CVE-2026-28917 | ByteOS Network

Vulnerability Details :

CVE-2026-28917

Assigner-apple

Assigner Org ID-286789f9-fbc2-4510-9f9a-43facdede74c

Published At-11 May, 2026 | 20:08

Updated At-12 May, 2026 | 18:11

The issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

▼Common Vulnerabilities and Exposures (CVE)

Assigner:apple

Assigner Org ID:286789f9-fbc2-4510-9f9a-43facdede74c

Published At:11 May, 2026 | 20:08

Updated At:12 May, 2026 | 18:11

▼CVE Numbering Authority (CNA)

The issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

Affected Products

Vendor

Product

Versions

Affected

From 0 before 18.7.9 (custom)
From 0 before 26.5 (custom)

Vendor

Product

Versions

Affected

From 0 before 26.5 (custom)

Vendor

Product

Versions

Affected

From 0 before 26.5 (custom)

Vendor

Product

Versions

Affected

From 0 before 26.5 (custom)

Vendor

Product

Versions

Affected

From 0 before 26.5 (custom)

Problem Types

Type	CWE ID	Description
N/A	N/A	Processing maliciously crafted web content may lead to an unexpected process crash

Type: N/A

CWE ID: N/A

Description: Processing maliciously crafted web content may lead to an unexpected process crash

References

Hyperlink	Resource
https://support.apple.com/en-us/127110	N/A
https://support.apple.com/en-us/127111	N/A
https://support.apple.com/en-us/127115	N/A
https://support.apple.com/en-us/127118	N/A
https://support.apple.com/en-us/127119	N/A
https://support.apple.com/en-us/127120	N/A

Hyperlink: https://support.apple.com/en-us/127110

Resource: N/A

Hyperlink: https://support.apple.com/en-us/127111

Resource: N/A

Hyperlink: https://support.apple.com/en-us/127115

Resource: N/A

Hyperlink: https://support.apple.com/en-us/127118

Resource: N/A

Hyperlink: https://support.apple.com/en-us/127119

Resource: N/A

Hyperlink: https://support.apple.com/en-us/127120

Resource: N/A

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-20	CWE-20 Improper Input Validation

Type: CWE

CWE ID: CWE-20

Description: CWE-20 Improper Input Validation

Metrics

Version	Base score	Base severity	Vector
3.1	4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Version: 3.1

Base score: 4.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Metrics Other Info

▼National Vulnerability Database (NVD)

Source:product-security@apple.com

Published At:11 May, 2026 | 21:18

Updated At:12 May, 2026 | 19:16

The issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Type: Secondary

Version: 3.1

Base score: 4.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Weaknesses

CWE ID	Type	Source
CWE-20	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-20

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
https://support.apple.com/en-us/127110	product-security@apple.com	N/A
https://support.apple.com/en-us/127111	product-security@apple.com	N/A
https://support.apple.com/en-us/127115	product-security@apple.com	N/A
https://support.apple.com/en-us/127118	product-security@apple.com	N/A
https://support.apple.com/en-us/127119	product-security@apple.com	N/A
https://support.apple.com/en-us/127120	product-security@apple.com	N/A

Hyperlink: https://support.apple.com/en-us/127110

Source: product-security@apple.com

Resource: N/A

Hyperlink: https://support.apple.com/en-us/127111

Source: product-security@apple.com

Resource: N/A

Hyperlink: https://support.apple.com/en-us/127115

Source: product-security@apple.com

Resource: N/A

Hyperlink: https://support.apple.com/en-us/127118

Source: product-security@apple.com

Resource: N/A

Hyperlink: https://support.apple.com/en-us/127119

Source: product-security@apple.com

Resource: N/A

Hyperlink: https://support.apple.com/en-us/127120

Source: product-security@apple.com

Resource: N/A

Similar CVEs

180Records found

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.10% / 27.24%

||

7 Day CHG~0.00%

Published-04 Nov, 2025 | 01:16

Updated-02 Apr, 2026 | 19:20

This issue was addressed through improved state management. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.

