ByteOS

Product

macOS

Versions

Affected

From unspecified before 14.8 (custom)

Vendor

Product

macOS

Versions

Affected

From unspecified before 26.1 (custom)

Vendor

Product

macOS

Versions

Affected

From unspecified before 15.7 (custom)

Problem Types

Type	CWE ID	Description
N/A	N/A	Parsing a file may lead to an unexpected app termination

Type: N/A

CWE ID: N/A

Description: Parsing a file may lead to an unexpected app termination

References

Hyperlink	Resource
https://support.apple.com/en-us/125636	N/A
https://support.apple.com/en-us/125634	N/A
https://support.apple.com/en-us/125635	N/A

Hyperlink: https://support.apple.com/en-us/125636

Resource: N/A

Hyperlink: https://support.apple.com/en-us/125634

Resource: N/A

Hyperlink: https://support.apple.com/en-us/125635

Resource: N/A

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-787	CWE-787 Out-of-bounds Write

Type: CWE

CWE ID: CWE-787

Description: CWE-787 Out-of-bounds Write

Metrics

Version	Base score	Base severity	Vector
3.1	5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Version: 3.1

Base score: 5.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:product-security@apple.com

Published At:04 Nov, 2025 | 02:15

Updated At:17 Dec, 2025 | 21:15

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Type: Secondary

Version: 3.1

Base score: 5.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CPE Matches

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

>>macos>>Versions from 14.0(inclusive) to 14.8.2(exclusive)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

>>macos>>Versions from 15.0(inclusive) to 15.7.2(exclusive)

Weaknesses

CWE ID	Type	Source
CWE-787	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-787

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
https://support.apple.com/en-us/125634	product-security@apple.com	N/A
https://support.apple.com/en-us/125635	product-security@apple.com	Release Notes Vendor Advisory
https://support.apple.com/en-us/125636	product-security@apple.com	Release Notes Vendor Advisory

Hyperlink: https://support.apple.com/en-us/125634

Source: product-security@apple.com

Resource: N/A

Hyperlink: https://support.apple.com/en-us/125635

Source: product-security@apple.com

Resource:

Release Notes

Vendor Advisory

Hyperlink: https://support.apple.com/en-us/125636

Source: product-security@apple.com

Resource:

Release Notes

Vendor Advisory

Similar CVEs

1636Records found

CVE-2016-4233

Matching Score-6

Matching Score-6

CVSS Score-8.8||HIGH

EPSS-3.90% / 88.10%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4175

Matching Score-6

Matching Score-6

CVSS Score-8.8||HIGH

EPSS-50.21% / 97.79%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4124

Matching Score-6

Matching Score-6

Vendor-n/a Adobe Inc.openSUSE Linux Kernel Organization, Inc SUSE Red Hat, Inc.Google LLC Apple Inc.Microsoft Corporation

CVSS Score-8.8||HIGH

EPSS-2.74% / 85.78%

7 Day CHG~0.00%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.

Product-flash_player enterprise_linux_server chrome_os linux_kernel linux_enterprise_workstation_extension opensuse flash_player_desktop_runtime enterprise_linux_desktop enterprise_linux_workstation linux_enterprise_desktop windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4246

Matching Score-6

Matching Score-6

CVSS Score-8.8||HIGH

EPSS-3.90% / 88.10%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, and CVE-2016-4245.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4181

Matching Score-6

Matching Score-6

CVSS Score-8.8||HIGH

EPSS-4.12% / 88.47%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4122

Matching Score-6

Matching Score-6

Vendor-n/a Adobe Inc.openSUSE Linux Kernel Organization, Inc SUSE Red Hat, Inc.Google LLC Apple Inc.Microsoft Corporation

CVSS Score-8.8||HIGH

EPSS-2.74% / 85.78%

7 Day CHG~0.00%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4235

Matching Score-6

Matching Score-6

CVSS Score-8.8||HIGH

EPSS-3.90% / 88.10%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4151

Matching Score-6

Matching Score-6

Vendor-n/a Adobe Inc.openSUSE Linux Kernel Organization, Inc SUSE Red Hat, Inc.Google LLC Apple Inc.Microsoft Corporation

CVSS Score-8.8||HIGH

EPSS-2.74% / 85.78%

7 Day CHG-1.51%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4185

Matching Score-6

Matching Score-6

CVSS Score-8.8||HIGH

EPSS-6.89% / 91.26%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-35984

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.09% / 25.81%

7 Day CHG~0.00%

Published-26 Sep, 2023 | 20:14

Updated-04 Nov, 2025 | 20:16

The issue was addressed with improved checks. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. An attacker in physical proximity can cause a limited out of bounds write.

