoon,\nHiroki Imai (LAC Co., Ltd.), F\u00e1bio Lu\u00eds @scanpt, DARKNAVY\n(@DarkNavyOrg), an anonymous researcher\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote attacker may be able to bypass network filters\nDescription: An inconsistent user interface issue was addressed with\nimproved state management.\nCVE-2026-64735: Gor Aleksanyan\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43822: Michal Kosiorek, Eddy Tsalolikhin\nCVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\nCVE-2026-64700: Asjid Kalam (@odinshell)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR L"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:11:41Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/42"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/42"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/148287"
        },
        {
          "url": "https://www.apple.com/itunes/"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/42"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0034",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/42",
            "automated": true,
            "contentSha256": "e23ca2444eddcf9fe8571816e5f9871be844a3cf9989741df860b5a103b3a26b",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/42",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-17T22:01:56Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-09T10:11:41Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0034"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0036

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-09 10:11
VLAI
Title
CVE-2026-78331 / CVE-2026-78332: Multiple Vulnerabilities in NethServer
Summary
Two stored XSS vulnerabilities have been disclosed in the NethServer WebTop module, affecting versions 1.5.6 and earlier. CVE-2026-78331 (CVSS 4.0: 8.7) affects the calendar component, while CVE-2026-78332 (CVSS 4.0: 8.2) affects the contacts component. Both vulnerabilities allow malicious content to be stored and JavaScript code to be executed when the affected calendar event or contact is viewed by another user. Affected versions: WebTop <= 1.5.6 Fixed version: WebTop 1.5.7 Credits: Vulnerability discovered by Andrea Intilangelo References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-nethserver https://github.com/NethServer/ns8-webtop/security/advisories/GHSA-cqcv-5f3w-wpmr https://github.com/NethServer/ns8-webtop/security/advisories/GHSA-7vf9-f3rc-vg3x _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
Impacted products
Credits
Intilangelo, Andrea
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CVE-2026-78331 / CVE-2026-78332",
          "vendor": "Cve",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Intilangelo, Andrea"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Two stored XSS vulnerabilities have been disclosed in the NethServer WebTop module, affecting versions 1.5.6 and \nearlier.\nCVE-2026-78331 (CVSS 4.0: 8.7) affects the calendar component, while CVE-2026-78332 (CVSS 4.0: 8.2) affects the \ncontacts component.\n\nBoth vulnerabilities allow malicious content to be stored and JavaScript code to be executed when the affected calendar \nevent or contact is viewed by another user.\n\nAffected versions:\nWebTop \u003c= 1.5.6\n\nFixed version:\nWebTop 1.5.7\n\nCredits:\nVulnerability discovered by Andrea Intilangelo\n\nReferences:\n\nhttps://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-nethserver\nhttps://github.com/NethServer/ns8-webtop/security/advisories/GHSA-cqcv-5f3w-wpmr\nhttps://github.com/NethServer/ns8-webtop/security/advisories/GHSA-7vf9-f3rc-vg3x\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:11:36Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/79"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/79"
        },
        {
          "url": "https://github.com/NethServer/ns8-webtop/security/advisories/GHSA-7vf9-f3rc-vg3x"
        },
        {
          "url": "https://github.com/NethServer/ns8-webtop/security/advisories/GHSA-cqcv-5f3w-wpmr"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-nethserver"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/79"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CVE-2026-78331 / CVE-2026-78332: Multiple Vulnerabilities in NethServer",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0036",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/79",
            "automated": true,
            "contentSha256": "e1f55767d3e6df800c47b3094da09062a86c11a0996a33ed8342dd347e1f2a90",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/79",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-24T15:07:24Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-09T10:11:36Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0036"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0037

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-09 10:11
VLAI
Title
[0day-Rubbish] SonicWall SMA 1000 — Pre-Auth Deserialization RCE (CVSS 9.8) via Struts 1 Property Injection and Auth-Filter Rewrite
Summary
