GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Search

Find a vulnerability

Search criteria

    4 vulnerabilities found for APPLE-SA-08-17-2026-2 iOS by Apple

    GCVE-1988-2026-0285

    Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-09 10:11
    VLAI
    Title
    APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10 iOS 18.7.10 and iPadOS 18.7.10 addresses the following issues. Information about the security content is also available at https://support.apple.com/148287. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accessibility Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An attacker with physical access may be able to access sensitive user data during iPhone Mirroring Description: This issue was addressed through improved state management. CVE-2026-64732: Jorge Welch (@jorgwelch) AirDrop Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An attacker in a privileged network position may be able to cause a denial-of-service Description: A reachable assertion was addressed with improved input validation. CVE-2026-43667: Arash Ale Ebrahim from SCy-Phy research group of CISPA Helmholtz Center for Information Security APFS Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64695: Narendra Singh (@_3P1C), Peter Malone App Store Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved checks. CVE-2026-43801: Rahul Raj AppleDouble Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-43776: Peter Malone, Nicolas Rabrenovic, Irvin Wang Audio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/) AVEVideoEncoder Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to execute arbitrary code with kernel privileges Description: A buffer overflow was addressed with improved size validation. CVE-2026-64747: Franco Belman at Blackwing Intelligence AVEVideoEncoder Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun BackgroundAssets Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to delete files for which it does not have permission Description: A permissions issue was addressed with improved validation. CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab Books Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to modify protected parts of the file system Description: A race condition was addressed with improved checks. CVE-2026-43811: Rodolphe Brunetti (@eisw0lf) of Lupus Nova Contacts Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to add contacts without user authorization Description: An authorization issue was addressed with improved validation. CVE-2026-64746: Rodolphe Brunetti (@eisw0lf) of Lupus Nova, Daniel Febrero Contacts Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted contact may leak sensitive data Description: The issue was addressed with improved checks. CVE-2026-64734: Daniel Williams Contacts Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to access information about a user's contacts Description: This issue was addressed with improved checks. CVE-2026-43797: Arni Hardarson (Neonix Security) CoreAudio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted audio file may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative CoreAudio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43744: ret2happy, Mathis Mansière, an anonymous researcher CoreAudio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A remote attacker may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43803: Rahul Raj CoreMedia Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: A memory corruption issue was addressed with improved memory handling. CVE-2026-43711: James Duffy (@0x4A616D657344) CoreUI Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted asset catalog may result in disclosure of process memory Description: The issue was addressed with improved memory handling. CVE-2026-43738: Peter Malone CoreVideo Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43802: an anonymous researcher curl Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Authentication credentials may be sent to a server on another origin Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2026-3784 CVE-2026-3783 Foundation Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A malicious app may be able to access protected user data Description: The issue was addressed with improved input sanitization. CVE-2026-43714: an anonymous researcher FrontBoard Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to access sensitive user data Description: This issue was addressed by using HTTPS when sending information over the network. CVE-2026-64742: Huỳnh Tấn Ngàn Game Center Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A malicious app may be able to break out of its sandbox Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-64740: Manuel Fernandez (Stackhopper Security) Game Center Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to read a persistent device identifier Description: This issue was addressed with improved data protection. CVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive Technologies Heimdal Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64692: Redon Gashi ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-64716: Peter Malone, Jonathan Alush-Aben, Arni Hardarson CVE-2026-28990: Jiri Ha, Arni Hardarson ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may corrupt process memory Description: A buffer overflow issue was addressed with improved memory handling. CVE-2026-43661: Gandalf4a of PKU-ICODE, Anton Pakhunov, an anonymous researcher ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An integer overflow was addressed with improved input validation. CVE-2026-43818: an anonymous researcher ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may lead to a denial-of-service Description: A type confusion issue was addressed with improved checks. CVE-2026-64693: Geonha Lee (@leegn4a) IOSkywalkFamily Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to disclose kernel memory Description: A memory corruption issue was addressed with improved memory handling. CVE-2026-39877: Richard Zana, Dhiyanesh Selvaraj (@redroot97) IOSurfaceAccelerator Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to leak sensitive kernel state Description: An information leakage was addressed with additional validation. CVE-2026-64760: Seiji Sakurai (@HeapSmasher), Franco Belman at Blackwing Intelligence, an anonymous researcher Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64749: hxr1, Hiroki Imai (LAC Co., Ltd.), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ashish Kunwar Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to disclose kernel memory Description: An information leakage was addressed with additional validation. CVE-2026-64744: Ryan Hileman via Xint Code (xint.io) Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2026-43778: Ashish Kunwar, f0r of MurphySec, Mahmoud Abdelmoniem, Feng Xue and XGPT of ThreatBook, Wang Yu, Nicolas Rabrenovic, Lyutoon, Hiroki Imai (LAC Co., Ltd.), Fábio Luís @scanpt, DARKNAVY (@DarkNavyOrg), an anonymous researcher Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A remote attacker may be able to bypass network filters Description: An inconsistent user interface issue was addressed with improved state management. CVE-2026-64735: Gor Aleksanyan Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-43822: Michal Kosiorek, Eddy Tsalolikhin CVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. CVE-2026-64700: Asjid Kalam (@odinshell) Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination or write kernel memory Description: The issue was addressed with improved input sanitization. CVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel) Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: An integer overflow was addressed with improved input validation. CVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR L
    Severity
    No CVSS data available.