Vendor-Apple Inc.

Product-tvos visionos watchos safari iphone_os ipados Safari visionOS macOS tvOS iOS and iPadOS watchOS

CWE ID-CWE-20

Improper Input Validation

CWE ID-CWE-703

Improper Check or Handling of Exceptional Conditions

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.06% / 19.86%

||

7 Day CHG~0.00%

Published-04 Nov, 2025 | 01:17

Updated-02 Apr, 2026 | 19:20

This issue was addressed through improved state management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.

Vendor-Apple Inc.

Product-tvos visionos safari iphone_os ipados Safari visionOS macOS tvOS iOS and iPadOS

CWE ID-CWE-20

Improper Input Validation

CWE ID-CWE-703

Improper Check or Handling of Exceptional Conditions

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.10% / 26.48%

||

7 Day CHG~0.00%

Published-04 Nov, 2025 | 01:17

Updated-02 Apr, 2026 | 19:20

This issue was addressed through improved state management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.

Vendor-Apple Inc.

Product-tvos visionos watchos safari iphone_os ipados Safari visionOS macOS tvOS iOS and iPadOS watchOS

CWE ID-CWE-20

Improper Input Validation

CWE ID-CWE-703

Improper Check or Handling of Exceptional Conditions

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.08% / 24.03%

||

7 Day CHG~0.00%

Published-11 Feb, 2026 | 22:58

Updated-02 Apr, 2026 | 19:21

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. Processing maliciously crafted web content may lead to an unexpected process crash.

Vendor-Apple Inc.

Product-tvos visionos watchos safari macos iphone_os ipados Safari visionOS macOS tvOS iOS and iPadOS watchOS

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.04% / 12.55%

||

7 Day CHG~0.00%

Published-25 Mar, 2026 | 00:32

Updated-02 Apr, 2026 | 18:25

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may lead to an unexpected process crash.

Vendor-Apple Inc.

Product-visionos safari macos iphone_os ipados Safari iOS and iPadOS macOS visionOS

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-Not Assigned

Published-11 May, 2026 | 20:08

Updated-12 May, 2026 | 19:16

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing an audio stream in a maliciously crafted media file may terminate the process.

Vendor-Apple Inc.

Product-watchOS iOS and iPadOS visionOS tvOS macOS

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-Not Assigned

Published-11 May, 2026 | 20:08

Updated-12 May, 2026 | 21:16

The issue was addressed with improved memory handling. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

Vendor-Apple Inc.

Product-watchOS iOS and iPadOS visionOS tvOS macOS

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.05% / 14.77%

||

7 Day CHG~0.00%

Published-29 Aug, 2025 | 00:28

Updated-02 Apr, 2026 | 18:21

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.2. Parsing a maliciously crafted file may lead to an unexpected app termination.

Vendor-Apple Inc.

Product-macos macOS

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.34% / 56.34%

||

7 Day CHG~0.00%

Published-28 Oct, 2024 | 21:08

Updated-02 Apr, 2026 | 19:18

A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 18.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, tvOS 18.1, visionOS 2.1, watchOS 11.1. Processing maliciously crafted web content may lead to an unexpected process crash.

Vendor-Apple Inc.

Product-tvos visionos watchos safari macos iphone_os ipados Safari visionOS macOS tvOS iOS and iPadOS watchOS

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.47% / 64.76%

||

7 Day CHG~0.00%

Published-29 Jul, 2024 | 22:17

Updated-02 Apr, 2026 | 19:17

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing maliciously crafted web content may lead to an unexpected process crash.

Vendor-Apple Inc.

Product-tvos visionos watchos safari macos iphone_os ipados Safari visionOS macOS tvOS iOS and iPadOS watchOS

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.01% / 3.29%

||

7 Day CHG~0.00%

Published-28 Jan, 2026 | 17:26

Updated-02 Apr, 2026 | 19:21

An out-of-bounds read was addressed with improved input validation. This issue is fixed in Pages 15.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1. Processing a maliciously crafted Pages document may result in unexpected termination or disclosure of process memory.