Full-Disclosure List, An unauthenticated remote code execution vulnerability chain in SonicWall SMA 1000 series appliances is being disclosed here. The chain yields code execution as the `mgmt-server` user (uid=1011) on the management plane, with no credentials and no prior knowledge of the appliance beyond a reachable address. A full technical writeup with a reproducible proof-of-concept is published at: https://0day-rubbish.com/blog/sonicwall-sma-preauth-deserialization-rce Repository (advisory + PoC): https://github.com/Exploit-Garbage/0day-Rubbish ----------------------------------------------------------------- 1. Summary ----------------------------------------------------------------- A four-stage pre-auth chain combines a Struts 1 property-injection flaw, an in-memory Jetty authentication-filter rewrite, an unauthenticated SSO Primary-Administrator token issuance, and a Java deserialization sink. The result is unauthenticated RCE as `mgmt-server` (uid=1011). CVSS 3.1 base: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vector: network, low complexity, no privileges, no user interaction. ----------------------------------------------------------------- 2. Affected product ----------------------------------------------------------------- Vendor: SonicWall Product: SMA 1000 series (Secure Mobile Access) Firmware: 12.4.x line (verified on a 12.4 build; other 12.x lines may share the Struts 1 / Jetty console stack — not all were independently tested). Component: /Console management plane, Central Management Service (CMS), /configUserCommunityEPC.do ----------------------------------------------------------------- 3. Vulnerability details ----------------------------------------------------------------- Stage 1 — Authentication bypass via Struts 1 property injection Every Struts 1 ActionForm exposes a `multipartRequestHandler` property. By walking the bean graph (`servletContext -> servletHandler -> filterMappings`) an unauthenticated caller can rewrite the Jetty authentication filter's pathSpecs to a non-existent path and force the filter cache to rebuild. The entire `/Console` API and console actions become reachable without authentication. Stage 2 — Enable Central Management Service With `/Console` unauthenticated, Central Management Service (CMS) can be enabled from the console API, preparing the SSO token path. Stage 3 — Unauthenticated SSO Primary Admin token GET /Console/CentralManagement/SSO/Authorize?user=admin&roleUser=Primary+Admin returns a Primary Administrator token without any password. The token is exchanged for a valid JSESSIONID. The attacker is now the Primary Administrator, fully unauthenticated. Stage 4 — Java deserialization RCE The `storedCommunity` field of `/configUserCommunityEPC.do` is consumed by a setter that calls `ObjectInputStream.readObject()` on attacker-controlled input. A `BeanComparator` + `TemplatesImpl` gadget chain is delivered through this field. The command executes as `mgmt-server` (uid=1011). Output is written to the webroot and read back via an anonymous GET. ----------------------------------------------------------------- 4. Impact ----------------------------------------------------------------- - Unauthenticated remote code execution as `mgmt-server`. - Full compromise of the SMA 1000 management plane. - The appliance terminates remote-access VPN sessions; compromise of the management plane can be leveraged to pivot into the protected internal network and to intercept or reset VPN sessions. - No credentials, no user interaction, no prior appliance knowledge beyond a reachable HTTPS address. ----------------------------------------------------------------- 5. Proof of concept ----------------------------------------------------------------- A reproducible PoC is included in the repository under `product/sonicwall/sma-12.4/preauth-deserialization-rce/exploit`. The full chain and reproduction steps are documented in the advisory URL above. The PoC contains no operator-identifying information and targets placeholder hosts. ----------------------------------------------------------------- 6. Disclosure timeline ----------------------------------------------------------------- - 2026-07-26: Technical writeup + PoC published to the project site and repository. - 2026-07-27: This Full-Disclosure submission. Vendor contact: SonicWall PSIRT was notified (cc'd). A coordinated embargo was not requested by the operator prior to publication; this submission is made in parallel with public availability of the writeup. ----------------------------------------------------------------- 7. Credits ----------------------------------------------------------------- Discovered and documented by the 0day-Rubbish independent vulnerability-research project. ----------------------------------------------------------------- 8. References ----------------------------------------------------------------- - Advisory: https://0day-rubbish.com/blog/sonicwall-sma-preauth-deserialization-rce - Repo: https://github.com/Exploit-Garbage/0day-Rubbish -- 0day-Rubbish disclosure () 0day-rubbish com https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
Impacted products
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SonicWall SMA 1000",
          "vendor": "Sonicwall",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Full-Disclosure List,\n\nAn unauthenticated remote code execution vulnerability chain in SonicWall SMA 1000 series appliances is being disclosed \nhere. The chain yields code execution as the `mgmt-server` user (uid=1011) on the management plane, with no credentials \nand no prior knowledge of the appliance beyond a reachable address.\n\nA full technical writeup with a reproducible proof-of-concept is published at:\n\n  https://0day-rubbish.com/blog/sonicwall-sma-preauth-deserialization-rce\n\nRepository (advisory + PoC):\n\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\n-----------------------------------------------------------------\n1. Summary\n-----------------------------------------------------------------\n\nA four-stage pre-auth chain combines a Struts 1 property-injection\nflaw, an in-memory Jetty authentication-filter rewrite, an unauthenticated\nSSO Primary-Administrator token issuance, and a Java deserialization sink.