Vendor-Apple Inc.

Product-tvos watchos ipados macos iphone_os watchOS iOS and iPadOS tvOS macOS

CWE ID-CWE-787

Out-of-bounds Write

CVE-2015-3043

Matching Score-6

Matching Score-6

Product-enterprise_linux_server_aus enterprise_linux_server_from_rhui enterprise_linux_server enterprise_linux_eus evergreen enterprise_linux_desktop windows suse_linux_enterprise_workstation_extension suse_linux_enterprise_desktop linux_kernel flash_player enterprise_linux_workstation opensuse mac_os_x n/a Flash Player

CVSS Score-7.8||HIGH

EPSS-83.92% / 99.29%

7 Day CHG+1.27%

Published-14 Apr, 2015 | 22:00

Updated-17 Nov, 2025 | 20:15

Known KEV||Action Due Date - 2022-03-24||The impacted product is end-of-life and should be disconnected if still in use.

Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as exploited in the wild in April 2015, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, and CVE-2015-3042.

Vendor-n/a Novell Microsoft Corporation Apple Inc.Adobe Inc.openSUSE Linux Kernel Organization, Inc Red Hat, Inc.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2015-0235

Matching Score-6

Assigner-Red Hat, Inc.

Product-communications_eagle_lnp_application_processor communications_session_border_controller communications_webrtc_session_controller php debian_linux linux virtualization communications_eagle_application_processor exalogic_infrastructure communications_lsms communications_application_session_controller vm_virtualbox pureapplication_system security_access_manager_for_enterprise_single_sign-on communications_policy_management glibc mac_os_x communications_user_data_repository n/a

Matching Score-6

Assigner-Red Hat, Inc.

CVSS Score-10||HIGH

EPSS-84.84% / 99.33%

7 Day CHG-1.82%

Published-28 Jan, 2015 | 19:00

Updated-12 Apr, 2025 | 10:46

Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."

Vendor-n/a GNU Red Hat, Inc.The PHP Group Apple Inc.IBM Corporation Debian GNU/Linux Oracle Corporation

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-32397

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.5||HIGH

EPSS-0.10% / 27.86%

7 Day CHG~0.00%

Published-23 Jun, 2023 | 00:00

Updated-05 Dec, 2024 | 16:15

A logic issue was addressed with improved state management. This issue is fixed in iOS 15.7.6 and iPadOS 15.7.6, macOS Big Sur 11.7.7, macOS Monterey 12.6.6, macOS Ventura 13.4. An app may be able to modify protected parts of the file system.

Vendor-Apple Inc.

Product-iphone_os macos ipados macOS iOS and iPadOS

CWE ID-CWE-787

Out-of-bounds Write

CVE-2014-8128

Matching Score-6

Assigner-Red Hat, Inc.

Matching Score-6

Assigner-Red Hat, Inc.

CVSS Score-6.5||MEDIUM

EPSS-1.46% / 80.67%

7 Day CHG~0.00%

Published-12 Feb, 2020 | 02:15

Updated-06 Aug, 2024 | 13:10

LibTIFF prior to 4.0.4, as used in Apple iOS before 8.4 and OS X before 10.10.4 and other products, allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted TIFF image.

Vendor-n/a LibTIFF Apple Inc.

Product-iphone_os mac_os_x libtiff LibTIFF

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-32435

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.41% / 61.35%

7 Day CHG~0.00%

Published-23 Jun, 2023 | 00:00

Updated-23 Oct, 2025 | 18:48

Known KEV||Action Due Date - 2023-07-14||Apply updates per vendor instructions.

A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.7 and iPadOS 15.7.7. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.

Vendor-Apple Inc.