    Impacted products
    Relationships
    reference GCVE-1988-2026-0285 (this record)

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "product": "APPLE-SA-08-17-2026-2 iOS",
              "vendor": "Apple",
              "versions": [
                {
                  "status": "affected",
                  "version": "unknown"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Apple Product Security via Fulldisclosure"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10\n\niOS 18.7.10 and iPadOS 18.7.10 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/148287.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccessibility\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An attacker with physical access may be able to access sensitive\nuser data during iPhone Mirroring\nDescription: This issue was addressed through improved state management.\nCVE-2026-64732: Jorge Welch (@jorgwelch)\n\nAirDrop\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An attacker in a privileged network position may be able to\ncause a denial-of-service\nDescription: A reachable assertion was addressed with improved input\nvalidation.\nCVE-2026-43667: Arash Ale Ebrahim from SCy-Phy research group of CISPA\nHelmholtz Center for Information Security\n\nAPFS\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote user may be able to cause unexpected system termination\nor corrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64695: Narendra Singh (@_3P1C), Peter Malone\n\nApp Store\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved checks.\nCVE-2026-43801: Rahul Raj\n\nAppleDouble\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination or arbitrary code execution\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-43776: Peter Malone, Nicolas Rabrenovic, Irvin Wang\n\nAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\nAVEVideoEncoder\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges\nDescription: A buffer overflow was addressed with improved size\nvalidation.\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\nAVEVideoEncoder\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun\n\nBackgroundAssets\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to delete files for which it does not have\npermission\nDescription: A permissions issue was addressed with improved validation.\nCVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity\u0027s WeBin lab\n\nBooks\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to modify protected parts of the file system\nDescription: A race condition was addressed with improved checks.\nCVE-2026-43811: Rodolphe Brunetti (@eisw0lf) of Lupus Nova\n\nContacts\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to add contacts without user authorization\nDescription: An authorization issue was addressed with improved\nvalidation.\nCVE-2026-64746: Rodolphe Brunetti (@eisw0lf) of Lupus Nova, Daniel\nFebrero\n\nContacts\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted contact may leak sensitive data\nDescription: The issue was addressed with improved checks.\nCVE-2026-64734: Daniel Williams\n\nContacts\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access information about a user\u0027s contacts\nDescription: This issue was addressed with improved checks.\nCVE-2026-43797: Arni Hardarson (Neonix Security)\n\nCoreAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted audio file may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\nCoreAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43744: ret2happy, Mathis Mansi\u00e8re, an anonymous researcher\n\nCoreAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43803: Rahul Raj\n\nCoreMedia\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\nCoreUI\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted asset catalog may result in\ndisclosure of process memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43738: Peter Malone\n\nCoreVideo\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43802: an anonymous researcher\n\ncurl\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Authentication credentials may be sent to a server on another\norigin\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-3784\nCVE-2026-3783\n\nFoundation\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A malicious app may be able to access protected user data\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43714: an anonymous researcher\n\nFrontBoard\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed by using HTTPS when sending\ninformation over the network.\nCVE-2026-64742: Hu\u1ef3nh T\u1ea5n Ng\u00e0n\n\nGame Center\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\nGame Center\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to read a persistent device identifier\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive\nTechnologies\n\nHeimdal\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64692: Redon Gashi\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64716: Peter Malone, Jonathan Alush-Aben, Arni Hardarson\nCVE-2026-28990: Jiri Ha, Arni Hardarson\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: A buffer overflow issue was addressed with improved memory\nhandling.\nCVE-2026-43661: Gandalf4a of PKU-ICODE, Anton Pakhunov, an anonymous\nresearcher\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may lead to arbitrary\ncode execution\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43818: an anonymous researcher\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may lead to a\ndenial-of-service\nDescription: A type confusion issue was addressed with improved checks.\nCVE-2026-64693: Geonha Lee (@leegn4a)\n\nIOSkywalkFamily\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to disclose kernel memory\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-39877: Richard Zana, Dhiyanesh Selvaraj (@redroot97)\n\nIOSurfaceAccelerator\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to leak sensitive kernel state\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-64760: Seiji Sakurai (@HeapSmasher), Franco Belman at Blackwing\nIntelligence, an anonymous researcher\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64749: hxr1, Hiroki Imai (LAC Co., Ltd.), Billy Jheng Bing\nJhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ashish\nKunwar\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to disclose kernel memory\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-64744: Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43778: Ashish Kunwar, f0r of MurphySec, Mahmoud Abdelmoniem,\nFeng Xue and XGPT of ThreatBook, Wang Yu, Nicolas Rabrenovic, Lyutoon,\nHiroki Imai (LAC Co., Ltd.), F\u00e1bio Lu\u00eds @scanpt, DARKNAVY\n(@DarkNavyOrg), an anonymous researcher\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote attacker may be able to bypass network filters\nDescription: An inconsistent user interface issue was addressed with\nimproved state management.\nCVE-2026-64735: Gor Aleksanyan\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43822: Michal Kosiorek, Eddy Tsalolikhin\nCVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\nCVE-2026-64700: Asjid Kalam (@odinshell)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR L"
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-09T10:11:41Z",
            "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
            "shortName": "VULNARCHIVE"
          },
          "references": [
            {
              "tags": [
                "technical-description"
              ],
              "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/42"
            },
            {
              "tags": [
                "technical-description"
              ],
              "url": "https://seclists.org/fulldisclosure/2026/Aug/42"
            },
            {
              "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
            },
            {
              "url": "https://seclists.org/fulldisclosure/"
            },
            {
              "url": "https://support.apple.com/100100"
            },
            {
              "url": "https://support.apple.com/148287"
            },
            {
              "url": "https://www.apple.com/itunes/"
            },
            {
              "url": "https://www.apple.com/support/security/pgp/"
            }
          ],
          "source": {
            "defect": [
              "https://seclists.org/fulldisclosure/2026/Aug/42"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10",
          "x_gcve": [
            {
              "recordType": "reference",
              "relationships": [
                {
                  "destId": "CVE-2026-28947",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-28958",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-28973",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-28979",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-28984",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-28990",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-28996",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-3783",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-3784",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-39868",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-39872",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-39877",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43658",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43661",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43663",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43667",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43673",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43676",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43699",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43700",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43701",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43705",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43708",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43711",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43714",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43717",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43720",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43722",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43723",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43724",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43725",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43726",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43727",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43729",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43731",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43733",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43734",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43735",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43738",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43742",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43744",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43745",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43754",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43757",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43769",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43776",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43778",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43794",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43795",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43796",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43797",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43799",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43800",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43801",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43802",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43803",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43807",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43809",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43810",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43811",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43812",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43818",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