\nThe result is unauthenticated RCE as `mgmt-server` (uid=1011).\n\nCVSS 3.1 base: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)\nVector: network, low complexity, no privileges, no user interaction.\n\n-----------------------------------------------------------------\n2. Affected product\n-----------------------------------------------------------------\n\nVendor:  SonicWall\nProduct: SMA 1000 series (Secure Mobile Access)\nFirmware: 12.4.x line (verified on a 12.4 build; other 12.x lines\n          may share the Struts 1 / Jetty console stack \u2014 not all\n          were independently tested).\nComponent: /Console management plane, Central Management Service (CMS),\n           /configUserCommunityEPC.do\n\n-----------------------------------------------------------------\n3. Vulnerability details\n-----------------------------------------------------------------\n\nStage 1 \u2014 Authentication bypass via Struts 1 property injection\n  Every Struts 1 ActionForm exposes a `multipartRequestHandler`\n  property. By walking the bean graph\n  (`servletContext -\u003e servletHandler -\u003e filterMappings`) an\n  unauthenticated caller can rewrite the Jetty authentication\n  filter\u0027s pathSpecs to a non-existent path and force the filter\n  cache to rebuild. The entire `/Console` API and console actions\n  become reachable without authentication.\n\nStage 2 \u2014 Enable Central Management Service\n  With `/Console` unauthenticated, Central Management Service (CMS)\n  can be enabled from the console API, preparing the SSO token path.\n\nStage 3 \u2014 Unauthenticated SSO Primary Admin token\n  GET /Console/CentralManagement/SSO/Authorize?user=admin\u0026roleUser=Primary+Admin\n  returns a Primary Administrator token without any password. The\n  token is exchanged for a valid JSESSIONID. The attacker is now the\n  Primary Administrator, fully unauthenticated.\n\nStage 4 \u2014 Java deserialization RCE\n  The `storedCommunity` field of `/configUserCommunityEPC.do` is\n  consumed by a setter that calls `ObjectInputStream.readObject()`\n  on attacker-controlled input. A `BeanComparator` + `TemplatesImpl`\n  gadget chain is delivered through this field. The command executes\n  as `mgmt-server` (uid=1011). Output is written to the webroot and\n  read back via an anonymous GET.\n\n-----------------------------------------------------------------\n4. Impact\n-----------------------------------------------------------------\n\n- Unauthenticated remote code execution as `mgmt-server`.\n- Full compromise of the SMA 1000 management plane.\n- The appliance terminates remote-access VPN sessions; compromise\n  of the management plane can be leveraged to pivot into the\n  protected internal network and to intercept or reset VPN sessions.\n- No credentials, no user interaction, no prior appliance knowledge\n  beyond a reachable HTTPS address.\n\n-----------------------------------------------------------------\n5. Proof of concept\n-----------------------------------------------------------------\n\nA reproducible PoC is included in the repository under\n`product/sonicwall/sma-12.4/preauth-deserialization-rce/exploit`.\nThe full chain and reproduction steps are documented in the advisory\nURL above. The PoC contains no operator-identifying information and\ntargets placeholder hosts.\n\n-----------------------------------------------------------------\n6. Disclosure timeline\n-----------------------------------------------------------------\n\n- 2026-07-26: Technical writeup + PoC published to the project\n              site and repository.\n- 2026-07-27: This Full-Disclosure submission.\n\nVendor contact: SonicWall PSIRT was notified (cc\u0027d). A coordinated\nembargo was not requested by the operator prior to publication; this\nsubmission is made in parallel with public availability of the\nwriteup.\n\n-----------------------------------------------------------------\n7. Credits\n-----------------------------------------------------------------\n\nDiscovered and documented by the 0day-Rubbish independent\nvulnerability-research project.\n\n-----------------------------------------------------------------\n8. References\n-----------------------------------------------------------------\n\n- Advisory: https://0day-rubbish.com/blog/sonicwall-sma-preauth-deserialization-rce\n- Repo:     https://github.com/Exploit-Garbage/0day-Rubbish\n\n--\n0day-Rubbish\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:11:28Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/2"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/2"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/sonicwall-sma-preauth-deserialization-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/2"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-Rubbish] SonicWall SMA 1000 \u2014 Pre-Auth Deserialization RCE (CVSS 9.8) via Struts 1 Property Injection and Auth-Filter Rewrite",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0037",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/2",
            "automated": true,
            "contentSha256": "78588e06d62af725c03928b8b4da89488c10191a6628c7abfa57534c7dde9d20",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/2",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-27T03:58:55Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-09T10:11:28Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0037"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0281