Product-ipados safari iphone_os macos Safari macOS iOS and iPadOS Multiple Products

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-32366

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.08% / 23.24%

7 Day CHG~0.00%

Published-10 Jan, 2024 | 22:03

Updated-26 Aug, 2024 | 21:35

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.7.5, macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, macOS Monterey 12.6.4. Processing a font file may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-iphone_os macos ipados macOS iOS and iPadOS macos ipados

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-8601

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-9.56% / 92.75%

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-itunes iphone_os watchos tvos safari mac_os_x icloud iTunes for Windows watchOS Safari iCloud for Windows macOS iOS tvOS

CWE ID-CWE-787

Out-of-bounds Write

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2023-27936

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.03% / 8.66%

7 Day CHG~0.00%

Published-08 May, 2023 | 00:00

Updated-29 Jan, 2025 | 20:15

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3, iOS 15.7.4 and iPadOS 15.7.4, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. An app may be able to cause unexpected system termination or write kernel memory.

Vendor-Apple Inc.

Product-ipados iphone_os macos iOS and iPadOS macOS

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-2988

Matching Score-6

Matching Score-6

CVSS Score-8.8||HIGH

EPSS-60.86% / 98.28%

7 Day CHG~0.00%

Published-15 Feb, 2017 | 06:11

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability when performing garbage collection. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-chrome_os linux_kernel flash_player_desktop_runtime windows_8.1 windows windows_10 flash_player mac_os_x Adobe Flash Player 24.0.0.194 and earlier.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-30774

Matching Score-6

Assigner-Red Hat, Inc.

Matching Score-6

Assigner-Red Hat, Inc.

CVSS Score-5.5||MEDIUM

EPSS-0.02% / 5.58%

7 Day CHG~0.00%

Published-19 May, 2023 | 00:00

Updated-14 Mar, 2025 | 19:09

A vulnerability was found in the libtiff library. This flaw causes a heap buffer overflow issue via the TIFFTAG_INKNAMES and TIFFTAG_NUMBEROFINKS values.

Vendor-n/a LibTIFF Apple Inc.

Product-macos libtiff libtiff

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-787

Out-of-bounds Write

CVE-2024-45108

Matching Score-6

Matching Score-6

CVSS Score-7.8||HIGH

EPSS-0.21% / 43.70%

7 Day CHG~0.00%

Published-13 Sep, 2024 | 09:37

Updated-18 Sep, 2024 | 14:14

Photoshop Desktop | Out-of-bounds Write (CWE-787)

Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-windows photoshop macos Photoshop Desktop photoshop

CWE ID-CWE-787

Out-of-bounds Write

CVE-2021-30739

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.07% / 21.12%

7 Day CHG~0.00%

Published-08 Sep, 2021 | 13:44

Updated-03 Aug, 2024 | 22:40

A local attacker may be able to elevate their privileges. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave. A memory corruption issue was addressed with improved validation.

Vendor-Apple Inc.

Product-macos mac_os_x macOS

CWE ID-CWE-787

Out-of-bounds Write

CVE-2021-30824

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.29% / 52.33%

7 Day CHG~0.00%

Published-28 Oct, 2021 | 18:17

Updated-03 Aug, 2024 | 22:48

A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.0.1, Security Update 2021-007 Catalina, macOS Big Sur 11.6.1. A malicious application may be able to execute arbitrary code with kernel privileges.

Vendor-Apple Inc.

Product-macos mac_os_x macOS

CWE ID-CWE-787

Out-of-bounds Write

CVE-2024-44126

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.02% / 5.73%

7 Day CHG~0.00%

Published-28 Oct, 2024 | 21:07

Updated-03 Nov, 2025 | 22:18

The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.1, macOS Sequoia 15, iOS 17.7 and iPadOS 17.7, macOS Sonoma 14.7, visionOS 2, iOS 18 and iPadOS 18. Processing a maliciously crafted file may lead to heap corruption.

Vendor-Apple Inc.

