PT-2025-47797

Name of the Vulnerable Software and Affected Versions MLX versions prior to 0.29.4 Description MLX, an array framework for machine learning on Apple silicon, contains a heap buffer overflow in the mlx::core::load function when processing malicious NumPy .npy files. A specially crafted file can...

PT-2025-47804

Name of the Vulnerable Software and Affected Versions iOS versions prior to 18.5 iPadOS versions prior to 17.7.7 and prior to 18.5 Description A security issue exists where an attacker with physical access to a device may be able to override managed Wi-Fi profiles. The issue was addressed with...

CVE-2025-55179

Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.23.83 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device. We have not seen...

Google Chrome on iO SInternals Post-Release Reuse Vulnerability

Google Chrome on iOS is a mobile browser designed by Google for Apple cell phone users, supporting cross-device synchronization, multi-tab browsing, voice search and other features to provide a smooth web browsing experience. Google Chrome on iOS suffers from an Internals reuse-after-release...

CVE-2025-60022

The CVE-2025-60022 issue affects the iOS app デジラアプリ (versions prior to 80.10.00). Root cause: improper server certificate validation, enabling a MITM, which could allow eavesdropping or tampering of encrypted communications. Affected platforms: iOS, with impact on confidentiality/integrity as des...

CVE-2024-9126

Use after free in Internals in Google Chrome on iOS prior to 127.0.6533.88 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a series of curated UI gestures. Chromium security severity: Medium...

CVE-2024-13983

Inappropriate implementation in Lens in Google Chrome on iOS prior to 136.0.7103.59 allowed a remote attacker to perform UI spoofing via a crafted QR code. Chromium security severity: Low...

Apple Compressor 安全漏洞

Apple Compressor is a video encoding and transcoding software from Apple USA. A security vulnerability exists in Apple Compressor versions prior to 4.11.1, which stems from an improper default denial of external connections and could lead to the execution of arbitrary code by unauthenticated user...

Apple macOS USD importMeshes Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple macOS. Interaction with the USD library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the USD library. T...

Apple macOS USD readAccessorData Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple macOS. Interaction with the USD library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the USD library. T...

Apple macOS USD importMeshJointWeights Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple macOS. Interaction with the USD library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the USD library. T...

Apple macOS ICC Profile Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple macOS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ICC...

Apple Safari JavaScriptCore Wasm Function Parsing Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple Safari. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of Wasm...

CVE-2025-43205

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. An app may be able to bypass ASLR...

Apple TV < 26.1 Multiple Vulnerabilities (125637)

According to its banner, the version of Apple TV on the remote device is prior to 26.1. It is therefore affected by multiple vulnerabilities as described in the 125637 %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid275165; scriptversion"1.1";...

Stolen iPhones are locked tight, until scammers phish your Apple ID credentials

One of the reassuring things about owning an iPhone was knowing you could lock it if it got lost or stolen. Without your passcode, fingerprint or face to unlock it, it would be useless to anyone else. Now, though, some phone thieves have found a workaround, not by breaking Apple's security, but b...

kernel: efi: Do not import certificates from UEFI Secure Boot for T2 Macs

In the Linux kernel, the following vulnerability has been resolved: efi: Do not import certificates from UEFI Secure Boot for T2 Macs On Apple T2 Macs, when Linux attempts to read the db and dbx efi variables at early boot to load UEFI Secure Boot certificates, a page fault occurs in Apple firmwa...

A week in security (November 3 &#8211; November 9)

Last week on Malwarebytes Labs: Malwarebytes scores 100% in AV-Comparatives Stalkerware Test 2025 Fake CAPTCHA sites now have tutorial videos to help victims install malware Hackers commit highway robbery, stealing cargo and goods Android malware steals your card details and PIN to make instant A...

Apple iOS and iPadOS Cache Mishandling Vulnerability

Apple iOS is an operating system developed for mobile devices.Apple iPadOS is an operating system for the iPad tablet computer. A cache mishandling vulnerability exists in Apple iOS and iPadOS, which can be exploited by attackers to cause malicious applications to track users...

Apple iOS and iPadOS Insufficient Boundary Check Vulnerability

Apple iOS is an operating system developed for mobile devices.Apple iPadOS is an operating system for the iPad tablet computer. Apple iOS and iPadOS suffer from a boundary check insufficiency vulnerability that can be exploited by an attacker to cause a process crash triggered by a malicious HID...