GCVE-1988-2026-0455

Vulnerability from gna-1988 – Published: 2026-11-02 07:29 – Updated: 2026-11-02 07:29
VLAI
Title
APPLE-SA-10-26-2026-3 iOS 18.7.11 and iPadOS 18.7.11
Summary
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-10-26-2026-3 iOS 18.7.11 and iPadOS 18.7.11 iOS 18.7.11 and iPadOS 18.7.11 addresses the following issues. Information about the security content is also available at https://support.apple.com/149225. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Audio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generationAir 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later Impact: An app may be able to leak sensitive user information Description: A logic issue was addressed with improved checks. CVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik Tsytsarkin CoreGraphics Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generationAir 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later Impact: Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-86950: Meta Product Security CoreMedia Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generationAir 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later Impact: A malicious app may be able to access the camera without user permission Description: An access issue was addressed with improved access restrictions. CVE-2026-86990: Mustafa Calap (@ordinal0, dbg.re) This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. * The version after applying this update will be "iOS 18.7.11 and iPadOS 18.7.11". All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmrfvLQACgkQ4Ifiq8DH 7PWbphAAuvTfoY9oqnKSiTdILV7Y9cN7MluSTQWgr292dJaIgSCdaeDZl1liUcE3 5VG8kFU6ynsxlPm1bHEUzxj+2uTaOpNcvrVw876YES7S6v/TQ73PLncQDQ8aviQ3 P6+FWGfui2mWNTshGeSbCJIp8k68ew+sJP8S+qr8F1E3fHMGxXaDx6wYjuTf68Sf +rBfpn0trEQpyO7xPGLTgOi6Cv28rnAXzX5iMYL3yCpXWZ0F4FqKpTw0cKUbPpQb fCQA33bgmTWtWeynLSxAOX91Sm3AGRchpeKkf7SU4saj3pDcjU8iHPDjpFWo/E3J vBT6vWjR95s+6hEFEoKvP48ezjnsD6Mz5Hrkq6KbWzBs5GgB0ySg1S4rbgDADPVp aDsEz6qbF5NB+aExc6F7/eFcJHDo31lGbmxUreTBgyUkUQ32tztttMmKRyQ3Teyt 1XSxM6ajFldpDlNN8hJJ8Q3zvmurwRI/pAKQxs+VhquxKS2ZpVE2WD3Df4EAqIWd 8Tbt1FH7pA7hqAN9wOcrs3/aNGNFEK3weTMQiRzgmfTJ5/pLHBXAHOeahTEfnCmX /6WuGviJHrrrWzQjcTmqh2ZH8jjC7moU5bBAYelH7LmCsvo1eBMJ6p+N1vGt2N5G d1PtmpFWz0zoqdiKBjoiKAP55yzYWh4YHSvzBIQPLBgtGnR/pl8= =aO7b -----END PGP SIGNATURE----- _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
VULNARCHIVE GNA GNA-1988
GNA scorecard E 38/100 over 556 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
unknown iOS Affected: unknown
guessed Create a notification for this product.