Vendor-Apple Inc.

Product-iphone_os ipados pages macos macOS iOS and iPadOS Pages

CWE ID-CWE-125

Out-of-bounds Read

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.05% / 15.10%

||

7 Day CHG~0.00%

Published-04 Nov, 2025 | 01:16

Updated-02 Apr, 2026 | 19:20

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.

Vendor-Apple Inc.

Product-tvos visionos watchos safari iphone_os ipados Safari visionOS macOS tvOS iOS and iPadOS watchOS

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.05% / 14.66%

||

7 Day CHG~0.00%

Published-04 Nov, 2025 | 01:15

Updated-02 Apr, 2026 | 19:20

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.

Vendor-Apple Inc.

Product-tvos visionos watchos safari iphone_os ipados Safari visionOS macOS tvOS iOS and iPadOS watchOS

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.05% / 14.48%

||

7 Day CHG~0.00%

Published-17 Dec, 2025 | 20:47

Updated-02 Apr, 2026 | 18:23

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected process crash.

Vendor-Apple Inc.

Product-safari visionos ipados macos iphone_os Safari iOS and iPadOS macOS visionOS

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.05% / 15.06%

||

7 Day CHG~0.00%

Published-04 Nov, 2025 | 01:15

Updated-02 Apr, 2026 | 19:20

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.

Vendor-Apple Inc.

Product-tvos visionos macos iphone_os ipados macOS iOS and iPadOS tvOS visionOS

CWE ID-CWE-125

Out-of-bounds Read

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.04% / 11.33%

||

7 Day CHG~0.00%

Published-04 Nov, 2025 | 01:17

Updated-02 Apr, 2026 | 19:20

Multiple issues were addressed by disabling array allocation sinking. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.

Vendor-Apple Inc.

Product-iphone_os visionos safari ipados Safari iOS and iPadOS macOS visionOS

CWE ID-CWE-125

Out-of-bounds Read

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.05% / 15.10%

||

7 Day CHG~0.00%

Published-04 Nov, 2025 | 01:16

Updated-02 Apr, 2026 | 19:20

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected Safari crash.

Vendor-Apple Inc.

Product-visionos watchos safari iphone_os ipados Safari visionOS macOS iOS and iPadOS watchOS

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.05% / 15.06%

||

7 Day CHG~0.00%

Published-04 Nov, 2025 | 01:15

Updated-02 Apr, 2026 | 19:20

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.

Vendor-Apple Inc.

Product-tvos visionos macos iphone_os ipados macOS iOS and iPadOS tvOS visionOS

CWE ID-CWE-125

Out-of-bounds Read

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.05% / 14.31%

||

7 Day CHG~0.00%

Published-04 Nov, 2025 | 01:15

Updated-02 Apr, 2026 | 19:20

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.

Vendor-Apple Inc.

Product-tvos visionos watchos macos iphone_os ipados visionOS macOS tvOS iOS and iPadOS watchOS

CWE ID-CWE-125

Out-of-bounds Read

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.05% / 15.06%

||

7 Day CHG~0.00%

Published-04 Nov, 2025 | 01:15

Updated-02 Apr, 2026 | 19:20

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.

Vendor-Apple Inc.

Product-tvos visionos macos iphone_os ipados macOS iOS and iPadOS tvOS visionOS

CWE ID-CWE-125

Out-of-bounds Read

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.05% / 14.66%

||

7 Day CHG~0.00%

Published-04 Nov, 2025 | 01:15

Updated-02 Apr, 2026 | 19:20

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.

Vendor-Apple Inc.

Product-tvos visionos watchos safari iphone_os ipados Safari visionOS macOS tvOS iOS and iPadOS watchOS

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.04% / 11.24%

||

7 Day CHG-0.05%

Published-17 Dec, 2025 | 20:46

Updated-02 Apr, 2026 | 19:21

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2. Processing maliciously crafted web content may lead to an unexpected process crash.

Vendor-Apple Inc.