Vulnerability from gna-1988 – Published: 2026-09-08 11:24 – Updated: 2026-09-09 10:11
VLAI
Title
APPLE-SA-07-27-2026-1 iOS 26.6 and iPadOS 26.6
Summary
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-07-27-2026-1 iOS 26.6 and iPadOS 26.6 iOS 26.6 and iPadOS 26.6 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/128066. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accessibility Available for: iPhone 11 and later Impact: An attacker with physical access may be able to access sensitive user data during iPhone Mirroring Description: This issue was addressed through improved state management. CVE-2026-64732: Jorge Welch (@jorgwelch) Accounts Framework Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to fingerprint the user Description: This issue was addressed with improved data protection. CVE-2026-64733: Rosyna Keller of Totally Not Malicious Software (paradisefacade.com) App Store Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved checks. CVE-2026-43801: Rahul Raj Apple Neural Engine Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-28928: Dun AppleDouble Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-43776: Irvin Wang, Peter Malone, Nicolas Rabrenovic Audio Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/) AuthKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to fingerprint the user Description: A permissions issue was addressed with additional restrictions. CVE-2026-43730: David Strnadel AVEVideoEncoder Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to execute arbitrary code with kernel privileges Description: A buffer overflow was addressed with improved size validation. CVE-2026-64747: Franco Belman at Blackwing Intelligence BackgroundAssets Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to delete files for which it does not have permission Description: A permissions issue was addressed with improved validation. CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab Books Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to modify protected parts of the file system Description: A race condition was addressed with improved checks. CVE-2026-43811: Rodolphe Brunetti (@eisw0lf) of Lupus Nova CloudAttestation Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: A maliciously crafted app may be able to bypass code signing enforcement Description: A validation issue was addressed with improved input sanitization. CVE-2026-43813: Anton Pakhunov Contacts Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to add contacts without user authorization Description: An authorization issue was addressed with improved validation. CVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel Febrero Contacts Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing a maliciously crafted contact may leak sensitive data Description: The issue was addressed with improved checks. CVE-2026-64734: Daniel Williams Contacts Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to access information about a user's contacts Description: This issue was addressed with improved checks. CVE-2026-43797: Arni Hardarson (Neonix Security) CoreAudio Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing a maliciously crafted audio file may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative CoreAudio Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43744: Mathis Mansière, an anonymous researcher CoreAudio Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: A remote attacker may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43803: Rahul Raj CoreMedia Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: A memory corruption issue was addressed with improved memory handling. CVE-2026-43711: James Duffy (@0x4A616D657344) curl Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Authentication credentials may be sent to a server on another origin Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2026-3784 CVE-2026-3783 DriverKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An attacker with physical access to a locked device may be able to view sensitive user information Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-43753: Niels Hofmans Foundation Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: A malicious app may be able to access protected user data Description: The issue was addressed with improved input sanitization. CVE-2026-43714: an anonymous researcher FrontBoard Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to access sensitive user data Description: This issue was addressed by using HTTPS when sending information over the network. CVE-2026-64742: Huỳnh Tấn Ngàn Game Center Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: A malicious app may be able to break out of its sandbox Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-64740: Manuel Fernandez (Stackhopper Security) Game Center Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved data protection. CVE-2026-43796: Ilya Andr (andrd3v) of Positive Technologies, Stanislav Jelezoglo Heimdal Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64692: Redon Gashi ImageIO Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing a maliciously crafted texture may lead to unexpected app termination Description: An integer overflow was addressed with improved input validation. CVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative ImageIO Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini
Severity
No CVSS data available.
