Apple vulnerabilities

CVE-2026-28873 High · 7.5 CWE-863 May 11, 2026

Incorrect Authorization in Apple Ipados

This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.4 and iPadOS 26.4. An app may be able to circumvent App Privacy Report logging.

CVE-2026-28872 High · 7.5 CWE-400 May 11, 2026

Uncontrolled Resource Consumption in Apple Ipados

A resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.4 and iPadOS 26.4. A remote attacker may be able to cause a denial-of-service.

CVE-2026-28860 High · 7.5 CWE-20 May 11, 2026

Improper Input Validation in Apple Ipados

The issue was addressed with improved input validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. A local attacker may be able to modify the state of the Keychain.

CVE-2026-28848 High · 7.5 CWE-121 May 11, 2026

Stack-based Buffer Overflow in Apple Macos

A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.7, macOS Tahoe 26.5. A remote attacker may be able to cause unexpected system termination.

CVE-2026-28847 High · 8.8 CWE-119 May 11, 2026

Buffer Errors (Improper Restriction of Operations within Memory Bounds) in Apple Ipados

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2026-28846 High · 7.5 CWE-121 May 11, 2026

Stack-based Buffer Overflow in Apple Ipados

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. A remote attacker may be able to cause unexpected app termination.

CVE-2026-28840 High · 7.8 CWE-269 May 11, 2026

Improper Privilege Management in Apple Macos

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.4. An app may be able to gain root privileges.

CVE-2026-28830 Medium · 4.7 CWE-362 May 11, 2026

Race Condition in Apple Macos

A race condition was addressed with additional validation. This issue is fixed in macOS Tahoe 26.4. An app may be able to access sensitive user data.

CVE-2026-28819 Medium · 5.4 CWE-787 May 11, 2026

Out-of-bounds Write in Apple Ipados

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to execute arbitrary code with kernel privileges.

CVE-2026-20696 Medium · 5.5 CWE-862 May 11, 2026

Missing Authorization in Apple Macos

An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.4. An app may be able to access sensitive user data.

CVE-2026-28909 Medium · 6.5 CWE-522 Apr 30, 2026

Insufficiently Protected Credentials in Apple Container

Users who connect to malicious registries with hostnames matching the bypass patterns will have their registry credentials exposed in plaintext. This issue is fixed in container version 0.12.3.

CVE-2026-28950 Medium · 6.2 CWE-359 Apr 22, 2026

A logging issue was addressed with improved data redaction. This issue is fixed in iOS…

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 15.8.8 and iPadOS 15.8.8, iOS 16.7.16 and iPadOS 16.7.16, iOS 18.7.8 and iPadOS 18.7.8, iOS 26.4.2 and iPadOS 26.4.2, iPadOS 17.7.11. Notifications marked for deletion could be unexpectedly retained on the device.

CVE-2026-28815 High · 7.5 CWE-125 Apr 3, 2026

Out-of-bounds Read in Apple Swift-crypto

A remote attacker can supply a short X-Wing HPKE encapsulated key and trigger an out-of-bounds read in the C decapsulation path, potentially causing a crash or memory disclosure depending on runtime protections. This issue is fixed in swift-crypto version 4.3.1.

CVE-2025-43264 High · 8.8 CWE-119 Apr 2, 2026

Buffer Errors (Improper Restriction of Operations within Memory Bounds) in Apple Macos

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6. Processing a maliciously crafted image may corrupt process memory.

CVE-2025-43257 High · 8.7 CWE-59 Apr 2, 2026

Link Following in Apple Macos

This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.6. An app may be able to break out of its sandbox.

CVE-2025-43238 Medium · 6.2 CWE-190 Apr 2, 2026

Integer Overflow or Wraparound in Apple Macos

An integer overflow was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to cause unexpected system termination.

CVE-2025-43236 Low · 3.3 CWE-843 Apr 2, 2026

Type Confusion in Apple Macos

A type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An attacker may be able to cause unexpected app termination.

CVE-2025-43219 High · 8.8 CWE-787 Apr 2, 2026

Out-of-bounds Write in Apple Macos

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6. Processing a maliciously crafted image may corrupt process memory.

CVE-2025-43210 Medium · 6.3 CWE-125 Apr 2, 2026

Out-of-bounds Read in Apple Ipados

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.

CVE-2025-43202 High · 8.8 CWE-787 Apr 2, 2026

Out-of-bounds Write in Apple Ipados

This issue was addressed with improved memory handling. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6. Processing a file may lead to memory corruption.

CVE-2024-44303 High · 7.5 CWE-284 Apr 2, 2026

Improper Access Control in Apple Macos

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.1. A malicious application may be able to modify protected parts of the file system.

CVE-2024-44286 High · 7.5 CWE-288 Apr 2, 2026

Authentication Bypass Using an Alternate Path or Channel in Apple Macos

This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.1. An attacker with physical access can input keyboard events to apps running on a locked device.

CVE-2024-44250 High · 8.2 CWE-269 Apr 2, 2026

Improper Privilege Management in Apple Macos

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges.

CVE-2024-44219 High · 7.5 CWE-284 Apr 2, 2026

Improper Access Control in Apple Macos

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. A malicious application with root privileges may be able to access private information.

CVE-2024-40858 High · 7.1 CWE-284 Apr 2, 2026

Improper Access Control in Apple Macos

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. An app may be able to access Contacts without user consent.