Product-iphone_os safari ipados macos Safari iOS and iPadOS macOS

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.07% / 20.33%

||

7 Day CHG~0.00%

Published-04 Nov, 2025 | 01:16

Updated-02 Apr, 2026 | 19:20

This issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.

Vendor-Apple Inc.

Product-tvos visionos watchos safari iphone_os ipados Safari visionOS macOS tvOS iOS and iPadOS watchOS

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.06% / 18.78%

||

7 Day CHG~0.00%

Published-04 Nov, 2025 | 01:15

Updated-02 Apr, 2026 | 19:20

A buffer overflow was addressed with improved bounds checking. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.

Vendor-Apple Inc.

Product-tvos visionos watchos safari iphone_os ipados Safari visionOS macOS tvOS iOS and iPadOS watchOS

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.07% / 21.42%

||

7 Day CHG~0.00%

Published-15 Sep, 2025 | 22:35

Updated-12 May, 2026 | 13:17

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26, iOS 26 and iPadOS 26, macOS Tahoe 26. Processing maliciously crafted web content may lead to an unexpected Safari crash.

Vendor-Apple Inc.Siemens AG

Product-safari iphone_os ipados macos macOS Safari iOS and iPadOS SIMATIC CN 4100

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.03% / 8.80%

||

7 Day CHG~0.00%

Published-21 Nov, 2025 | 21:22

Updated-02 Apr, 2026 | 19:19

A spoofing issue was addressed with improved truncation when displaying the fully qualified domain name. This issue is fixed in Safari 18.5, macOS Sequoia 15.5. A website may be able to spoof the domain name in the title of a pop-up window.

Vendor-Apple Inc.

Product-safari macos Safari macOS

CWE ID-CWE-451

User Interface (UI) Misrepresentation of Critical Information

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.20% / 42.00%

||

7 Day CHG~0.00%

Published-27 Jan, 2025 | 21:46

Updated-02 Apr, 2026 | 19:19

The issue was addressed with improved checks. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3, tvOS 18.3, visionOS 2.3, watchOS 11.3. Parsing a file may lead to an unexpected app termination.

Vendor-Apple Inc.

Product-tvos visionos watchos macos iphone_os ipados visionOS macOS tvOS iOS and iPadOS iPadOS watchOS

CWE ID-CWE-404

Improper Resource Shutdown or Release

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.12% / 30.32%

||

7 Day CHG-0.70%

Published-31 Mar, 2025 | 22:22

Updated-02 Apr, 2026 | 19:19

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, tvOS 18.4, visionOS 2.4, watchOS 11.4. Processing maliciously crafted web content may lead to an unexpected Safari crash.

Vendor-Apple Inc.

Product-tvos visionos safari macos iphone_os ipados Safari visionOS macOS tvOS iOS and iPadOS iPadOS watchOS

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-508

Non-Replicating Malicious Code

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.61% / 69.74%

||

7 Day CHG~0.00%

Published-09 Jun, 2020 | 16:12

Updated-20 Dec, 2025 | 04:55

Known KEV||Action Due Date - 2022-05-03||Apply updates per vendor instructions.

A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5 and iPadOS 13.5, iOS 12.4.7, watchOS 6.2.5, watchOS 5.3.7. Processing a maliciously crafted mail message may lead to heap corruption.

Vendor-Apple Inc.

Product-ipados iphone_os watchos iOS iOS-1 watchOS watchOS-1 iOS, iPadOS, and watchOS

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.16% / 36.50%

||

7 Day CHG-0.96%

Published-31 Mar, 2025 | 22:24

Updated-02 Apr, 2026 | 19:19

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, tvOS 18.4, visionOS 2.4, watchOS 11.4. Processing maliciously crafted web content may lead to an unexpected Safari crash.

Vendor-Apple Inc.

Product-tvos visionos safari macos iphone_os ipados Safari visionOS macOS tvOS iOS and iPadOS iPadOS watchOS

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.05% / 15.10%

||

7 Day CHG~0.00%

Published-04 Nov, 2025 | 01:16

Updated-02 Apr, 2026 | 19:20

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected Safari crash.

