Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "APPLE-SA-02-11-2026-7 watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-02-11-2026-7 watchOS 26.3\n\nwatchOS 26.3 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/126352.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nBluetooth\nAvailable for: Apple Watch Series 6 and later\nImpact: An attacker in a privileged network position may be able to\nperform denial-of-service attack using crafted Bluetooth packets\nDescription: A denial-of-service issue was addressed with improved\nvalidation.\nCVE-2026-20650: jioundai\n\nCoreAudio\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted media file may lead to\nunexpected app termination or corrupt process memory\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-20611: Anonymous working with Trend Micro Zero Day Initiative\n\nCoreMedia\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted file may lead to a denial-of-\nservice or potentially disclose memory contents\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-20609: Yi\u011fit Can YILMAZ (@yilmazcanyigit)\n\nCoreServices\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to gain root privileges\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-20617: Gergely Kalman (@gergely_kalman), Csaba Fitzl\n(@theevilbit) of Iru\n\nCoreServices\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to access sensitive user data\nDescription: An issue existed in the handling of environment variables.\nThis issue was addressed with improved validation.\nCVE-2026-20627: an anonymous researcher\n\ndyld\nAvailable for: Apple Watch Series 6 and later\nImpact: An attacker with memory write capability may be able to execute\narbitrary code. Apple is aware of a report that this issue may have been\nexploited in an extremely sophisticated attack against specific targeted\nindividuals on versions of iOS before iOS 26. CVE-2025-14174 and\nCVE-2025-43529 were also issued in response to this report.\nDescription: A memory corruption issue was addressed with improved state\nmanagement.\nCVE-2026-20700: Google Threat Analysis Group\n\nGame Center\nAvailable for: Apple Watch Series 6 and later\nImpact: A user may be able to view sensitive user information\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-20649: Asaf Cohen\n\nImageIO\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted image may lead to disclosure of\nuser information\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-20675: George Karchemsky (@gkarchemsky) working with Trend\nMicro Zero Day Initiative\n\nImageIO\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted image may result in disclosure\nof process memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-20634: George Karchemsky (@gkarchemsky) working with Trend\nMicro Zero Day Initiative\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-20654: Jian Lee (@speedyfriend433)\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An attacker in a privileged network position may be able to\nintercept network traffic\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-20671: Xin\u0027an Zhou, Juefei Pu, Zhutian Liu, Zhiyun Qian,\nZhaowei Tan, Srikanth V. Krishnamurthy, Mathy Vanhoef\n\nlibexpat\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted file may lead to a denial-of-\nservice\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2025-59375\n\nlibxpc\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to break out of its sandbox\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-20667: an anonymous researcher\n\nSandbox\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to break out of its sandbox\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-20628: Noah Gregory (wts.dev)\n\nStoreKit\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to identify what other apps a user has\ninstalled\nDescription: A privacy issue was addressed with improved checks.\nCVE-2026-20641: Gongyu Ma (@Mezone0)\n\nWebKit\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 304661\nCVE-2026-20635: EntryHi\n\nAdditional recognition\n\nBluetooth\nWe would like to acknowledge Tommaso Sacchetti for their assistance.\n\nKernel\nWe would like to acknowledge Joseph Ravichandran (@0xjprx) of MIT CSAIL,\nXinru Chi of Pangu Lab for their assistance.\n\nlibpthread\nWe would like to acknowledge Fabiano Anemone for their assistance.\n\nNetworkExtension\nWe would like to acknowledge Gongyu Ma (@Mezone0) for their assistance.\n\nTransparency\nWe would like to acknowledge Wojciech Regula of SecuRing\n(wojciechregula.blog) for their assistance.\n\nWallet\nWe would like to acknowledge Lorenzo Santina (@BigNerd95) and Marco\nBartoli (@wsxarcher) for their assistance.\n\nWebKit\nWe would like to acknowledge EntryHi, Luigino Camastra of Aisle\nResearch, Stanislav Fort of Aisle Research, Vsevolod Kokorin (Slonser)\nof Solidlab and Jorian Woltjer for their assistance.\n\nInstructions on how to update your Apple Watch software are\navailable at https://support.apple.com/kb/HT204641\n\nTo check the version on your Apple Watch, open the Apple Watch app\non your iPhone and select \"My Watch \u003e General \u003e About\".\n\nAlternatively, on your watch, select \"My Watch \u003e General \u003e About\".\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmmND5UACgkQ4Ifiq8DH\n7PXrTA//V0gBF+jsdvuwEBOSi+t1slOUCpE0Q9m75aW2n5eoxxyR6JWAZrMbjmqY\nU28crzng8tvqWukyKgenhqt9pqgoieGLSmIdk+jd9hTI3NeM0LYTuqEQ8vwFIzaz\nurPLMWEy5c2YdMHzvJvlaAWyTTVAUU5A4BCKUPeMKQu+o0MIaqesXCu43RTG5Z3M\npe8uChvt29jMqXQDZN7HY5LJWz11jyzilV3on5ErU5xeKCb3BFhjnXbn0OHLWpsM\nf7nZ7o9t7XBQkwgp3TB7/FkXuJT+gqp6XUdHB2NTmTEa1pDKu/Oy8+0YCPYmZWTZ\nmVk/wsWwCPYEKBh9GpnFHbnuAs44qo2MvyYutEEbsm4PUqvYHGvy4Hi9l/pBVpB5\ngveXlBa0WA/XD3UTZ64SPIOGrOE+o2Ik+EEQPDVgLNJpRfXmvojkxo/NfE3+LO7Q\nh8NxBHCnFeVx1qz6NdN4ofC3Kj9QrEfyj2wv6swGKp7v2ZMlxhNmm+3TzJThuOx7\nRjKG4SS0vja/7OMOBJdUginwMvdFHIvP4up7xvElloRqv9pu38EudRUANxFxT0Sf\nm/P7BkWPECzf0J+PXLjWNU0X9qXHtLhLIw7rEJNm4nRuFy8aDeUADxra9D44vwvi\n+bNcwY1uwKDVO/96dJ9dVuJrhrZsye3a4bG41BHhYN2xO4Tzaso=\n=79rN\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:07:40Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/27"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/27"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/126352"
        },
        {
          "url": "https://support.apple.com/kb/HT204641"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/27"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-02-11-2026-7 watchOS 26.3",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-14174",
              "type": "related"
            },
            {
              "destId": "CVE-2025-43529",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59375",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20609",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20611",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20617",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20627",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20628",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20634",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20635",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20641",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20649",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20650",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20654",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20667",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20671",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20675",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20700",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0222",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/27",
            "automated": true,
            "contentSha256": "227c1818c27e99b539ac2e6040fd7f1ebfb51a257db3ac2caa8be3a295bfdee3",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/27",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-12T00:05:58Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0222"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:43Z",
    "dateUpdated": "2026-09-09T10:07:40Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0222"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}