Credits
Apple Product Security via Fulldisclosure
Relationships
reference GCVE-1988-2026-0455 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "iOS",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-10-26-2026-3 iOS 18.7.11 and iPadOS 18.7.11\n\niOS 18.7.11 and iPadOS 18.7.11 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/149225.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th\ngenerationAir 4th generation and later, iPad 9th generation and later,\nand iPad mini 6th generation and later\nImpact: An app may be able to leak sensitive user information\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik\nTsytsarkin\n\nCoreGraphics\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th\ngenerationAir 4th generation and later, iPad 9th generation and later,\nand iPad mini 6th generation and later\nImpact: Processing a maliciously crafted file may lead to arbitrary code\nexecution. Apple is aware of a report that this issue may have been\nexploited in an extremely sophisticated attack against specific targeted\nindividuals on versions of iOS before iOS 27.\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-86950: Meta Product Security\n\nCoreMedia\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th\ngenerationAir 4th generation and later, iPad 9th generation and later,\nand iPad mini 6th generation and later\nImpact: A malicious app may be able to access the camera without user\npermission\nDescription: An access issue was addressed with improved access\nrestrictions.\nCVE-2026-86990: Mustafa Calap (@ordinal0, dbg.re)\n\nThis update is available through iTunes and Software Update on your iOS\ndevice, and will not appear in your computer\u0027s Software Update\napplication, or in the Apple Downloads site. Make sure you have an\nInternet connection and have installed the latest version of iTunes from\nhttps://www.apple.com/itunes/\n\niTunes and Software Update on the device will automatically check\nApple\u0027s update server on its weekly schedule. When an update is\ndetected, it is downloaded and the option to be installed is presented\nto the user when the iOS device is docked. We recommend applying the\nupdate immediately if possible. Selecting Don\u0027t Install will present the\noption the next time you connect your iOS device.\n\nThe automatic update process may take up to a week depending on the\nday that iTunes or the device checks for updates. You may manually\nobtain the update via the Check for Updates button within iTunes, or\nthe Software Update on your device.\n\nTo check that the iPhone, iPod touch, or iPad has been updated:\n\n* Navigate to Settings\n* Select General\n* Select About.\n* The version after applying this update will be \"iOS 18.7.11 and iPadOS\n18.7.11\".\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmrfvLQACgkQ4Ifiq8DH\n7PWbphAAuvTfoY9oqnKSiTdILV7Y9cN7MluSTQWgr292dJaIgSCdaeDZl1liUcE3\n5VG8kFU6ynsxlPm1bHEUzxj+2uTaOpNcvrVw876YES7S6v/TQ73PLncQDQ8aviQ3\nP6+FWGfui2mWNTshGeSbCJIp8k68ew+sJP8S+qr8F1E3fHMGxXaDx6wYjuTf68Sf\n+rBfpn0trEQpyO7xPGLTgOi6Cv28rnAXzX5iMYL3yCpXWZ0F4FqKpTw0cKUbPpQb\nfCQA33bgmTWtWeynLSxAOX91Sm3AGRchpeKkf7SU4saj3pDcjU8iHPDjpFWo/E3J\nvBT6vWjR95s+6hEFEoKvP48ezjnsD6Mz5Hrkq6KbWzBs5GgB0ySg1S4rbgDADPVp\naDsEz6qbF5NB+aExc6F7/eFcJHDo31lGbmxUreTBgyUkUQ32tztttMmKRyQ3Teyt\n1XSxM6ajFldpDlNN8hJJ8Q3zvmurwRI/pAKQxs+VhquxKS2ZpVE2WD3Df4EAqIWd\n8Tbt1FH7pA7hqAN9wOcrs3/aNGNFEK3weTMQiRzgmfTJ5/pLHBXAHOeahTEfnCmX\n/6WuGviJHrrrWzQjcTmqh2ZH8jjC7moU5bBAYelH7LmCsvo1eBMJ6p+N1vGt2N5G\nd1PtmpFWz0zoqdiKBjoiKAP55yzYWh4YHSvzBIQPLBgtGnR/pl8=\n=aO7b\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-02T07:29:56Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/41"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Oct/41"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/149225"
        },
        {
          "url": "https://www.apple.com/itunes/"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Oct/41"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-10-26-2026-3 iOS 18.7.11 and iPadOS 18.7.11",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-65339",
              "type": "related"
            },
            {
              "destId": "CVE-2026-86950",
              "type": "related"
            },
            {
              "destId": "CVE-2026-86990",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0455",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/41",
            "automated": true,
            "contentSha256": "7f3402a1acc396631dbfc82ad13455aa2be2b366e9c5ff0b4b7a3527e953293f",
            "evidenceScore": 6,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Oct/41",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-10-26T21:41:05Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0455"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-11-02T07:29:56Z",
    "dateUpdated": "2026-11-02T07:29:56Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0455"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.