Vendor-Apple Inc.

Product-visionos watchos safari iphone_os ipados Safari visionOS macOS iOS and iPadOS watchOS

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.05% / 16.14%

||

7 Day CHG-0.06%

Published-17 Dec, 2025 | 20:46

Updated-02 Apr, 2026 | 18:09

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected process crash.

Vendor-Apple Inc.

Product-safari visionos ipados macos iphone_os Safari iOS and iPadOS macOS visionOS

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.05% / 15.10%

||

7 Day CHG~0.00%

Published-04 Nov, 2025 | 01:17

Updated-02 Apr, 2026 | 19:20

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.

Vendor-Apple Inc.

Product-tvos visionos safari iphone_os ipados Safari visionOS macOS tvOS iOS and iPadOS

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.07% / 20.13%

||

7 Day CHG~0.00%

Published-17 Dec, 2025 | 20:46

Updated-02 Apr, 2026 | 18:09

A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.

Vendor-Apple Inc.

Product-safari visionos ipados macos iphone_os Safari iOS and iPadOS macOS visionOS

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.60% / 69.51%

||

7 Day CHG~0.00%

Published-12 May, 2025 | 21:42

Updated-02 Apr, 2026 | 19:19

A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, watchOS 11.5. Parsing a file may lead to an unexpected app termination.

Vendor-Apple Inc.

Product-tvos visionos watchos macos iphone_os ipados visionOS macOS tvOS iOS and iPadOS iPadOS watchOS

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-1.11% / 78.28%

||

7 Day CHG~0.00%

Published-12 May, 2025 | 21:42

Updated-02 Apr, 2026 | 19:19

A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.

Vendor-Apple Inc.

Product-tvos visionos watchos safari macos iphone_os ipados Safari visionOS macOS tvOS iOS and iPadOS iPadOS watchOS

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-5.3||MEDIUM

EPSS-0.10% / 27.44%

||

7 Day CHG~0.00%

Published-25 Mar, 2026 | 00:32

Updated-02 Apr, 2026 | 18:23

This issue was addressed with improved input validation. This issue is fixed in iOS 26.3 and iPadOS 26.3. An app may be able to access sensitive user data.

Vendor-Apple Inc.

Product-iphone_os ipados iOS and iPadOS

CWE ID-CWE-20

Improper Input Validation

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-5.4||MEDIUM

EPSS-0.04% / 10.90%

||

7 Day CHG~0.00%

Published-17 Mar, 2026 | 22:29

Updated-02 Apr, 2026 | 18:19

A cross-origin issue in the Navigation API was addressed with improved input validation. This issue is fixed in Background Security Improvements for iOS, iPadOS, and macOS, Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may bypass Same Origin Policy.

Vendor-Apple Inc.

Product-iphone_os ipados macos Safari iOS and iPadOS macOS visionOS

CWE ID-CWE-20

Improper Input Validation

CWE ID-CWE-346

Origin Validation Error

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-5.5||MEDIUM

EPSS-0.03% / 8.78%

||

7 Day CHG~0.00%

Published-11 Feb, 2026 | 22:58

Updated-02 Apr, 2026 | 19:21

An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sonoma 14.8.4, macOS Tahoe 26.3, visionOS 26.3, watchOS 26.3. An app may be able to access sensitive user data.

Vendor-Apple Inc.

Product-visionos watchos macos iphone_os ipados macOS watchOS iOS and iPadOS visionOS

CWE ID-CWE-20

Improper Input Validation

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-3.3||LOW

EPSS-0.07% / 20.43%

||

7 Day CHG~0.00%

Published-27 Oct, 2020 | 20:07

Updated-04 Aug, 2024 | 21:31

The issue was addressed with improved validation when an iCloud Link is created. This issue is fixed in iOS 13.3 and iPadOS 13.3. Live Photo audio and video data may be shared via iCloud links even if Live Photo is disabled in the Share Sheet carousel.

Vendor-Apple Inc.

