CVE-2022-22638

CVE-2022-22638 involves a null pointer dereference that was fixed through improved validation. Affected across Apple platforms: tvOS 15.4, iOS 15.4, iPadOS 15.4, macOS Big Sur 11.6.5, Security Update 2022-003 Catalina, watchOS 8.5, and macOS Monterey 12.3. The issue could allow a privileged attac...

CVE-2024-23284

CVE-2024-23284 concerns a logic issue in WebKitGTK/WebKit rendering where processing maliciously crafted web content may prevent Content Security Policy (CSP) from being enforced. The connected sources show the same vulnerability across multiple distributions (e.g., Debian webkit2gtk advisories a...

CVE-2024-54543

CVE-2024-54543 is a memory corruption flaw in WebKit when processing maliciously crafted web content. Apple’s advisories enumerate fixed products/versions: visionOS 2.2, tvOS 18.2, Safari 18.2, watchOS 11.2, iOS 18.2, iPadOS 18.2, macOS Sequoia 15.2. Connected sources (e.g., WebKit GTK deployment...

CVE-2025-24163

CVE-2025-24163 affects Apple platforms and has been fixed in multiple OS updates (iOS/iPadOS 18.3, macOS Sonoma 14.7.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3, iPadOS 17.7.4, visionOS 2.3). The issue is described as: Parsing a file may lead to an unexpected app termination in CoreAudio. Conn...

CVE-2022-26710

CVE-2022-26710 is a use-after-free vulnerability in WebKitGTK/WebKit2GTK that could lead to arbitrary code execution when processing malicious web content. Connected advisories identify WebKitGTK/WebKit2GTK as affected, with fixed updates in downstream distributions (e.g., AL2/AL8 advisories and ...

CVE-2020-9849

CVE-2020-9849 affects Apple platforms including macOS Big Sur 11.0.1, iOS/iPadOS 14.0, watchOS 7.0, tvOS 14.0, and related Windows components. The issue is described as an information disclosure due to improved state management that may allow memory leakage. Remediation is to update to the listed...

CVE-2024-54505

CVE-2024-54505 is a memory corruption vulnerability in WebKitGTK (WebKit2GTK) caused by a type confusion when processing malicious web content. Public advisories confirm fixes in WebKitGTK/WebKit packages: Debian 11 bullseye 2.46.5-1~deb11u1 and Debian 12 bookworm 2.46.5-1~deb12u1; AlmaLinux 8/9 ...

CVE-2025-24208

CVE-2025-24208 affects WebKitGTK (webkitgtk) where loading a malicious iframe may lead to a cross-site scripting (XSS) attack. Public advisories confirm the issue and list it among fixed CVEs in multiple distro advisories (e.g., Debian DSA-5899-1 and AlmaLinux/ALSA advisories) with remediation vi...

CVE-2024-23213

CVE-2024-23213 is a memory-handling vulnerability in WebKit (as used by WebKitGTK/WebKit in various OS ecosystems) that may allow arbitrary code execution when processing web content. Public disclosures in connected documents show fixes across multiple platforms: Apple family (watchOS/iOS/macOS/S...

CVE-2024-23263

CVE-2024-23263 is a WebKitGTK/WebKitGTK4 vulnerability observed in multiple Linux package advisories (webkit2gtk, webkitgtk4) and Debian Fedora Amazon Linux updates. The issue arises from processing maliciously crafted web content that may prevent Content Security Policy from being enforced. Conn...

CVE-2022-32923

CVE-2022-32923 is a correctness issue in the JIT that may disclose internal app states when processing malicious web content. Affected products include tvOS 16.1, iOS 15.7.1 and iPadOS 15.7.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 and iPadOS 16. The vulnerability is fixed in these ...

CVE-2022-42823

CVE-2022-42823 describes a type confusion vulnerability in WebKit (affecting WebKitGTK/WebKit2GTK and related WebKit variants) that could allow arbitrary code execution when processing maliciously crafted web content. The issue is addressed by memory-management improvements and fixes are listed f...