Product-ipados visionos iphone_os macos macOS visionOS iOS and iPadOS macos ipados visionos

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-2935

Matching Score-6

Matching Score-6

CVSS Score-8.8||HIGH

EPSS-69.09% / 98.62%

7 Day CHG~0.00%

Published-11 Jan, 2017 | 04:40

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability when processing the Flash Video container file format. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-mac_os_x chrome_os linux_kernel windows_8.1 windows_10 flash_player windows Adobe Flash Player 24.0.0.186 and earlier.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-2996

Matching Score-6

Matching Score-6

CVSS Score-8.8||HIGH

EPSS-2.65% / 85.53%

7 Day CHG~0.00%

Published-15 Feb, 2017 | 06:11

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability in Primetime SDK. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-chrome_os linux_kernel flash_player_desktop_runtime windows_8.1 windows windows_10 flash_player mac_os_x Adobe Flash Player 24.0.0.194 and earlier.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2024-54509

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.07% / 22.46%

7 Day CHG~0.00%

Published-27 Jan, 2025 | 21:46

Updated-03 Nov, 2025 | 21:17

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Sonoma 14.7.2, macOS Sequoia 15.2, macOS Sonoma 14.7.3. An app may be able to cause unexpected system termination or write kernel memory.

Vendor-Apple Inc.

Product-macos macOS

CWE ID-CWE-787

Out-of-bounds Write

CVE-2024-54517

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.09% / 25.50%

7 Day CHG~0.00%

Published-27 Jan, 2025 | 21:45

Updated-31 Jan, 2025 | 21:15

The issue was addressed with improved bounds checks. This issue is fixed in macOS Sequoia 15.2, watchOS 11.2, tvOS 18.2, iOS 18.2 and iPadOS 18.2. An app may be able to corrupt coprocessor memory.

Vendor-Apple Inc.

Product-macos tvos iphone_os watchos ipados tvOS watchOS macOS iOS and iPadOS

CWE ID-CWE-787

Out-of-bounds Write

CVE-2021-30832

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.07% / 20.54%

7 Day CHG~0.00%

Published-19 Oct, 2021 | 13:11

Updated-03 Aug, 2024 | 22:48

A memory corruption issue was addressed with improved state management. This issue is fixed in Security Update 2021-005 Catalina, macOS Big Sur 11.6. A local attacker may be able to elevate their privileges.

Vendor-Apple Inc.

Product-macos mac_os_x macOS

CWE ID-CWE-787

Out-of-bounds Write

CVE-2024-44157

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-5.5||MEDIUM

EPSS-0.08% / 22.72%

7 Day CHG~0.00%

Published-11 Oct, 2024 | 17:26

Updated-12 Dec, 2024 | 19:09

A stack buffer overflow was addressed through improved input validation. This issue is fixed in Apple TV 1.5.0.152 for Windows, iTunes 12.13.3 for Windows. Parsing a maliciously crafted video file may lead to unexpected system termination.

Vendor-Apple Inc.

Product-itunes apple_tv iTunes for Windows Apple TV for Windows

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE ID-CWE-787

Out-of-bounds Write

CVE-2021-30734

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-1.08% / 77.64%

7 Day CHG~0.00%

Published-08 Sep, 2021 | 13:42

Updated-03 Aug, 2024 | 22:40

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-iphone_os watchos ipados tvos safari macos macOS iOS and iPadOS

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-2991

Matching Score-6

Matching Score-6

CVSS Score-8.8||HIGH

EPSS-1.39% / 80.14%

7 Day CHG~0.00%

Published-15 Feb, 2017 | 06:11

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability in the h264 codec (related to decompression). Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-chrome_os linux_kernel flash_player_desktop_runtime windows_8.1 windows windows_10 flash_player mac_os_x Adobe Flash Player 24.0.0.194 and earlier.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2021-30743

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.42% / 61.91%

7 Day CHG~0.00%

Published-08 Sep, 2021 | 13:44

Updated-03 Aug, 2024 | 22:40

An out-of-bounds write was addressed with improved input validation. This issue is fixed in iOS 14.5 and iPadOS 14.5, watchOS 7.4, Security Update 2021-003 Catalina, tvOS 14.5, macOS Big Sur 11.3. Processing a maliciously crafted image may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-iphone_os watchos ipados tvos mac_os_x macos tvOS macOS watchOS iOS and iPadOS

CWE ID-CWE-787

Out-of-bounds Write

CVE-2021-30766

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.55% / 67.56%

7 Day CHG~0.00%

Published-08 Sep, 2021 | 13:46

Updated-03 Aug, 2024 | 22:40

An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.5, Security Update 2021-004 Catalina, Security Update 2021-005 Mojave. An application may be able to execute arbitrary code with kernel privileges.