43821",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43822",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-4424",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64692",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64693",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64695",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64700",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64707",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64709",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64715",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64716",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64719",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64721",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64722",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64723",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64724",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64725",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64726",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64732",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64734",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64735",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64738",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64739",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64740",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64742",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64743",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64744",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64746",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64747",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64749",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64755",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64757",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64760",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64762",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64763",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64764",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64765",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64766",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64768",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64769",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64770",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64771",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64772",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64774",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64778",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64779",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64780",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64781",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64782",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64784",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-65331",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-65332",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-65333",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-65334",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-65335",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-65336",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-65337",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-65338",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-65340",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-65341",
                  "type": "related"
                }
              ],
              "vulnId": "GCVE-1988-2026-0285",
              "x_vulnarchive": {
                "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/42",
                "automated": true,
                "contentSha256": "e23ca2444eddcf9fe8571816e5f9871be844a3cf9989741df860b5a103b3a26b",
                "evidenceScore": 7,
                "messageId": "",
                "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/42",
                "policy": "vulnarchive-1",
                "sourceFormat": "text/html",
                "sourcePublishedAt": "2026-08-17T22:01:56Z"
              }
            },
            {
              "recordType": "advisory",
              "vulnId": "gcve-1988-2026-0285"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "assignerShortName": "VULNARCHIVE",
        "datePublished": "2026-09-08T11:40:45Z",
        "dateUpdated": "2026-09-09T10:11:41Z",
        "state": "PUBLISHED",
        "vulnId": "GCVE-1988-2026-0285"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    GCVE-1988-2026-0284

    Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-09 10:11
    VLAI
    Title
    APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10 iOS 18.7.10 and iPadOS 18.7.10 addresses the following issues. Information about the security content is also available at https://support.apple.com/148287. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accessibility Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An attacker with physical access may be able to access sensitive user data during iPhone Mirroring Description: This issue was addressed through improved state management. CVE-2026-64732: Jorge Welch (@jorgwelch) AirDrop Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An attacker in a privileged network position may be able to cause a denial-of-service Description: A reachable assertion was addressed with improved input validation. CVE-2026-43667: Arash Ale Ebrahim from SCy-Phy research group of CISPA Helmholtz Center for Information Security APFS Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64695: Narendra Singh (@_3P1C), Peter Malone App Store Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved checks. CVE-2026-43801: Rahul Raj AppleDouble Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-43776: Peter Malone, Nicolas Rabrenovic, Irvin Wang Audio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/) AVEVideoEncoder Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to execute arbitrary code with kernel privileges Description: A buffer overflow was addressed with improved size validation. CVE-2026-64747: Franco Belman at Blackwing Intelligence AVEVideoEncoder Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun BackgroundAssets Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to delete files for which it does not have permission Description: A permissions issue was addressed with improved validation. CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab Books Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to modify protected parts of the file system Description: A race condition was addressed with improved checks. CVE-2026-43811: Rodolphe Brunetti (@eisw0lf) of Lupus Nova Contacts Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to add contacts without user authorization Description: An authorization issue was addressed with improved validation. CVE-2026-64746: Rodolphe Brunetti (@eisw0lf) of Lupus Nova, Daniel Febrero Contacts Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted contact may leak sensitive data Description: The issue was addressed with improved checks. CVE-2026-64734: Daniel Williams Contacts Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to access information about a user's contacts Description: This issue was addressed with improved checks. CVE-2026-43797: Arni Hardarson (Neonix Security) CoreAudio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted audio file may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative CoreAudio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43744: ret2happy, Mathis Mansière, an anonymous researcher CoreAudio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A remote attacker may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43803: Rahul Raj CoreMedia Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: A memory corruption issue was addressed with improved memory handling. CVE-2026-43711: James Duffy (@0x4A616D657344) CoreUI Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted asset catalog may result in disclosure of process memory Description: The issue was addressed with improved memory handling. CVE-2026-43738: Peter Malone CoreVideo Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43802: an anonymous researcher curl Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Authentication credentials may be sent to a server on another origin Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2026-3784 CVE-2026-3783 Foundation Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A malicious app may be able to access protected user data Description: The issue was addressed with improved input sanitization. CVE-2026-43714: an anonymous researcher FrontBoard Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to access sensitive user data Description: This issue was addressed by using HTTPS when sending information over the network. CVE-2026-64742: Huỳnh Tấn Ngàn Game Center Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A malicious app may be able to break out of its sandbox Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-64740: Manuel Fernandez (Stackhopper Security) Game Center Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to read a persistent device identifier Description: This issue was addressed with improved data protection. CVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive Technologies Heimdal Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64692: Redon Gashi ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-64716: Peter Malone, Jonathan Alush-Aben, Arni Hardarson CVE-2026-28990: Jiri Ha, Arni Hardarson ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may corrupt process memory Description: A buffer overflow issue was addressed with improved memory handling. CVE-2026-43661: Gandalf4a of PKU-ICODE, Anton Pakhunov, an anonymous researcher ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An integer overflow was addressed with improved input validation. CVE-2026-43818: an anonymous researcher ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may lead to a denial-of-service Description: A type confusion issue was addressed with improved checks. CVE-2026-64693: Geonha Lee (@leegn4a) IOSkywalkFamily Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to disclose kernel memory Description: A memory corruption issue was addressed with improved memory handling. CVE-2026-39877: Richard Zana, Dhiyanesh Selvaraj (@redroot97) IOSurfaceAccelerator Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to leak sensitive kernel state Description: An information leakage was addressed with additional validation. CVE-2026-64760: Seiji Sakurai (@HeapSmasher), Franco Belman at Blackwing Intelligence, an anonymous researcher Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64749: hxr1, Hiroki Imai (LAC Co., Ltd.), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ashish Kunwar Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to disclose kernel memory Description: An information leakage was addressed with additional validation. CVE-2026-64744: Ryan Hileman via Xint Code (xint.io) Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2026-43778: Ashish Kunwar, f0r of MurphySec, Mahmoud Abdelmoniem, Feng Xue and XGPT of ThreatBook, Wang Yu, Nicolas Rabrenovic, Lyutoon, Hiroki Imai (LAC Co., Ltd.), Fábio Luís @scanpt, DARKNAVY (@DarkNavyOrg), an anonymous researcher Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A remote attacker may be able to bypass network filters Description: An inconsistent user interface issue was addressed with improved state management. CVE-2026-64735: Gor Aleksanyan Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-43822: Michal Kosiorek, Eddy Tsalolikhin CVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. CVE-2026-64700: Asjid Kalam (@odinshell) Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination or write kernel memory Description: The issue was addressed with improved input sanitization. CVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel) Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: An integer overflow was addressed with improved input validation. CVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR L
    Severity
    No CVSS data available.
