GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

GCVE-1988-2026-0216

Vulnerability from gna-1988 – Published: 2026-09-08 07:57 – Updated: 2026-09-09 10:07
VLAI
Title
APPLE-SA-02-11-2026-1 iOS 26.3 and iPadOS 26.3
Summary
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-02-11-2026-1 iOS 26.3 and iPadOS 26.3 iOS 26.3 and iPadOS 26.3 addresses the following issues. Information about the security content is also available at https://support.apple.com/126346. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accessibility Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An attacker with physical access to a locked device may be able to view sensitive user information Description: An inconsistent user interface issue was addressed with improved state management. CVE-2026-20645: Loh Boon Keat Accessibility Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An attacker with physical access to a locked device may be able to view sensitive user information Description: A privacy issue was addressed by removing sensitive data. CVE-2026-20674: Jacob Prezant (prezant.us) Bluetooth Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Bluetooth packets Description: A denial-of-service issue was addressed with improved validation. CVE-2026-20650: jioundai Call History Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: A user with Live Caller ID app extensions turned off could have identifying information leaked to the extensions Description: A logic issue was addressed with improved checks. CVE-2026-20638: Nils Hanff (@nils1729@chaos.social) of Hasso Plattner Institute CFNetwork Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: A remote user may be able to write arbitrary files Description: A path handling issue was addressed with improved logic. CVE-2026-20660: Amy (amys.website) CoreAudio Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory Description: An out-of-bounds access issue was addressed with improved bounds checking. CVE-2026-20611: Anonymous working with Trend Micro Zero Day Initiative CoreMedia Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing a maliciously crafted file may lead to a denial-of- service or potentially disclose memory contents Description: The issue was addressed with improved memory handling. CVE-2026-20609: Yiğit Can YILMAZ (@yilmazcanyigit) CoreServices Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to gain root privileges Description: A race condition was addressed with improved state handling. CVE-2026-20617: Gergely Kalman (@gergely_kalman), Csaba Fitzl (@theevilbit) of Iru CoreServices Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to gain root privileges Description: A path handling issue was addressed with improved validation. CVE-2026-20615: Csaba Fitzl (@theevilbit) of Iru and Gergely Kalman (@gergely_kalman) CoreServices Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to access sensitive user data Description: An issue existed in the handling of environment variables. This issue was addressed with improved validation. CVE-2026-20627: an anonymous researcher dyld Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An attacker with memory write capability may be able to execute arbitrary code. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 and CVE-2025-43529 were also issued in response to this report. Description: A memory corruption issue was addressed with improved state management. CVE-2026-20700: Google Threat Analysis Group Game Center Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: A user may be able to view sensitive user information Description: A logging issue was addressed with improved data redaction. CVE-2026-20649: Asaf Cohen ImageIO Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing a maliciously crafted image may lead to disclosure of user information Description: The issue was addressed with improved bounds checks. CVE-2026-20675: George Karchemsky (@gkarchemsky) working with Trend Micro Zero Day Initiative ImageIO Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing a maliciously crafted image may result in disclosure of process memory Description: The issue was addressed with improved memory handling. CVE-2026-20634: George Karchemsky (@gkarchemsky) working with Trend Micro Zero Day Initiative Kernel Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause unexpected system termination Description: The issue was addressed with improved memory handling. CVE-2026-20654: Jian Lee (@speedyfriend433) Kernel Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: A malicious app may be able to gain root privileges Description: This issue was addressed with improved checks. CVE-2026-20626: Keisuke Hosoda Kernel Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An attacker in a privileged network position may be able to intercept network traffic Description: A logic issue was addressed with improved checks. CVE-2026-20671: Xin'an Zhou, Juefei Pu, Zhutian Liu, Zhiyun Qian, Zhaowei Tan, Srikanth V. Krishnamurthy, Mathy Vanhoef LaunchServices Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to enumerate a user's installed apps Description: The issue was resolved by sanitizing logging. CVE-2026-20663: Zhongcheng Li from IES Red Team libexpat Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing a maliciously crafted file may lead to a denial-of- service Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2025-59375 libxpc Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to break out of its sandbox Description: A logic issue was addressed with improved checks. CVE-2026-20667: an anonymous researcher Live Captions Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An attacker with physical access to a locked device may be able to view sensitive user information Description: An authorization issue was addressed with improved state management. CVE-2026-20655: Richard Hyunho Im (@richeeta) at Route Zero Security (routezero.security) Messages Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: A shortcut may be able to bypass sandbox restrictions Description: A race condition was addressed with improved handling of symbolic links. CVE-2026-20677: Ron Masas of BreakPoint.SH Photos Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: A person with physical access to an iOS device may be able to access photos from the lock screen Description: An input validation issue was addressed. CVE-2026-20642: Dalibor Milanovic Sandbox Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to break out of its sandbox Description: A permissions issue was addressed with additional restrictions. CVE-2026-20628: Noah Gregory (wts.dev) Sandbox Profiles Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state ma
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Apple APPLE-SA-02-11-2026-1 iOS Affected: unknown
guessed Create a notification for this product.