CVE-2024-54479

CVE-2024-54479 is documented in Debian security advisories as affecting WebKitGTK/webkit2gtk, where processing maliciously crafted web content may lead to an unexpected process crash. Debian reports this under webkit2gtk in both Debian 11 (bookworm) and LTS context, fixed in webkit2gtk version 2....

CVE-2025-24118

CVE-2025-24118 affects Apple’s kernel on iPadOS/macOS. The issue is described as an out-of-bounds/write-related memory handling race in credential updates (proc_ro.p_ucred) that could allow a kernel crash or credential corruption. Reports in connected sources provide PoCs and demonstrations of a ...

CVE-2022-32832

CVE-2022-32832: Apple security issue tied to memory handling that could allow an app with root privileges to execute arbitrary code with kernel privileges. The vulnerability is addressed via updates across Apple operating systems, including iOS 15.6/iPadOS 15.6, macOS Big Sur 11.6.8, macOS Monter...

CVE-2022-42824

CVE-2022-42824 is a WebKitGTK/WebKit runtime logic issue that may disclose sensitive user information when processing malicious web content. The connected advisories confirm WebKitGTK/WebKitGTK-related fixes (CVE-2022-42824) across multiple distributions: Debian DLA-3183-1 and DSA-5274-1 for wpew...

CVE-2022-32947

CVE-2022-32947 affects Apple platforms (iOS/iPadOS/macOS) and is tied to memory handling issues in GPU/Kernel components that could allow an app to execute arbitrary code with kernel privileges. Public documentation confirms the vulnerability could enable kernel-level code execution and that patc...

CVE-2024-23206

CVE-2024-23206 is a WebKitGTK fingerprinting vulnerability observed across multiple ecosystems. The connected documents show an access issue where a maliciously crafted webpage can fingerprint the user, with fixes implemented in WebKit-derived GTK ports. Affected components include webkitgtk/webk...

CVE-2024-44187

Summary of CVE-2024-44187 (Cross-origin iframe data exfiltration) A cross-origin issue existed involving iframe elements in WebKitGTK/WebKit2GTK, allowing a malicious site to exfiltrate data across origins. The root cause is stated as inadequate tracking of security origins for iframes. Affected ...

CVE-2023-42890

CVE-2023-42890 affects WebKitGTK/WebKitGTK+ via a memory-handling issue when processing web content that could lead to arbitrary code execution. Affected platforms include Apple Safari/WebKit on macOS/iOS/watchOS/tvOS and WebKitGTK4 deployments. Mitigation provided by upstream patches and platfor...

CVE-2025-24141

Apple fixed an authentication issue in iOS 18.3 and iPadOS 18.3 that could allow an attacker with physical access to an unlocked device to access Photos when the app is locked. The vulnerability (CVE-2025-24141) is tied to improved state management in the Accessibility flow, with the impact descr...

CVE-2020-3878

CVE-2020-3878 is an out-of-bounds read vulnerability in Apple’s ImageIO component. According to Apple security updates, it affects iOS 13.5/iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5, iTunes for Windows, and iCloud for Windows; processing a maliciously crafted image may lead ...

CVE-2020-9910

CVE-2020-9910 is a WebKit-related vulnerability that allowed a malicious attacker with arbitrary read and write capability to bypass Pointer Authentication. Apple's security updates indicate this issue affects iOS/iPadOS (13.6), tvOS (13.4.8), watchOS (6.2.8), Safari (13.1.2), and corresponding W...

CVE-2022-32888

CVE-2022-32888 is an out-of-bounds write vulnerability in WebKit/related components that affects Apple platforms. The connected documents confirm the issue is addressed with improved bounds checking and is fixed in macOS Big Sur 11.7, macOS Monterey 12.6, macOS Ventura 13, iOS 16, iOS 15.7 and iP...

CVE-2024-44136

CVE-2024-44136 affects Apple iOS and iPadOS, with fixed in iOS 17.5 and iPadOS 17.5. Root cause: improved state management. Impact: a local attacker with physical access may disable Stolen Device Protection. Affected component: Face ID-related flow per Apple security content; remediation is upgra...