    Impacted products
    Relationships
    reference GCVE-1988-2026-0284 (this record)

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "product": "APPLE-SA-08-17-2026-2 iOS",
              "vendor": "Apple",
              "versions": [
                {
                  "status": "affected",
                  "version": "unknown"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Apple Product Security via Fulldisclosure"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10\n\niOS 18.7.10 and iPadOS 18.7.10 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/148287.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccessibility\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An attacker with physical access may be able to access sensitive\nuser data during iPhone Mirroring\nDescription: This issue was addressed through improved state management.\nCVE-2026-64732: Jorge Welch (@jorgwelch)\n\nAirDrop\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An attacker in a privileged network position may be able to\ncause a denial-of-service\nDescription: A reachable assertion was addressed with improved input\nvalidation.\nCVE-2026-43667: Arash Ale Ebrahim from SCy-Phy research group of CISPA\nHelmholtz Center for Information Security\n\nAPFS\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote user may be able to cause unexpected system termination\nor corrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64695: Narendra Singh (@_3P1C), Peter Malone\n\nApp Store\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved checks.\nCVE-2026-43801: Rahul Raj\n\nAppleDouble\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination or arbitrary code execution\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-43776: Peter Malone, Nicolas Rabrenovic, Irvin Wang\n\nAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\nAVEVideoEncoder\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges\nDescription: A buffer overflow was addressed with improved size\nvalidation.\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\nAVEVideoEncoder\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun\n\nBackgroundAssets\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to delete files for which it does not have\npermission\nDescription: A permissions issue was addressed with improved validation.\nCVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity\u0027s WeBin lab\n\nBooks\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to modify protected parts of the file system\nDescription: A race condition was addressed with improved checks.\nCVE-2026-43811: Rodolphe Brunetti (@eisw0lf) of Lupus Nova\n\nContacts\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to add contacts without user authorization\nDescription: An authorization issue was addressed with improved\nvalidation.\nCVE-2026-64746: Rodolphe Brunetti (@eisw0lf) of Lupus Nova, Daniel\nFebrero\n\nContacts\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted contact may leak sensitive data\nDescription: The issue was addressed with improved checks.\nCVE-2026-64734: Daniel Williams\n\nContacts\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access information about a user\u0027s contacts\nDescription: This issue was addressed with improved checks.\nCVE-2026-43797: Arni Hardarson (Neonix Security)\n\nCoreAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted audio file may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\nCoreAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43744: ret2happy, Mathis Mansi\u00e8re, an anonymous researcher\n\nCoreAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43803: Rahul Raj\n\nCoreMedia\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\nCoreUI\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted asset catalog may result in\ndisclosure of process memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43738: Peter Malone\n\nCoreVideo\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43802: an anonymous researcher\n\ncurl\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Authentication credentials may be sent to a server on another\norigin\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-3784\nCVE-2026-3783\n\nFoundation\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A malicious app may be able to access protected user data\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43714: an anonymous researcher\n\nFrontBoard\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed by using HTTPS when sending\ninformation over the network.\nCVE-2026-64742: Hu\u1ef3nh T\u1ea5n Ng\u00e0n\n\nGame Center\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\nGame Center\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to read a persistent device identifier\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive\nTechnologies\n\nHeimdal\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64692: Redon Gashi\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64716: Peter Malone, Jonathan Alush-Aben, Arni Hardarson\nCVE-2026-28990: Jiri Ha, Arni Hardarson\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: A buffer overflow issue was addressed with improved memory\nhandling.\nCVE-2026-43661: Gandalf4a of PKU-ICODE, Anton Pakhunov, an anonymous\nresearcher\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may lead to arbitrary\ncode execution\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43818: an anonymous researcher\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may lead to a\ndenial-of-service\nDescription: A type confusion issue was addressed with improved checks.\nCVE-2026-64693: Geonha Lee (@leegn4a)\n\nIOSkywalkFamily\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to disclose kernel memory\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-39877: Richard Zana, Dhiyanesh Selvaraj (@redroot97)\n\nIOSurfaceAccelerator\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to leak sensitive kernel state\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-64760: Seiji Sakurai (@HeapSmasher), Franco Belman at Blackwing\nIntelligence, an anonymous researcher\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64749: hxr1, Hiroki Imai (LAC Co., Ltd.), Billy Jheng Bing\nJhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ashish\nKunwar\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to disclose kernel memory\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-64744: Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43778: Ashish Kunwar, f0r of MurphySec, Mahmoud Abdelmoniem,\nFeng Xue and XGPT of ThreatBook, Wang Yu, Nicolas Rabrenovic, Lyutoon,\nHiroki Imai (LAC Co., Ltd.), F\u00e1bio Lu\u00eds @scanpt, DARKNAVY\n(@DarkNavyOrg), an anonymous researcher\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote attacker may be able to bypass network filters\nDescription: An inconsistent user interface issue was addressed with\nimproved state management.\nCVE-2026-64735: Gor Aleksanyan\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43822: Michal Kosiorek, Eddy Tsalolikhin\nCVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\nCVE-2026-64700: Asjid Kalam (@odinshell)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR L"
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-09T10:11:42Z",
            "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
            "shortName": "VULNARCHIVE"
          },
          "references": [
            {
              "tags": [
                "technical-description"
              ],
              "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/38"
            },
            {
              "tags": [
                "technical-description"
              ],
              "url": "https://seclists.org/fulldisclosure/2026/Aug/38"
            },
            {
              "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
            },
            {
              "url": "https://seclists.org/fulldisclosure/"
            },
            {
              "url": "https://support.apple.com/100100"
            },
            {
              "url": "https://support.apple.com/148287"
            },
            {
              "url": "https://www.apple.com/itunes/"
            },
            {
              "url": "https://www.apple.com/support/security/pgp/"
            }
          ],
          "source": {
            "defect": [
              "https://seclists.org/fulldisclosure/2026/Aug/38"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10",
          "x_gcve": [
            {
              "recordType": "reference",
              "relationships": [
                {
                  "destId": "CVE-2026-28947",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-28958",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-28973",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-28979",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-28984",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-28990",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-28996",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-3783",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-3784",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-39868",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-39872",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-39877",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43658",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43661",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43663",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43667",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43673",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43676",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43699",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43700",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43701",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43705",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43708",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43711",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43714",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43717",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43720",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43722",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43723",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43724",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43725",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43726",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43727",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43729",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43731",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43733",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43734",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43735",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43738",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43742",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43744",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43745",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43754",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43757",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43769",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43776",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43778",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43794",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43795",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43796",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43797",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43799",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43800",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43801",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43802",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43803",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43807",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43809",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43810",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43811",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43812",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43818",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43821