Assigner
References
Impacted products
Credits
Apple Product Security via Fulldisclosure
Relationships
reference GCVE-1988-2026-0281 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "APPLE-SA-07-27-2026-1 iOS",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-07-27-2026-1 iOS 26.6 and iPadOS 26.6\n\niOS 26.6 and iPadOS 26.6 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/128066.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccessibility\nAvailable for: iPhone 11 and later\nImpact: An attacker with physical access may be able to access sensitive\nuser data during iPhone Mirroring\nDescription: This issue was addressed through improved state management.\nCVE-2026-64732: Jorge Welch (@jorgwelch)\n\nAccounts Framework\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to fingerprint the user\nDescription: This issue was addressed with improved data protection.\nCVE-2026-64733: Rosyna Keller of Totally Not Malicious Software\n(paradisefacade.com)\n\nApp Store\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved checks.\nCVE-2026-43801: Rahul Raj\n\nApple Neural Engine\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28928: Dun\n\nAppleDouble\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination or arbitrary code execution\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-43776: Irvin Wang, Peter Malone, Nicolas Rabrenovic\n\nAudio\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\nAuthKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to fingerprint the user\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-43730: David Strnadel\n\nAVEVideoEncoder\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges\nDescription: A buffer overflow was addressed with improved size\nvalidation.\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\nBackgroundAssets\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to delete files for which it does not have\npermission\nDescription: A permissions issue was addressed with improved validation.\nCVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity\u0027s WeBin lab\n\nBooks\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to modify protected parts of the file system\nDescription: A race condition was addressed with improved checks.\nCVE-2026-43811: Rodolphe Brunetti (@eisw0lf) of Lupus Nova\n\nCloudAttestation\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A maliciously crafted app may be able to bypass code signing\nenforcement\nDescription: A validation issue was addressed with improved input\nsanitization.\nCVE-2026-43813: Anton Pakhunov\n\nContacts\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to add contacts without user authorization\nDescription: An authorization issue was addressed with improved\nvalidation.\nCVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel\nFebrero\n\nContacts\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing a maliciously crafted contact may leak sensitive data\nDescription: The issue was addressed with improved checks.\nCVE-2026-64734: Daniel Williams\n\nContacts\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to access information about a user\u0027s contacts\nDescription: This issue was addressed with improved checks.\nCVE-2026-43797: Arni Hardarson (Neonix Security)\n\nCoreAudio\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing a maliciously crafted audio file may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\nCoreAudio\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43744: Mathis Mansi\u00e8re, an anonymous researcher\n\nCoreAudio\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43803: Rahul Raj\n\nCoreMedia\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\ncurl\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Authentication credentials may be sent to a server on another\norigin\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-3784\nCVE-2026-3783\n\nDriverKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An attacker with physical access to a locked device may be able\nto view sensitive user information\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43753: Niels Hofmans\n\nFoundation\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A malicious app may be able to access protected user data\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43714: an anonymous researcher\n\nFrontBoard\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed by using HTTPS when sending\ninformation over the network.\nCVE-2026-64742: Hu\u1ef3nh T\u1ea5n Ng\u00e0n\n\nGame Center\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\nGame Center\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43796: Ilya Andr (andrd3v) of Positive Technologies, Stanislav\nJelezoglo\n\nHeimdal\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64692: Redon Gashi\n\nImageIO\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing a maliciously crafted texture may lead to unexpected\napp termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day\nInitiative\n\nImageIO\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:11:26Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/16"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/16"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/en-us/128066"
        },
        {
          "url": "https://www.apple.com/itunes/"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/16"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-07-27-2026-1 iOS 26.6 and iPadOS 26.6",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-28928",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28931",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28973",
              "type": "related"
            },
            {
              "destId": "CVE-2026-3783",
              "type": "related"
            },
            {
              "destId": "CVE-2026-3784",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43673",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43711",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43714",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43723",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43729",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43730",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43733",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43739",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43740",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43744",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43753",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43769",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43776",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43778",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43780",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43796",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43797",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43799",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43800",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43801",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43803",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43804",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43805",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43810",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43811",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43812",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43813",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43814",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43816",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43817",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43818",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43821",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43822",
              "type": "related"
            },
            {
              "destId": "CVE-2026-4424",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64692",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64693",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64700",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64707",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64709",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64711",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64713",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64716",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64718",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64719",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64720",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64721",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64722",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64724",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64725",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64726",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64728",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64729",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64730",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64732",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64733",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64734",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64735",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64739",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64740",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64741",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64742",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64743",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64746",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64747",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64749",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64751",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64754",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64755",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64757",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64758",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64763",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64764",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64765",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64766",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64768",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64769",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64770",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64771",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64772",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64774",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64775",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64783",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0281",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/16",
            "automated": true,
            "contentSha256": "14583bf0d28100cd329b90429d3b3cdb637337829fbe0cf0ee93b5a23b8d39f9",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/16",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-28T00:19:40Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0281"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:24:56Z",
    "dateUpdated": "2026-09-09T10:11:26Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0281"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
displaying 261 - 270 publications in total 387