CVE-2024-54508

CVE-2024-54508 affects WebKitGTK (webkit2gtk). The issue arises from processing maliciously crafted web content and can lead to an unexpected process crash; memory-related impact is also indicated in related entries. Public advisories confirm fixes in WebKitGTK/WebKit2GTK packages across distribu...

CVE-2022-32788

CVE-2022-32788 is a buffer overflow in Apple’s AppleAVD component that could allow a remote attacker to cause kernel code execution. Affected products include watchOS 8.7, tvOS 15.6, iOS 15.6, iPadOS 15.6, and macOS Monterey 12.5. The issue was mitigated by applying bounds checking improvements a...

CVE-2022-32912

CVE-2022-32912 - Summary: An out-of-bounds read vulnerability in WebKit/WebKitGTK was addressed by improving bounds checking. The issue could allow memory disclosure or arbitrary code execution when processing malicious web content. Affected/affected components appear in WebKitGTK/WebKit across m...

CVE-2024-23271

CVE-2024-23271 is a logic-issue in WebKit/WebKitGTK affecting Apple platforms (iOS/iPadOS/macOS/tvOS/watchOS) and WebKitGTK. It can cause unexpected cross-origin behavior when visiting a malicious site. Public details confirm fixes in iOS/iPadOS 17.3, macOS Sonoma 14.3, Safari 17.3, tvOS 17.3, wa...

CVE-2021-30740

CVE-2021-30740 is a logic issue addressed by improved input validation, fixed in macOS Big Sur 11.4 and iOS/iPadOS 14.6, tvOS 14.6, and watchOS 7.5. A malicious app could potentially execute arbitrary code with kernel privileges. The description and connected records confirm the affected platform...

CVE-2025-24143

CVE-2025-24143 is a fingerprinting vulnerability involving WebKit-derived components. The core issue appears to be insufficient access restrictions to the local file system, allowing a malicious webpage to fingerprint the user. Apple patched this in macOS Sequoia 15.3, Safari 18.3, iOS 18.3, iPad...

CVE-2026-64778

CVE-2026-64778 affects WebKit History in Apple platforms: a logic issue allowed visiting a malicious website to leak sensitive data. Fixed in iOS 18.7.10, iPadOS 18.7.10, iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2 via improved checks. No in-the-wild exploitation reported; CVSS 6.5 (Medium).

CVE-2021-30737

CVE-2021-30737 is an iOS/macOS NSS ASN.1 decoding issue in Apple’s secasn1d.c, fixed in iOS 14.6. The root cause is a memory corruption primitive arising from Apple’s NSS fork’s ASN.1 bit-string handling. A path in sec_asn1d_parse_bit_string can set the destination item’s Data pointer to NULL for...

CVE-2022-32854

CVE-2022-32854 affects Apple platforms (iOS/iPadOS/macOS). The issue is a logic flaw in privacy-related components (ATS/Contacts) that could allow an app to bypass Privacy preferences. Fixed in iOS 15.7, iPadOS 15.7, iOS 16, and macOS Big Sur 11.7 (and related updates). The primary impact stated ...

CVE-2022-42825

CVE-2022-42825 affects Apple platforms including tvOS, macOS, iOS, iPadOS, watchOS and macOS Big Sur/Monterey/Ventura families. The issue stems from entitlement handling that allowed an app to modify protected parts of the file system. Fixed releases: tvOS 16.1, macOS Ventura 13, watchOS 9.1, iOS...

CVE-2024-54502

CVE-2024-54502 is a WebKitGTK/WebKit-based issue where processing maliciously crafted web content could cause an unexpected process crash. Publicly provided connected documents confirm this CVE is discussed across multiple advisories and platforms, with fixes released in various vendor updates. A...

CVE-2025-31278

CVE-2025-31278 is a WebKitGTK/WebKit2GTK memory corruption issue triggered by processing malicious web content. The connected documents confirm the vulnerability affecting WebKitGTK/WebKit in multiple ecosystems and provide concrete fixes: Debian/Ubuntu-style advisories fix webkit2gtk to version ...