",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-43822",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-4424",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64692",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64693",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64695",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64700",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64707",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64709",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64715",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64716",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64719",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64721",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64722",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64723",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64724",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64725",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64726",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64732",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64734",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64735",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64738",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64739",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64740",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64742",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64743",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64744",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64746",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64747",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64749",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64755",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64757",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64760",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64762",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64763",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64764",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64765",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64766",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64768",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64769",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64770",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64771",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64772",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64774",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64778",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64779",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64780",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64781",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64782",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-64784",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-65331",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-65332",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-65333",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-65334",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-65335",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-65336",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-65337",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-65338",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-65340",
                  "type": "related"
                },
                {
                  "destId": "CVE-2026-65341",
                  "type": "related"
                }
              ],
              "vulnId": "GCVE-1988-2026-0284",
              "x_vulnarchive": {
                "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/38",
                "automated": true,
                "contentSha256": "4f94a9072b82830135f0c238c7ec5b4f85054d563fda541bcdc667d3f5f62d48",
                "evidenceScore": 7,
                "messageId": "",
                "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/38",
                "policy": "vulnarchive-1",
                "sourceFormat": "text/html",
                "sourcePublishedAt": "2026-08-17T22:00:58Z"
              }
            },
            {
              "recordType": "advisory",
              "vulnId": "gcve-1988-2026-0284"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "assignerShortName": "VULNARCHIVE",
        "datePublished": "2026-09-08T11:40:45Z",
        "dateUpdated": "2026-09-09T10:11:42Z",
        "state": "PUBLISHED",
        "vulnId": "GCVE-1988-2026-0284"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    GCVE-1988-2026-0034

    Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-09 10:11
    VLAI
    Title
    APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10 iOS 18.7.10 and iPadOS 18.7.10 addresses the following issues. Information about the security content is also available at https://support.apple.com/148287. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accessibility Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An attacker with physical access may be able to access sensitive user data during iPhone Mirroring Description: This issue was addressed through improved state management. CVE-2026-64732: Jorge Welch (@jorgwelch) AirDrop Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An attacker in a privileged network position may be able to cause a denial-of-service Description: A reachable assertion was addressed with improved input validation. CVE-2026-43667: Arash Ale Ebrahim from SCy-Phy research group of CISPA Helmholtz Center for Information Security APFS Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64695: Narendra Singh (@_3P1C), Peter Malone App Store Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved checks. CVE-2026-43801: Rahul Raj AppleDouble Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-43776: Peter Malone, Nicolas Rabrenovic, Irvin Wang Audio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/) AVEVideoEncoder Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to execute arbitrary code with kernel privileges Description: A buffer overflow was addressed with improved size validation. CVE-2026-64747: Franco Belman at Blackwing Intelligence AVEVideoEncoder Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun BackgroundAssets Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to delete files for which it does not have permission Description: A permissions issue was addressed with improved validation. CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab Books Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to modify protected parts of the file system Description: A race condition was addressed with improved checks. CVE-2026-43811: Rodolphe Brunetti (@eisw0lf) of Lupus Nova Contacts Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to add contacts without user authorization Description: An authorization issue was addressed with improved validation. CVE-2026-64746: Rodolphe Brunetti (@eisw0lf) of Lupus Nova, Daniel Febrero Contacts Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted contact may leak sensitive data Description: The issue was addressed with improved checks. CVE-2026-64734: Daniel Williams Contacts Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to access information about a user's contacts Description: This issue was addressed with improved checks. CVE-2026-43797: Arni Hardarson (Neonix Security) CoreAudio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted audio file may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative CoreAudio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43744: ret2happy, Mathis Mansière, an anonymous researcher CoreAudio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A remote attacker may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43803: Rahul Raj CoreMedia Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: A memory corruption issue was addressed with improved memory handling. CVE-2026-43711: James Duffy (@0x4A616D657344) CoreUI Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted asset catalog may result in disclosure of process memory Description: The issue was addressed with improved memory handling. CVE-2026-43738: Peter Malone CoreVideo Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43802: an anonymous researcher curl Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Authentication credentials may be sent to a server on another origin Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2026-3784 CVE-2026-3783 Foundation Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A malicious app may be able to access protected user data Description: The issue was addressed with improved input sanitization. CVE-2026-43714: an anonymous researcher FrontBoard Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to access sensitive user data Description: This issue was addressed by using HTTPS when sending information over the network. CVE-2026-64742: Huỳnh Tấn Ngàn Game Center Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A malicious app may be able to break out of its sandbox Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-64740: Manuel Fernandez (Stackhopper Security) Game Center Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to read a persistent device identifier Description: This issue was addressed with improved data protection. CVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive Technologies Heimdal Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64692: Redon Gashi ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-64716: Peter Malone, Jonathan Alush-Aben, Arni Hardarson CVE-2026-28990: Jiri Ha, Arni Hardarson ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may corrupt process memory Description: A buffer overflow issue was addressed with improved memory handling. CVE-2026-43661: Gandalf4a of PKU-ICODE, Anton Pakhunov, an anonymous researcher ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An integer overflow was addressed with improved input validation. CVE-2026-43818: an anonymous researcher ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may lead to a denial-of-service Description: A type confusion issue was addressed with improved checks. CVE-2026-64693: Geonha Lee (@leegn4a) IOSkywalkFamily Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to disclose kernel memory Description: A memory corruption issue was addressed with improved memory handling. CVE-2026-39877: Richard Zana, Dhiyanesh Selvaraj (@redroot97) IOSurfaceAccelerator Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to leak sensitive kernel state Description: An information leakage was addressed with additional validation. CVE-2026-64760: Seiji Sakurai (@HeapSmasher), Franco Belman at Blackwing Intelligence, an anonymous researcher Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64749: hxr1, Hiroki Imai (LAC Co., Ltd.), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ashish Kunwar Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to disclose kernel memory Description: An information leakage was addressed with additional validation. CVE-2026-64744: Ryan Hileman via Xint Code (xint.io) Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2026-43778: Ashish Kunwar, f0r of MurphySec, Mahmoud Abdelmoniem, Feng Xue and XGPT of ThreatBook, Wang Yu, Nicolas Rabrenovic, Lyutoon, Hiroki Imai (LAC Co., Ltd.), Fábio Luís @scanpt, DARKNAVY (@DarkNavyOrg), an anonymous researcher Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A remote attacker may be able to bypass network filters Description: An inconsistent user interface issue was addressed with improved state management. CVE-2026-64735: Gor Aleksanyan Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-43822: Michal Kosiorek, Eddy Tsalolikhin CVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. CVE-2026-64700: Asjid Kalam (@odinshell) Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination or write kernel memory Description: The issue was addressed with improved input sanitization. CVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel) Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: An integer overflow was addressed with improved input validation. CVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR L
    Severity
    No CVSS data available.