Vendor-Apple Inc.

Product-macos mac_os_x Security Update - Catalina macOS

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-3069

Matching Score-6

Matching Score-6

Vendor-n/a Linux Kernel Organization, Inc Red Hat, Inc.Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

CVSS Score-8.8||HIGH

EPSS-2.02% / 83.55%

7 Day CHG~0.00%

Published-09 May, 2017 | 16:00

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the BlendMode class. Successful exploitation could lead to arbitrary code execution.

Product-enterprise_linux_desktop chrome_os enterprise_linux_workstation linux_kernel flash_player_desktop_runtime windows_8.1 windows enterprise_linux windows_10 flash_player mac_os_x Adobe Flash Player 25.0.0.148 and earlier.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2024-54523

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-9.1||CRITICAL

EPSS-0.11% / 30.32%

7 Day CHG~0.00%

Published-27 Jan, 2025 | 21:46

Updated-19 Mar, 2025 | 15:15

The issue was addressed with improved bounds checks. This issue is fixed in macOS Sequoia 15.2, watchOS 11.2, tvOS 18.2, iOS 18.2 and iPadOS 18.2. An app may be able to corrupt coprocessor memory.

Vendor-Apple Inc.

Product-watchos iphone_os macos tvos ipados macOS watchOS iOS and iPadOS tvOS

CWE ID-CWE-787

Out-of-bounds Write

CVE-2024-54522

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.10% / 27.80%

7 Day CHG~0.00%

Published-27 Jan, 2025 | 21:46

Updated-06 Feb, 2025 | 16:15

The issue was addressed with improved bounds checks. This issue is fixed in macOS Sequoia 15.2, watchOS 11.2, tvOS 18.2, iOS 18.2 and iPadOS 18.2. An app may be able to corrupt coprocessor memory.

Vendor-Apple Inc.

Product-ipados iphone_os watchos macos tvos tvOS macOS watchOS iOS and iPadOS

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-3068

Matching Score-6

Matching Score-6

Vendor-n/a Linux Kernel Organization, Inc Red Hat, Inc.Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

CVSS Score-8.8||HIGH

EPSS-68.46% / 98.59%

7 Day CHG~0.00%

Published-09 May, 2017 | 16:00

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the Advanced Video Coding engine. Successful exploitation could lead to arbitrary code execution.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-29531

Matching Score-6

Assigner-Mozilla Corporation

Matching Score-6

Assigner-Mozilla Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.55% / 67.77%

7 Day CHG~0.00%

Published-19 Jun, 2023 | 09:48

Updated-11 Dec, 2024 | 16:15

An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable crash. *This bug only affects Firefox and Thunderbird for macOS. Other operating systems are unaffected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.

Vendor-Mozilla Corporation Apple Inc.

Product-firefox thunderbird macos firefox_esr Firefox Firefox ESR Thunderbird

CWE ID-CWE-787

Out-of-bounds Write

CVE-2021-30728

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.29% / 52.33%

7 Day CHG~0.00%

Published-08 Sep, 2021 | 13:41

Updated-03 Aug, 2024 | 22:40

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave. A malicious application may be able to execute arbitrary code with kernel privileges.

Vendor-Apple Inc.

Product-macos mac_os_x macOS

CWE ID-CWE-787

Out-of-bounds Write

CVE-2013-0640

Matching Score-6

Matching Score-6

Product-mac_os_x enterprise_linux_server enterprise_linux_eus windows enterprise_linux_server_aus opensuse linux_enterprise_desktop enterprise_linux_desktop acrobat linux_kernel enterprise_linux_workstation acrobat_reader n/a Reader and Acrobat

CVSS Score-7.8||HIGH

EPSS-92.36% / 99.73%

7 Day CHG-0.19%

Published-14 Feb, 2013 | 01:00

Updated-22 Oct, 2025 | 01:15

Known KEV||Action Due Date - 2022-03-24||Apply updates per vendor instructions.

Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document, as exploited in the wild in February 2013.

Vendor-n/a Microsoft Corporation Apple Inc.Adobe Inc.openSUSE SUSE Linux Kernel Organization, Inc Red Hat, Inc.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-2931

Matching Score-6

Matching Score-6

CVSS Score-8.8||HIGH

EPSS-67.94% / 98.56%

7 Day CHG~0.00%

Published-11 Jan, 2017 | 04:40

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to the parsing of SWF metadata. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-mac_os_x chrome_os linux_kernel windows_8.1 windows_10 flash_player windows Adobe Flash Player 24.0.0.186 and earlier.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-2933

Matching Score-6

Matching Score-6

CVSS Score-8.8||HIGH

EPSS-69.09% / 98.62%

7 Day CHG~0.00%

Published-11 Jan, 2017 | 04:40

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability related to texture compression. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-mac_os_x chrome_os linux_kernel windows_8.1 windows_10 flash_player windows Adobe Flash Player 24.0.0.186 and earlier.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2022-46690

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.11% / 30.34%

7 Day CHG~0.00%

Published-15 Dec, 2022 | 00:00

Updated-21 Apr, 2025 | 14:15

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2, watchOS 9.2. An app may be able to execute arbitrary code with kernel privileges.

Vendor-Apple Inc.

Product-ipados tvos watchos macos iphone_os watchOS tvOS

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-2928

Matching Score-6

Matching Score-6

CVSS Score-8.8||HIGH

EPSS-3.25% / 86.95%

7 Day CHG~0.00%

Published-11 Jan, 2017 | 04:40

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to setting visual mode effects. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-mac_os_x chrome_os linux_kernel windows_8.1 windows_10 flash_player windows Adobe Flash Player 24.0.0.186 and earlier.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2021-30792

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.50% / 65.56%

7 Day CHG~0.00%

Published-08 Sep, 2021 | 13:49

Updated-03 Aug, 2024 | 22:40

An out-of-bounds write was addressed with improved input validation. This issue is fixed in iOS 14.7, macOS Big Sur 11.5. Processing a maliciously crafted image may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-iphone_os macos mac_os_x ipados macOS iOS

CWE ID-CWE-787

Out-of-bounds Write

CVE-2024-54543

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.50% / 65.72%

7 Day CHG+0.08%

Published-27 Jan, 2025 | 21:46

Updated-03 Nov, 2025 | 21:17

The issue was addressed with improved memory handling. This issue is fixed in visionOS 2.2, tvOS 18.2, Safari 18.2, watchOS 11.2, iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2. Processing maliciously crafted web content may lead to memory corruption.

Vendor-Apple Inc.

Product-tvos macos watchos ipados visionos safari iphone_os Safari iOS and iPadOS tvOS visionOS watchOS macOS

CWE ID-CWE-787

Out-of-bounds Write

CVE-2026-21357

Matching Score-6

Matching Score-6

CVSS Score-7.8||HIGH

EPSS-0.01% / 0.80%

7 Day CHG~0.00%

Published-10 Feb, 2026 | 17:59

Updated-26 Feb, 2026 | 14:44

InDesign Desktop | Heap-based Buffer Overflow (CWE-122)

InDesign Desktop versions 21.1, 20.5.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Vendor-Apple Inc.Adobe Inc.Microsoft Corporation

Product-indesign macos windows InDesign Desktop

CWE ID-CWE-122

Heap-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-29308

Matching Score-6

Matching Score-6

CVSS Score-7.8||HIGH

EPSS-0.14% / 34.13%

7 Day CHG~0.00%

Published-12 Jul, 2023 | 15:56

Updated-05 Mar, 2025 | 18:51

[FG-VD-23-009] Adobe InDesign 2023 Arbitrary Code Execution Vulnerability Notification

Adobe InDesign versions ID18.3 (and earlier) and ID17.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Vendor-Apple Inc.Adobe Inc.Microsoft Corporation

Product-windows indesign macos InDesign

CWE ID-CWE-787

Out-of-bounds Write

CVE-2026-21283

Matching Score-6

Matching Score-6