CVE-2022-22633

CVE-2022-22633 is a memory corruption vulnerability in Apple’s Accelerate Framework that can be triggered by opening a maliciously crafted PDF, potentially leading to arbitrary code execution. It is fixed in watchOS 8.5, iOS 15.4 / iPadOS 15.4, macOS Big Sur 11.6.5, and macOS Monterey 12.3. Publi...

CVE-2022-22634

CVE-2022-22634 affects Apple’s AVEVideoEncoder component on tvOS, iOS, and iPadOS. The issue is a buffer overflow that was addressed by improved bounds checking, enabling arbitrary code execution with kernel privileges on the affected devices. Affected firmwares include tvOS 15.4, iOS 15.4, and i...

CVE-2023-23500

CVE-2023-23500 is a memory-handling issue in Apple operating systems that could allow an app to leak sensitive kernel state. The vulnerability is addressed in macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3, and in older releases iOS 15.7.3/iPadOS 15.7.3, tvOS 16.3, and watchOS 9.3. Connected source...

CVE-2026-65351

CVE-2026-65351 is a WebKit state management flaw in Apple's browser engine; processing malicious web content can crash Safari. It is fixed in Safari 26.6.1, iOS/iPadOS 26.6.1, and macOS Tahoe 26.6.2. No exploitation reported; CISA assesses technical impact as partial. Users should apply the relev...

CVE-2023-23503

CVE-2023-23503 describes a logic issue in Apple’s privacy state management that may allow an app to bypass Privacy preferences. The vulnerability is fixed in macOS Ventura 13.2, iOS 16.3/iPadOS 16.3, iOS 15.7.3/iPadOS 15.7.3, tvOS 16.3, and watchOS 9.3. No exploit details are provided in the sour...

CVE-2023-40446

CVE-2023-40446 in Apple software was mitigated by improved memory handling. Processing malicious input could lead to arbitrary code execution in user-installed apps. Fixed in macOS Monterey 12.7.1; iOS 16.7.2 and iPadOS 16.7.2; iOS 17.1 and iPadOS 17.1. No exploitation details are provided in the...

CVE-2020-3825

CVE-2020-3825 concerns memory corruption in WebKit-based components used by Apple Safari/WebKit across multiple platforms. The Initial document notes that processing maliciously crafted web content may lead to arbitrary code execution. Affected products/areas (from Apple advisories) include Safar...

CVE-2020-9800

CVE-2020-9800 is a type-confusion vulnerability in WebKit that was fixed in Apple platforms (iOS 13.5/iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, Windows/iCloud components as noted). The issue involved improved memory handling and could lead to arbitrary code execution when processing...

CVE-2022-26766

CVE-2022-26766 is a certificate parsing issue addressed by Apple in updates for multiple OSes. The advisory states that a malicious app may bypass signature validation due to improved checks in certificate parsing. Affected and fixed versions include: tvOS 15.5; iOS 15.5 and iPadOS 15.5; watchOS ...

CVE-2024-23208

CVE-2024-23208 affects Apple’s kernel memory handling and can enable an app to execute arbitrary code with kernel privileges. Publicly documented fixes apply to macOS Sonoma 14.3, watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3. The Apple IOS 17.3 advisory confirms the Kernel impact and the mem...

CVE-2025-31204

The CVE-2025-31204 issue affects WebKitGTK/WebKit components as applied in affected platforms, where processing maliciously crafted web content may lead to memory corruption. The available connected documents indicate the root cause is memory handling deficiencies, with the vulnerability fixed by...

CVE-2022-42803

CVE-2022-42803 describes a race condition that could allow an app to execute arbitrary code with kernel privileges. The vulnerability is addressed by multiple Apple operating system updates: tvOS 16.1, iOS 15.7.1 and iPadOS 15.7.1, macOS Ventura 13, watchOS 9.1, iOS 16.1 and iPadOS 16, and macOS ...

CVE-2020-3829

CVE-2020-3829 corresponds to an out-of-bounds read fixed by Apple across multiple platforms. The Apple advisories show the vulnerability contributing to elevated-privilege risk and are mitigated by updates: iOS 13.3.1, iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, and watchOS 6.1.2. In the ...