    Impacted products

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "product": "APPLE-SA-08-17-2026-2 iOS",
              "vendor": "Apple",
              "versions": [
                {
                  "status": "affected",
                  "version": "unknown"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Apple Product Security via Fulldisclosure"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10\n\niOS 18.7.10 and iPadOS 18.7.10 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/148287.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccessibility\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An attacker with physical access may be able to access sensitive\nuser data during iPhone Mirroring\nDescription: This issue was addressed through improved state management.\nCVE-2026-64732: Jorge Welch (@jorgwelch)\n\nAirDrop\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An attacker in a privileged network position may be able to\ncause a denial-of-service\nDescription: A reachable assertion was addressed with improved input\nvalidation.\nCVE-2026-43667: Arash Ale Ebrahim from SCy-Phy research group of CISPA\nHelmholtz Center for Information Security\n\nAPFS\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote user may be able to cause unexpected system termination\nor corrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64695: Narendra Singh (@_3P1C), Peter Malone\n\nApp Store\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved checks.\nCVE-2026-43801: Rahul Raj\n\nAppleDouble\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination or arbitrary code execution\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-43776: Peter Malone, Nicolas Rabrenovic, Irvin Wang\n\nAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\nAVEVideoEncoder\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges\nDescription: A buffer overflow was addressed with improved size\nvalidation.\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\nAVEVideoEncoder\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun\n\nBackgroundAssets\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to delete files for which it does not have\npermission\nDescription: A permissions issue was addressed with improved validation.\nCVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity\u0027s WeBin lab\n\nBooks\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to modify protected parts of the file system\nDescription: A race condition was addressed with improved checks.\nCVE-2026-43811: Rodolphe Brunetti (@eisw0lf) of Lupus Nova\n\nContacts\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to add contacts without user authorization\nDescription: An authorization issue was addressed with improved\nvalidation.\nCVE-2026-64746: Rodolphe Brunetti (@eisw0lf) of Lupus Nova, Daniel\nFebrero\n\nContacts\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted contact may leak sensitive data\nDescription: The issue was addressed with improved checks.\nCVE-2026-64734: Daniel Williams\n\nContacts\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access information about a user\u0027s contacts\nDescription: This issue was addressed with improved checks.\nCVE-2026-43797: Arni Hardarson (Neonix Security)\n\nCoreAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted audio file may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\nCoreAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43744: ret2happy, Mathis Mansi\u00e8re, an anonymous researcher\n\nCoreAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43803: Rahul Raj\n\nCoreMedia\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\nCoreUI\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted asset catalog may result in\ndisclosure of process memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43738: Peter Malone\n\nCoreVideo\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43802: an anonymous researcher\n\ncurl\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Authentication credentials may be sent to a server on another\norigin\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-3784\nCVE-2026-3783\n\nFoundation\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A malicious app may be able to access protected user data\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43714: an anonymous researcher\n\nFrontBoard\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed by using HTTPS when sending\ninformation over the network.\nCVE-2026-64742: Hu\u1ef3nh T\u1ea5n Ng\u00e0n\n\nGame Center\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\nGame Center\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to read a persistent device identifier\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive\nTechnologies\n\nHeimdal\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64692: Redon Gashi\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64716: Peter Malone, Jonathan Alush-Aben, Arni Hardarson\nCVE-2026-28990: Jiri Ha, Arni Hardarson\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: A buffer overflow issue was addressed with improved memory\nhandling.\nCVE-2026-43661: Gandalf4a of PKU-ICODE, Anton Pakhunov, an anonymous\nresearcher\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may lead to arbitrary\ncode execution\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43818: an anonymous researcher\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may lead to a\ndenial-of-service\nDescription: A type confusion issue was addressed with improved checks.\nCVE-2026-64693: Geonha Lee (@leegn4a)\n\nIOSkywalkFamily\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to disclose kernel memory\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-39877: Richard Zana, Dhiyanesh Selvaraj (@redroot97)\n\nIOSurfaceAccelerator\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to leak sensitive kernel state\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-64760: Seiji Sakurai (@HeapSmasher), Franco Belman at Blackwing\nIntelligence, an anonymous researcher\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64749: hxr1, Hiroki Imai (LAC Co., Ltd.), Billy Jheng Bing\nJhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ashish\nKunwar\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to disclose kernel memory\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-64744: Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43778: Ashish Kunwar, f0r of MurphySec, Mahmoud Abdelmoniem,\nFeng Xue and XGPT of ThreatBook, Wang Yu, Nicolas Rabrenovic, Lyutoon,\nHiroki Imai (LAC Co., Ltd.), F\u00e1bio Lu\u00eds @scanpt, DARKNAVY\n(@DarkNavyOrg), an anonymous researcher\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote attacker may be able to bypass network filters\nDescription: An inconsistent user interface issue was addressed with\nimproved state management.\nCVE-2026-64735: Gor Aleksanyan\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43822: Michal Kosiorek, Eddy Tsalolikhin\nCVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\nCVE-2026-64700: Asjid Kalam (@odinshell)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR L"
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-09T10:11:41Z",
            "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
            "shortName": "VULNARCHIVE"
          },
          "references": [
            {
              "tags": [
                "technical-description"
              ],
              "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/42"
            },
            {
              "tags": [
                "technical-description"
              ],
              "url": "https://seclists.org/fulldisclosure/2026/Aug/42"
            },
            {
              "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
            },
            {
              "url": "https://seclists.org/fulldisclosure/"
            },
            {
              "url": "https://support.apple.com/100100"
            },
            {
              "url": "https://support.apple.com/148287"
            },
            {
              "url": "https://www.apple.com/itunes/"
            },
            {
              "url": "https://www.apple.com/support/security/pgp/"
            }
          ],
          "source": {
            "defect": [
              "https://seclists.org/fulldisclosure/2026/Aug/42"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10",
          "x_gcve": [
            {
              "recordType": "advisory",
              "relationships": [],
              "vulnId": "GCVE-1988-2026-0034",