Product-iphone_os ipados iOS and iPadOS

CWE ID-CWE-20

Improper Input Validation

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.60% / 69.59%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. This issue is fixed in Xcode 11.0. Compiling code without proper input validation could lead to arbitrary code execution with user privilege.

Vendor-Apple Inc.

Product-xcode Xcode

CWE ID-CWE-20

Improper Input Validation

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.14% / 33.65%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:31

A validation issue was addressed with improved logic. This issue is fixed in macOS Catalina 10.15.1. A malicious application may be able to gain root privileges.

Vendor-Apple Inc.

Product-mac_os_x macOS

CWE ID-CWE-20

Improper Input Validation

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-3.3||LOW

EPSS-0.24% / 46.22%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:17

An API issue existed in the handling of dictation requests. This issue was addressed with improved validation. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. A malicious application may be able to initiate a Dictation request without user authorization.

Vendor-Apple Inc.

Product-mac_os_x iphone_os watchos tvos tvOS macOS watchOS iOS

CWE ID-CWE-20

Improper Input Validation

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.30% / 53.24%

||

7 Day CHG~0.00%

Published-27 Oct, 2020 | 20:57

Updated-04 Aug, 2024 | 21:24

An input validation issue was addressed with improved input validation. This issue is fixed in iOS 12.3, watchOS 5.2.1. Processing a maliciously crafted message may lead to a denial of service.

Vendor-Apple Inc.

Product-iphone_os watchos watchOS iOS

CWE ID-CWE-20

Improper Input Validation

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.5||HIGH

EPSS-0.54% / 67.61%

||

7 Day CHG~0.00%

Published-27 Oct, 2020 | 19:25

Updated-04 Aug, 2024 | 21:24

An input validation issue was addressed with improved input validation. This issue is fixed in macOS Mojave 10.14.5, Security Update 2019-003 High Sierra, Security Update 2019-003 Sierra, iOS 12.3, watchOS 5.2.1. A remote attacker may be able to cause a system denial of service.

Vendor-Apple Inc.

Product-mac_os_x iphone_os watchos macOS iOS

CWE ID-CWE-20

Improper Input Validation

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.5||HIGH

EPSS-0.77% / 73.65%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:17

A validation issue was addressed with improved logic. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. Processing a maliciously crafted string may lead to a denial of service.

Vendor-Apple Inc.

Product-mac_os_x iphone_os watchos tvos tvOS macOS watchOS iOS

CWE ID-CWE-20

Improper Input Validation

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-3.3||LOW

EPSS-0.15% / 35.68%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement. This issue is fixed in iOS 12.4, tvOS 12.4. A malicious application may be able to restrict access to websites.

Vendor-Apple Inc.

Product-iphone_os tvos tvOS iOS

CWE ID-CWE-20

Improper Input Validation

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.35% / 57.63%

||

7 Day CHG~0.00%

Published-27 Oct, 2020 | 19:45

Updated-04 Aug, 2024 | 21:24

An input validation issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006, macOS Catalina 10.15. An attacker in a privileged network position may be able to leak sensitive user information.

Vendor-Apple Inc.

Product-mac_os_x macOS

CWE ID-CWE-20

Improper Input Validation

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-5.5||MEDIUM

EPSS-0.14% / 33.99%

||

7 Day CHG~0.00%

Published-27 Oct, 2020 | 19:50

Updated-04 Aug, 2024 | 21:31

A resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS 13.1 and iPadOS 13.1, macOS Catalina 10.15. Parsing a maliciously crafted iBooks file may lead to a persistent denial-of-service.

Vendor-Apple Inc.

Product-iphone_os ipad_os mac_os_x macOS iOS and iPadOS

CWE ID-CWE-400

Uncontrolled Resource Consumption

CWE ID-CWE-20

Improper Input Validation

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.22% / 44.55%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.6, Safari 12.1.2. Visiting a malicious website may lead to address bar spoofing.

Vendor-Apple Inc.

Product-safari mac_os_x Safari macOS

CWE ID-CWE-20

Improper Input Validation