GCVE-1988-2026-0226
Vulnerability from gna-1988 – Published: 2026-09-08 07:57 – Updated: 2026-09-09 10:07
VLAI
EPSS
VEX
Title
APPLE-SA-03-11-2026-2 iOS 15.8.7 and iPadOS 15.8.7
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-03-11-2026-2 iOS 15.8.7 and iPadOS 15.8.7
iOS 15.8.7 and iPadOS 15.8.7 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/126632.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Kernel
Available for: iPhone 6s (all models), iPhone 7 (all models), iPhone SE
(1st generation), iPad Air 2, iPad mini (4th generation), and iPod touch
(7th generation)
Impact: An app may be able to execute arbitrary code with kernel
privileges. This fix associated with the Coruna exploit was shipped in
iOS 17 on September 18, 2023. This update brings that fix to devices
that cannot update to the latest iOS version.
Description: A use-after-free issue was addressed with improved memory
management.
CVE-2023-41974: Félix Poulin-Bélanger
WebKit
Available for: iPhone 6s (all models), iPhone 7 (all models), iPhone SE
(1st generation), iPad Air 2, iPad mini (4th generation), and iPod touch
(7th generation)
Impact: Processing maliciously crafted web content may lead to arbitrary
code execution. This fix associated with the Coruna exploit was shipped
in iOS 17.3 on January 22, 2024. This update brings that fix to devices
that cannot update to the latest iOS version.
Description: A type confusion issue was addressed with improved checks.
WebKit Bugzilla: 267134
CVE-2024-23222
WebKit
Available for: iPhone 6s (all models), iPhone 7 (all models), iPhone SE
(1st generation), iPad Air 2, iPad mini (4th generation), and iPod touch
(7th generation)
Impact: Processing maliciously crafted web content may lead to memory
corruption. This fix associated with the Coruna exploit was shipped in
iOS 16.6 on July 24, 2023. This update brings that fix to devices that
cannot update to the latest iOS version.
Description: A use-after-free issue was addressed with improved memory
management.
WebKit Bugzilla: 255951
CVE-2023-43000: Apple
WebKit
Available for: iPhone 6s (all models), iPhone 7 (all models), iPhone SE
(1st generation), iPad Air 2, iPad mini (4th generation), and iPod touch
(7th generation)
Impact: Processing maliciously crafted web content may lead to memory
corruption. This fix associated with the Coruna exploit was shipped in
iOS 17.2 on December 11th, 2023. This update brings that fix to devices
that cannot update to the latest iOS version.
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 260913
CVE-2023-43010: Apple
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "iOS 15.8.7 and iPadOS 15.8.7".
All information is also posted on the Apple Security Releases
web site: https://support.apple.com/100100.
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmmyENEACgkQ4Ifiq8DH
7PUQNw//ZgXEOg3VGIhzmsh/7SXOGSZhxoTKwWZGWNc+TlBUYPWqLyoGX2uXulna
WxJtKJJxcpYNesdEjBWAlPnJwJCd7Fe6+/NJekz1iH35U3KwhTvUWDBBo9gZUnId
OvBCZSwXAHiCJJ8uhUkCjhpZnx+u29SQyWPiYPwcrjMkI4H3oQ0eyrZ4sdQyUeA1
5ZdwFfVaDNKhpOYaoEXLbuYI4fPsnIiHs31djdzUTZKL5lnPUlKWJ4eVzJ7P/BSB
PgI7TUP9VNRzt5PJvVB1efWIEJtOWAB2splo2ASmNorBKdcjdBNUbRo6NE+vqwlZ
OjoguusrMS9wNu/iHJgnJzMit3ZToLauat3wuPxF7O8UNyfF1Ybvfg4auQGYo1Bj
PuHaOVtYSRhr0q+JF6htpoURjXp6nmEsmh4Wjs4q307RVqDuhwMGAJcwO/2Y30ow
H4nmEq3L4rCvu7Le2OgzsI311PU06vvbVfY6SznfG97pwsLeNZz6d91Z/aHxmAYm
iQqUZjaRyvs9jlD5Y526CFn3x5Sw1AgJX9WZdr4WcCwHE6JsxCu+J8DhG85RVlWJ
HXqd+sSloPmtagwrW9gPag4zA7wUwhJxa6wgLOC5V+P0DsZ81NwmUtppHaONM0qY
M4upJMdLHrXf/Sh8Csnevl5FX+dvwpn9vZodbYJyhsQ3L/PnwT8=
=x1N5
-----END PGP SIGNATURE-----
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Apple | APPLE-SA-03-11-2026-2 iOS |
Affected:
unknown
|
guessed |
Relationships
reference
GCVE-1988-2026-0226 (this record)
- related CVE-2023-41974
- related CVE-2023-43000
- related CVE-2023-43010
- related CVE-2024-23222
{
"containers": {
"cna": {
"affected": [
{
"product": "APPLE-SA-03-11-2026-2 iOS",
"vendor": "Apple",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-03-11-2026-2 iOS 15.8.7 and iPadOS 15.8.7\n\niOS 15.8.7 and iPadOS 15.8.7 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/126632.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nKernel\nAvailable for: iPhone 6s (all models), iPhone 7 (all models), iPhone SE\n(1st generation), iPad Air 2, iPad mini (4th generation), and iPod touch\n(7th generation)\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges. This fix associated with the Coruna exploit was shipped in\niOS 17 on September 18, 2023. This update brings that fix to devices\nthat cannot update to the latest iOS version.\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nCVE-2023-41974: F\u00e9lix Poulin-B\u00e9langer\n\nWebKit\nAvailable for: iPhone 6s (all models), iPhone 7 (all models), iPhone SE\n(1st generation), iPad Air 2, iPad mini (4th generation), and iPod touch\n(7th generation)\nImpact: Processing maliciously crafted web content may lead to arbitrary\ncode execution. This fix associated with the Coruna exploit was shipped\nin iOS 17.3 on January 22, 2024. This update brings that fix to devices\nthat cannot update to the latest iOS version.\nDescription: A type confusion issue was addressed with improved checks.\nWebKit Bugzilla: 267134\nCVE-2024-23222\n\nWebKit\nAvailable for: iPhone 6s (all models), iPhone 7 (all models), iPhone SE\n(1st generation), iPad Air 2, iPad mini (4th generation), and iPod touch\n(7th generation)\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption. This fix associated with the Coruna exploit was shipped in\niOS 16.6 on July 24, 2023. This update brings that fix to devices that\ncannot update to the latest iOS version.\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 255951\nCVE-2023-43000: Apple\n\nWebKit\nAvailable for: iPhone 6s (all models), iPhone 7 (all models), iPhone SE\n(1st generation), iPad Air 2, iPad mini (4th generation), and iPod touch\n(7th generation)\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption. This fix associated with the Coruna exploit was shipped in\niOS 17.2 on December 11th, 2023. This update brings that fix to devices\nthat cannot update to the latest iOS version.\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 260913\nCVE-2023-43010: Apple\n\nThis update is available through iTunes and Software Update on your\niOS device, and will not appear in your computer\u0027s Software Update\napplication, or in the Apple Downloads site. Make sure you have an\nInternet connection and have installed the latest version of iTunes\nfrom https://www.apple.com/itunes/\n\niTunes and Software Update on the device will automatically check\nApple\u0027s update server on its weekly schedule. When an update is\ndetected, it is downloaded and the option to be installed is\npresented to the user when the iOS device is docked. We recommend\napplying the update immediately if possible. Selecting Don\u0027t Install\nwill present the option the next time you connect your iOS device.\n\nThe automatic update process may take up to a week depending on the\nday that iTunes or the device checks for updates. You may manually\nobtain the update via the Check for Updates button within iTunes, or\nthe Software Update on your device.\n\nTo check that the iPhone, iPod touch, or iPad has been updated:\n\n* Navigate to Settings\n* Select General\n* Select About. The version after applying this update\nwill be \"iOS 15.8.7 and iPadOS 15.8.7\".\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmmyENEACgkQ4Ifiq8DH\n7PUQNw//ZgXEOg3VGIhzmsh/7SXOGSZhxoTKwWZGWNc+TlBUYPWqLyoGX2uXulna\nWxJtKJJxcpYNesdEjBWAlPnJwJCd7Fe6+/NJekz1iH35U3KwhTvUWDBBo9gZUnId\nOvBCZSwXAHiCJJ8uhUkCjhpZnx+u29SQyWPiYPwcrjMkI4H3oQ0eyrZ4sdQyUeA1\n5ZdwFfVaDNKhpOYaoEXLbuYI4fPsnIiHs31djdzUTZKL5lnPUlKWJ4eVzJ7P/BSB\nPgI7TUP9VNRzt5PJvVB1efWIEJtOWAB2splo2ASmNorBKdcjdBNUbRo6NE+vqwlZ\nOjoguusrMS9wNu/iHJgnJzMit3ZToLauat3wuPxF7O8UNyfF1Ybvfg4auQGYo1Bj\nPuHaOVtYSRhr0q+JF6htpoURjXp6nmEsmh4Wjs4q307RVqDuhwMGAJcwO/2Y30ow\nH4nmEq3L4rCvu7Le2OgzsI311PU06vvbVfY6SznfG97pwsLeNZz6d91Z/aHxmAYm\niQqUZjaRyvs9jlD5Y526CFn3x5Sw1AgJX9WZdr4WcCwHE6JsxCu+J8DhG85RVlWJ\nHXqd+sSloPmtagwrW9gPag4zA7wUwhJxa6wgLOC5V+P0DsZ81NwmUtppHaONM0qY\nM4upJMdLHrXf/Sh8Csnevl5FX+dvwpn9vZodbYJyhsQ3L/PnwT8=\n=x1N5\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T10:07:36Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/2"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Mar/2"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/126632"
},
{
"url": "https://www.apple.com/itunes/"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Mar/2"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-03-11-2026-2 iOS 15.8.7 and iPadOS 15.8.7",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2023-41974",
"type": "related"
},
{
"destId": "CVE-2023-43000",
"type": "related"
},
{
"destId": "CVE-2023-43010",
"type": "related"
},
{
"destId": "CVE-2024-23222",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0226",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/2",
"automated": true,
"contentSha256": "b30ef416ac00b3de8d0cf65118161de49e41b62334a04ac724b7296335a0980e",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/2",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-03-12T02:10:30Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0226"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T07:57:43Z",
"dateUpdated": "2026-09-09T10:07:36Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0226"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…