              "x_vulnarchive": {
                "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/42",
                "automated": true,
                "contentSha256": "e23ca2444eddcf9fe8571816e5f9871be844a3cf9989741df860b5a103b3a26b",
                "evidenceScore": 7,
                "messageId": "",
                "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/42",
                "policy": "vulnarchive-1",
                "sourceFormat": "text/html",
                "sourcePublishedAt": "2026-08-17T22:01:56Z"
              }
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "assignerShortName": "VULNARCHIVE",
        "datePublished": "2026-09-07T13:20:21Z",
        "dateUpdated": "2026-09-09T10:11:41Z",
        "state": "PUBLISHED",
        "vulnId": "GCVE-1988-2026-0034"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    GCVE-1988-2026-0033

    Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-09 10:11
    VLAI
    Title
    APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10 iOS 18.7.10 and iPadOS 18.7.10 addresses the following issues. Information about the security content is also available at https://support.apple.com/148287. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accessibility Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An attacker with physical access may be able to access sensitive user data during iPhone Mirroring Description: This issue was addressed through improved state management. CVE-2026-64732: Jorge Welch (@jorgwelch) AirDrop Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An attacker in a privileged network position may be able to cause a denial-of-service Description: A reachable assertion was addressed with improved input validation. CVE-2026-43667: Arash Ale Ebrahim from SCy-Phy research group of CISPA Helmholtz Center for Information Security APFS Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64695: Narendra Singh (@_3P1C), Peter Malone App Store Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved checks. CVE-2026-43801: Rahul Raj AppleDouble Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-43776: Peter Malone, Nicolas Rabrenovic, Irvin Wang Audio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/) AVEVideoEncoder Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to execute arbitrary code with kernel privileges Description: A buffer overflow was addressed with improved size validation. CVE-2026-64747: Franco Belman at Blackwing Intelligence AVEVideoEncoder Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun BackgroundAssets Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to delete files for which it does not have permission Description: A permissions issue was addressed with improved validation. CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab Books Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to modify protected parts of the file system Description: A race condition was addressed with improved checks. CVE-2026-43811: Rodolphe Brunetti (@eisw0lf) of Lupus Nova Contacts Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to add contacts without user authorization Description: An authorization issue was addressed with improved validation. CVE-2026-64746: Rodolphe Brunetti (@eisw0lf) of Lupus Nova, Daniel Febrero Contacts Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted contact may leak sensitive data Description: The issue was addressed with improved checks. CVE-2026-64734: Daniel Williams Contacts Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to access information about a user's contacts Description: This issue was addressed with improved checks. CVE-2026-43797: Arni Hardarson (Neonix Security) CoreAudio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted audio file may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative CoreAudio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43744: ret2happy, Mathis Mansière, an anonymous researcher CoreAudio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A remote attacker may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43803: Rahul Raj CoreMedia Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: A memory corruption issue was addressed with improved memory handling. CVE-2026-43711: James Duffy (@0x4A616D657344) CoreUI Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted asset catalog may result in disclosure of process memory Description: The issue was addressed with improved memory handling. CVE-2026-43738: Peter Malone CoreVideo Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43802: an anonymous researcher curl Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Authentication credentials may be sent to a server on another origin Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2026-3784 CVE-2026-3783 Foundation Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A malicious app may be able to access protected user data Description: The issue was addressed with improved input sanitization. CVE-2026-43714: an anonymous researcher FrontBoard Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to access sensitive user data Description: This issue was addressed by using HTTPS when sending information over the network. CVE-2026-64742: Huỳnh Tấn Ngàn Game Center Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A malicious app may be able to break out of its sandbox Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-64740: Manuel Fernandez (Stackhopper Security) Game Center Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to read a persistent device identifier Description: This issue was addressed with improved data protection. CVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive Technologies Heimdal Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64692: Redon Gashi ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-64716: Peter Malone, Jonathan Alush-Aben, Arni Hardarson CVE-2026-28990: Jiri Ha, Arni Hardarson ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may corrupt process memory Description: A buffer overflow issue was addressed with improved memory handling. CVE-2026-43661: Gandalf4a of PKU-ICODE, Anton Pakhunov, an anonymous researcher ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An integer overflow was addressed with improved input validation. CVE-2026-43818: an anonymous researcher ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may lead to a denial-of-service Description: A type confusion issue was addressed with improved checks. CVE-2026-64693: Geonha Lee (@leegn4a) IOSkywalkFamily Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to disclose kernel memory Description: A memory corruption issue was addressed with improved memory handling. CVE-2026-39877: Richard Zana, Dhiyanesh Selvaraj (@redroot97) IOSurfaceAccelerator Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to leak sensitive kernel state Description: An information leakage was addressed with additional validation. CVE-2026-64760: Seiji Sakurai (@HeapSmasher), Franco Belman at Blackwing Intelligence, an anonymous researcher Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64749: hxr1, Hiroki Imai (LAC Co., Ltd.), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ashish Kunwar Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to disclose kernel memory Description: An information leakage was addressed with additional validation. CVE-2026-64744: Ryan Hileman via Xint Code (xint.io) Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2026-43778: Ashish Kunwar, f0r of MurphySec, Mahmoud Abdelmoniem, Feng Xue and XGPT of ThreatBook, Wang Yu, Nicolas Rabrenovic, Lyutoon, Hiroki Imai (LAC Co., Ltd.), Fábio Luís @scanpt, DARKNAVY (@DarkNavyOrg), an anonymous researcher Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A remote attacker may be able to bypass network filters Description: An inconsistent user interface issue was addressed with improved state management. CVE-2026-64735: Gor Aleksanyan Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-43822: Michal Kosiorek, Eddy Tsalolikhin CVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. CVE-2026-64700: Asjid Kalam (@odinshell) Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination or write kernel memory Description: The issue was addressed with improved input sanitization. CVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel) Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: An integer overflow was addressed with improved input validation. CVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR L
    Severity
    No CVSS data available.