Credits
Apple Product Security via Fulldisclosure
Relationships
reference GCVE-1988-2026-0216 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "APPLE-SA-02-11-2026-1 iOS",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-02-11-2026-1 iOS 26.3 and iPadOS 26.3\n\niOS 26.3 and iPadOS 26.3 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/126346.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccessibility\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An attacker with physical access to a locked device may be able\nto view sensitive user information\nDescription: An inconsistent user interface issue was addressed with\nimproved state management.\nCVE-2026-20645: Loh Boon Keat\n\nAccessibility\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An attacker with physical access to a locked device may be able\nto view sensitive user information\nDescription: A privacy issue was addressed by removing sensitive data.\nCVE-2026-20674: Jacob Prezant (prezant.us)\n\nBluetooth\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An attacker in a privileged network position may be able to\nperform denial-of-service attack using crafted Bluetooth packets\nDescription: A denial-of-service issue was addressed with improved\nvalidation.\nCVE-2026-20650: jioundai\n\nCall History\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A user with Live Caller ID app extensions turned off could have\nidentifying information leaked to the extensions\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-20638: Nils Hanff (@nils1729@chaos.social) of Hasso Plattner\nInstitute\n\nCFNetwork\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A remote user may be able to write arbitrary files\nDescription: A path handling issue was addressed with improved logic.\nCVE-2026-20660: Amy (amys.website)\n\nCoreAudio\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing a maliciously crafted media file may lead to\nunexpected app termination or corrupt process memory\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-20611: Anonymous working with Trend Micro Zero Day Initiative\n\nCoreMedia\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing a maliciously crafted file may lead to a denial-of-\nservice or potentially disclose memory contents\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-20609: Yi\u011fit Can YILMAZ (@yilmazcanyigit)\n\nCoreServices\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to gain root privileges\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-20617: Gergely Kalman (@gergely_kalman), Csaba Fitzl\n(@theevilbit) of Iru\n\nCoreServices\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to gain root privileges\nDescription: A path handling issue was addressed with improved\nvalidation.\nCVE-2026-20615: Csaba Fitzl (@theevilbit) of Iru and Gergely Kalman\n(@gergely_kalman)\n\nCoreServices\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to access sensitive user data\nDescription: An issue existed in the handling of environment variables.\nThis issue was addressed with improved validation.\nCVE-2026-20627: an anonymous researcher\n\ndyld\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An attacker with memory write capability may be able to execute\narbitrary code. Apple is aware of a report that this issue may have been\nexploited in an extremely sophisticated attack against specific targeted\nindividuals on versions of iOS before iOS 26. CVE-2025-14174 and\nCVE-2025-43529 were also issued in response to this report.\nDescription: A memory corruption issue was addressed with improved state\nmanagement.\nCVE-2026-20700: Google Threat Analysis Group\n\nGame Center\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A user may be able to view sensitive user information\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-20649: Asaf Cohen\n\nImageIO\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing a maliciously crafted image may lead to disclosure of\nuser information\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-20675: George Karchemsky (@gkarchemsky) working with Trend\nMicro Zero Day Initiative\n\nImageIO\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing a maliciously crafted image may result in disclosure\nof process memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-20634: George Karchemsky (@gkarchemsky) working with Trend\nMicro Zero Day Initiative\n\nKernel\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to cause unexpected system termination\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-20654: Jian Lee (@speedyfriend433)\n\nKernel\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A malicious app may be able to gain root privileges\nDescription: This issue was addressed with improved checks.\nCVE-2026-20626: Keisuke Hosoda\n\nKernel\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An attacker in a privileged network position may be able to\nintercept network traffic\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-20671: Xin\u0027an Zhou, Juefei Pu, Zhutian Liu, Zhiyun Qian,\nZhaowei Tan, Srikanth V. Krishnamurthy, Mathy Vanhoef\n\nLaunchServices\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to enumerate a user\u0027s installed apps\nDescription: The issue was resolved by sanitizing logging.\nCVE-2026-20663: Zhongcheng Li from IES Red Team\n\nlibexpat\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing a maliciously crafted file may lead to a denial-of-\nservice\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2025-59375\n\nlibxpc\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to break out of its sandbox\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-20667: an anonymous researcher\n\nLive Captions\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An attacker with physical access to a locked device may be able\nto view sensitive user information\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-20655: Richard Hyunho Im (@richeeta) at Route Zero Security\n(routezero.security)\n\nMessages\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A shortcut may be able to bypass sandbox restrictions\nDescription: A race condition was addressed with improved handling of\nsymbolic links.\nCVE-2026-20677: Ron Masas of BreakPoint.SH\n\nPhotos\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A person with physical access to an iOS device may be able to\naccess photos from the lock screen\nDescription: An input validation issue was addressed.\nCVE-2026-20642: Dalibor Milanovic\n\nSandbox\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to break out of its sandbox\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-20628: Noah Gregory (wts.dev)\n\nSandbox Profiles\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nma"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:07:48Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/21"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/21"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/126346"
        },
        {
          "url": "https://www.apple.com/itunes/"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/21"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-02-11-2026-1 iOS 26.3 and iPadOS 26.3",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-14174",
              "type": "related"
            },
            {
              "destId": "CVE-2025-43529",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59375",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20606",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20608",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20609",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20611",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20615",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20617",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20621",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20626",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20627",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20628",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20634",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20635",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20636",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20638",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20640",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20641",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20642",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20644",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20645",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20649",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20650",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20652",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20653",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20654",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20655",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20660",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20661",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20663",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20667",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20671",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20674",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20675",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20676",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20677",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20678",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20680",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20682",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20700",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0216",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/21",
            "automated": true,
            "contentSha256": "f33f0e360bda6866cc4566b107aa0e7f7085f7b8436ec31bd76431be2a7dfe7e",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/21",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-12T00:02:49Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0216"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:42Z",
    "dateUpdated": "2026-09-09T10:07:48Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0216"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.