    Impacted products

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "product": "APPLE-SA-08-17-2026-2 iOS",
              "vendor": "Apple",
              "versions": [
                {
                  "status": "affected",
                  "version": "unknown"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Apple Product Security via Fulldisclosure"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10\n\niOS 18.7.10 and iPadOS 18.7.10 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/148287.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccessibility\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An attacker with physical access may be able to access sensitive\nuser data during iPhone Mirroring\nDescription: This issue was addressed through improved state management.\nCVE-2026-64732: Jorge Welch (@jorgwelch)\n\nAirDrop\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An attacker in a privileged network position may be able to\ncause a denial-of-service\nDescription: A reachable assertion was addressed with improved input\nvalidation.\nCVE-2026-43667: Arash Ale Ebrahim from SCy-Phy research group of CISPA\nHelmholtz Center for Information Security\n\nAPFS\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote user may be able to cause unexpected system termination\nor corrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64695: Narendra Singh (@_3P1C), Peter Malone\n\nApp Store\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved checks.\nCVE-2026-43801: Rahul Raj\n\nAppleDouble\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination or arbitrary code execution\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-43776: Peter Malone, Nicolas Rabrenovic, Irvin Wang\n\nAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\nAVEVideoEncoder\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges\nDescription: A buffer overflow was addressed with improved size\nvalidation.\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\nAVEVideoEncoder\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun\n\nBackgroundAssets\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to delete files for which it does not have\npermission\nDescription: A permissions issue was addressed with improved validation.\nCVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity\u0027s WeBin lab\n\nBooks\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to modify protected parts of the file system\nDescription: A race condition was addressed with improved checks.\nCVE-2026-43811: Rodolphe Brunetti (@eisw0lf) of Lupus Nova\n\nContacts\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to add contacts without user authorization\nDescription: An authorization issue was addressed with improved\nvalidation.\nCVE-2026-64746: Rodolphe Brunetti (@eisw0lf) of Lupus Nova, Daniel\nFebrero\n\nContacts\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted contact may leak sensitive data\nDescription: The issue was addressed with improved checks.\nCVE-2026-64734: Daniel Williams\n\nContacts\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access information about a user\u0027s contacts\nDescription: This issue was addressed with improved checks.\nCVE-2026-43797: Arni Hardarson (Neonix Security)\n\nCoreAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted audio file may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\nCoreAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43744: ret2happy, Mathis Mansi\u00e8re, an anonymous researcher\n\nCoreAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43803: Rahul Raj\n\nCoreMedia\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\nCoreUI\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted asset catalog may result in\ndisclosure of process memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43738: Peter Malone\n\nCoreVideo\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43802: an anonymous researcher\n\ncurl\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Authentication credentials may be sent to a server on another\norigin\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-3784\nCVE-2026-3783\n\nFoundation\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A malicious app may be able to access protected user data\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43714: an anonymous researcher\n\nFrontBoard\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed by using HTTPS when sending\ninformation over the network.\nCVE-2026-64742: Hu\u1ef3nh T\u1ea5n Ng\u00e0n\n\nGame Center\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\nGame Center\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to read a persistent device identifier\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive\nTechnologies\n\nHeimdal\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64692: Redon Gashi\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64716: Peter Malone, Jonathan Alush-Aben, Arni Hardarson\nCVE-2026-28990: Jiri Ha, Arni Hardarson\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: A buffer overflow issue was addressed with improved memory\nhandling.\nCVE-2026-43661: Gandalf4a of PKU-ICODE, Anton Pakhunov, an anonymous\nresearcher\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may lead to arbitrary\ncode execution\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43818: an anonymous researcher\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may lead to a\ndenial-of-service\nDescription: A type confusion issue was addressed with improved checks.\nCVE-2026-64693: Geonha Lee (@leegn4a)\n\nIOSkywalkFamily\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to disclose kernel memory\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-39877: Richard Zana, Dhiyanesh Selvaraj (@redroot97)\n\nIOSurfaceAccelerator\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to leak sensitive kernel state\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-64760: Seiji Sakurai (@HeapSmasher), Franco Belman at Blackwing\nIntelligence, an anonymous researcher\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64749: hxr1, Hiroki Imai (LAC Co., Ltd.), Billy Jheng Bing\nJhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ashish\nKunwar\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to disclose kernel memory\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-64744: Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43778: Ashish Kunwar, f0r of MurphySec, Mahmoud Abdelmoniem,\nFeng Xue and XGPT of ThreatBook, Wang Yu, Nicolas Rabrenovic, Lyutoon,\nHiroki Imai (LAC Co., Ltd.), F\u00e1bio Lu\u00eds @scanpt, DARKNAVY\n(@DarkNavyOrg), an anonymous researcher\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote attacker may be able to bypass network filters\nDescription: An inconsistent user interface issue was addressed with\nimproved state management.\nCVE-2026-64735: Gor Aleksanyan\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43822: Michal Kosiorek, Eddy Tsalolikhin\nCVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\nCVE-2026-64700: Asjid Kalam (@odinshell)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR L"
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-09T10:11:42Z",
            "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
            "shortName": "VULNARCHIVE"
          },
          "references": [
            {
              "tags": [
                "technical-description"
              ],
              "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/38"
            },
            {
              "tags": [
                "technical-description"
              ],
              "url": "https://seclists.org/fulldisclosure/2026/Aug/38"
            },
            {
              "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
            },
            {
              "url": "https://seclists.org/fulldisclosure/"
            },
            {
              "url": "https://support.apple.com/100100"
            },
            {
              "url": "https://support.apple.com/148287"
            },
            {
              "url": "https://www.apple.com/itunes/"
            },
            {
              "url": "https://www.apple.com/support/security/pgp/"
            }
          ],
          "source": {
            "defect": [
              "https://seclists.org/fulldisclosure/2026/Aug/38"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10",
          "x_gcve": [
            {
              "recordType": "advisory",
              "relationships": [],
              "vulnId": "GCVE-1988-2026-0033",
              "x_vulnarchive": {
                "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/38",
                "automated": true,
                "contentSha256": "4f94a9072b82830135f0c238c7ec5b4f85054d563fda541bcdc667d3f5f62d48",
                "evidenceScore": 7,
                "messageId": "",
                "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/38",
                "policy": "vulnarchive-1",
                "sourceFormat": "text/html",
                "sourcePublishedAt": "2026-08-17T22:00:58Z"
              }
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "assignerShortName": "VULNARCHIVE",
        "datePublished": "2026-09-07T13:20:21Z",
        "dateUpdated": "2026-09-09T10:11:42Z",
        "state": "PUBLISHED",
        "vulnId": "GCVE-1988-2026-0033"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }