CVE-2024-27835

CVE-2024-27835 affects Apple iOS and iPadOS where notes could be accessed from the lock screen due to a state-management issue in the Notes component. Root cause: improved state management in the affected UI path. Impact: local attacker with physical access could view notes on a locked device. Re...

CVE-2024-44252

Summary: CVE-2024-44252 describes a logic issue in Apple's backup/file handling that could allow restoration of a maliciously crafted backup to modify protected system files. The vulnerability is addressed in Apple security updates across multiple platforms, with fixes in iOS 18.1, iPadOS 18.1, i...

CVE-2024-54550

CVE-2024-54550 concerns Apple platforms: macOS Sequoia, iOS, and iPadOS. The issue arises from the Contact Information Handler, enabling an app to view autocompleted contact information from Messages/Mail in system logs. Root cause described as improved redaction in macOS/iOS/iPadOS updates. Affe...

CVE-2025-24177

CVE-2025-24177 is an Apple AirPlay vulnerability. The description notes a null pointer dereference that was addressed by improved input validation, with a fixed patch in macOS Sequoia 15.3 and iOS/iPadOS 18.3. The CVE entry indicates a possible remote denial-of-service if exploited. Connected App...

CVE-2025-24212

CVE-2025-24212 describes a sandbox-escape issue addressed by Apple via updated checks. Affected platforms include visionOS 2.4, macOS Ventura 13.7.5, tvOS 18.4, iPadOS 17.7.6, iOS 18.4/iPadOS 18.4, macOS Sequoia 15.4, and macOS Sonoma 14.7.5. The issue’s root cause is summarized as improved check...

CVE-2025-30433

The CVE-2025-30433 issue concerns the Shortcuts app on Apple platforms where a shortcut could access files normally inaccessible to Shortcuts. The root cause is insufficient access restrictions within the Shortcuts environment. Affects multiple Apple OS lines; fixes are delivered as OS updates: i...

CVE-2025-30465

CVE-2025-30465 is a permissions issue in Shortcuts where a shortcut could access files normally inaccessible. Root cause: insufficient validation allowed access to restricted files. Fixes are in macOS Ventura 13.7.5, iPadOS 17.7.6, macOS Sequoia 15.4, and macOS Sonoma 14.7.5. Impact: potential un...

CVE-2026-28941

Apple fixed CVE-2026-28941 across macOS Sequoia 15.7.7, macOS Tahoe 26.5, iOS 18.7.9 and iPadOS 18.7.9. The issue involves processing a maliciously crafted file that may cause denial of service or disclose memory contents. The root cause is described as an improved checks/validation in the affect...

CVE-2019-8838

CVE-2019-8838 is a kernel memory corruption issue affecting Apple platforms. The vulnerability could allow an application to execute arbitrary code with kernel privileges. It is fixed in macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra, tvOS 13.3, iOS ...

CVE-2020-27933

CVE-2020-27933 is a memory corruption issue affecting Apple ImageIO (notably in iCloud for Windows 7.20 and related macOS/iOS/watchOS/tvOS updates). The root cause is memory corruption when processing a maliciously crafted image, addressed by Apple via improved input validation and memory handlin...

CVE-2020-29614

CVE-2020-29614 affects Apple platforms and is described as a heap corruption issue triggered by processing a maliciously crafted file. The description lists affected releases and a fixed status: macOS Big Sur 11.2; Security Update 2021-001 Catalina and Mojave; macOS Big Sur 11.1; Security Update ...

CVE-2020-3872

CVE-2020-3872 is a memory initialization issue in Apple platforms causing an application to read restricted memory. It is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, and watchOS 6.1.2. Affected components are kernel/memory handling across Apple OS releases; remedia...

CVE-2020-3874

The CVE-2020-3874 entry concerns an issue in the naming of Screenshots within Messages on iOS/iPadOS. According to the Apple security content, an issue allowed Screenshots to reveal additional message content, and this was fixed in iOS 13.3.1 / iPadOS 13.3.1. The core problem is described as a mi...

CVE-2020-3919

CVE-2020-3919 corresponds to a memory initialization issue in Apple IOHIDFamily that could allow a malicious application to execute arbitrary code with kernel privileges. Concrete details in connected documents show the vulnerability affecting Apple platforms and components across multiple OS lin...

CVE-2020-9813

CVE-2020-9813 describes a logic issue causing memory corruption in Apple systems. The issue could allow a malicious application to execute arbitrary code with kernel privileges. Apple’s advisories show the fix being applied in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, and wat...

CVE-2020-9906

CVE-2020-9906 (Apple iOS/macOS/watchOS) - AWDL SyncTree TLV heap overflow, remote kernel impact The issue arises in the iOS/macOS AWDL kernel parser (IO80211AWDLPeer). The SyncTree TLV (type 0x14) length is validated with a 1024-byte upper bound when TLVs are parsed, but the code copies 6-byte MA...

CVE-2020-9932

CVE-2020-9932 is a memory corruption issue in Apple’s WebKit/Web content handling that could allow arbitrary code execution when processing malicious web content. Root cause described as memory corruption due to improved validation. Affected software includes Safari 13.0.1, iOS 13.1 and iPadOS 13...

CVE-2020-9973

CVE-2020-9973 is an out-of-bounds read vulnerability in Apple’s Model I/O handling of USD files. The issue allows processing a maliciously crafted USD file to potentially terminate the application or execute arbitrary code. Apple attributes the fix to improved bounds checking, and remediation is ...

CVE-2021-1777

CVE-2021-1777 affects Apple macOS/iOS/watchOS/tvOS image processing, with the issue fixed in macOS Big Sur 11.2 and Security Update 2021-001 for Catalina and Mojave, plus corresponding watchOS/tvOS/iOS updates. The vulnerability description states that processing a maliciously crafted image may l...

CVE-2021-30825

CVE-2021-30825 concerns Apple’s CoreML MLMODEL parsing. The ZDI advisory (ZDI-22-354) describes an out-of-bounds read in CoreML’s MLMODEL file processing, which can be leveraged to cause arbitrary code execution and information disclosure. Apple’s security content for iOS 15/iPadOS 15 states the ...

CVE-2021-30945

CVE-2021-30945 affects Apple platforms: macOS Big Sur 11.6.2, tvOS 15.2, macOS Monterey 12.1, Security Update 2021-008 Catalina, iOS 15.2 / iPadOS 15.2, and watchOS 8.3. The issue is described as fixed by improved checks, with the vulnerability enabling a local attacker to elevate privileges. Aff...

CVE-2022-26760

CVE-2022-26760 is a memory corruption issue in Apple's Wi‑Fi stack that was addressed with improved state management. Affected products are iOS and iPadOS; fixed in iOS 15.5 / iPadOS 15.5. Remediation: update to the 15.5 (or later) releases. Exploitation details are not provided in the supplied d...

CVE-2022-46725

CVE-2022-46725 is a WebKitGTK/WebKit URL handling spoofing vulnerability. The advisory notes a spoofing issue in URL handling that could mislead users via address bar manipulation and indicates it was mitigated by improved input validation. Affected software inclusion (via the Alibaba Cloud Linux...

CVE-2023-42884

CVE-2023-42884 affects Apple platforms; the issue is an information-disclosure vulnerability allowing an app to disclose kernel memory. Root cause and vulnerable surface are described across sources as a memory-redaction/handling flaw. Fixed in macOS Sonoma 14.2, iOS 17.2 / iPadOS 17.2, macOS Ven...

CVE-2024-23287

CVE-2024-23287 concerns a privacy issue in Apple platforms where improved handling of temporary files fixes a vulnerability that could allow an app to access user-sensitive data. Affected products/versions (per provided documents): macOS Sonoma 14.4, iOS 17.4, iPadOS 17.4, watchOS 10.4. The entry...

CVE-2024-27884

CVE-2024-27884 affects Apple platforms (macOS Sonoma 14.5, watchOS 10.5, visionOS 1.2, tvOS 17.5, iOS 17.5 and iPadOS 17.5). Description in multiple sources indicates the issue was addressed with a new entitlement, enabling an app to access user-sensitive data. In visionOS security content, CVE-2...

CVE-2024-40784

CVE-2024-40784 involves an integer overflow that was addressed by improved input validation. The issue affects Apple platforms when processing a maliciously crafted file, potentially causing an unexpected app termination. Public disclosures in connected sources (Red Hat, CIRCL, Nessus/OPENVAS sum...

CVE-2025-24238

CVE-2025-24238 is an Apple vulnerability tied to a logic issue in the libxpc/privilege checks that could allow an app to obtain elevated privileges. The issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5, and on iOS/iPadOS 18.4 and tvOS 18.4. Connected documents expli...

CVE-2026-65331

CVE-2026-65331 is a WebKit state management vulnerability in Apple's Safari browser. Processing maliciously crafted web content may lead to an unexpected Safari crash (denial of service). The issue was addressed through improved state management (WebKit Bugzilla 317611), reported by OpenAI Codex ...

CVE-2019-8833

CVE-2019-8833 affects Apple’s kernel component and describes a memory corruption vulnerability. The issue was mitigated by removing the vulnerable code and is fixed in macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra, tvOS 13.3, iOS 13.3, and iPadOS 13...

CVE-2020-27908

CVE-2020-27908 is an Apple macOS/audio issue where an out-of-bounds read in CoreAudio during processing of a maliciously crafted audio file could lead to arbitrary code execution. The vulnerability affects macOS and iOS-family OS updates and was addressed by input-validation hardening and memory ...

CVE-2020-29639

CVE-2020-29639 concerns an out-of-bounds read issue in the Apple font parsing component (FontParser) across Apple platforms. The public docs from Apple reference fixes via improved input validation for FontParser, with citations in iOS 14.0/iPadOS 14.0 and watchOS 7.0 advisories. Specifically, in...

CVE-2020-9792

CVE-2020-9792 affects the Apple USB Audio component across iOS/iPadOS/macOS. A validation issue in the USB Audio handling could allow a plugged-in USB device to cause a denial of service. Exploitation would be local (physical USB connection). Apple resolved this with fixes in iOS 13.5, iPadOS 13....

CVE-2020-9812

CVE-2020-9812 is an information-disclosure flaw in Apple platforms where a local user could read kernel memory due to an issue with state management in the kernel. Affected: iOS/iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. Impact: local read of kernel memory; no remote vector ...

CVE-2020-9949

CVE-2020-9949 is a use-after-free vulnerability reported by Apple, affecting CoreCapture and related macOS/iOS/watchOS components. It could allow arbitrary code execution with kernel/system privileges. Apple patched this in macOS Big Sur 11.0.1, macOS Catalina 10.15.6 (and Security Update 2020-00...

CVE-2021-30763

CVE-2021-30763 involves an input-validation issue in ActionKit on Apple iOS/iPadOS. Affected: iOS 14.7 and iPadOS 14.7; impact described as a shortcut that may bypass Internet permission requirements. Root cause: improved input validation fixes address the issue. Mitigation: apply iOS 14.7 / iPad...

CVE-2021-30947

CVE-2021-30947 affects Apple platforms (macOS Big Sur, Monterey; iOS/iPadOS 15.2; tvOS 15.2; watchOS 8.3). Root cause: an access issue addressed by implementing additional sandbox restrictions, potentially allowing an application to access a user’s files. Fixes are in macOS Big Sur 11.6.2, macOS ...

CVE-2021-30993

CVE-2021-30993 involves a kernel-level buffer overflow in Apple’s OS stack. The description confirms a memory handling issue that could allow an attacker in a privileged network position to execute arbitrary code. Publicly documented fixes target macOS Monterey 12.1 and Apple OS updates for watch...

CVE-2022-32898

CVE-2022-32898 is an Apple Kernel/Apple Neural Engine memory‑handling issue that could allow arbitrary code execution with kernel privileges. The connected exploit notes describe a memory corruption path in ANE’s program creation (ANE_ProgramCreate_gated) via an overflow of a planes array, contro...

CVE-2022-42813

CVE-2022-42813 concerns a certificate validation issue in WKWebView. It affects Apple platforms and is addressed in tvOS 16.1, iOS 16.1 / iPadOS 16, macOS Ventura 13, and watchOS 9.1. The vulnerability could allow processing a malicious certificate to execute arbitrary code. Affected component: W...

CVE-2023-32389

CVE-2023-32389 is an Apple kernel memory disclosure vulnerability affecting multiple Apple platforms (iOS 16.5 and iPadOS 16.5, watchOS 9.5, tvOS 16.5, macOS Ventura 13.4). The issue is described as an information disclosure that could allow an app to disclose kernel memory. The CVE entry lists a...

CVE-2023-32399

CVE-2023-32399 concerns a Core Location information disclosure in Apple platforms. The issue allows an app to read sensitive location data due to inadequate handling of caches and was fixed in iOS 16.5 and iPadOS 16.5, watchOS 9.5, tvOS 16.5, and macOS Ventura 13.4. Affected components include Co...

CVE-2023-42936

CVE-2023-42936 affects Apple platforms and is connected to Apple’s update fixing an issue where an app may access user-sensitive data due to improved redaction of sensitive information. The public entry lists fixes in macOS Monterey 12.7.2, macOS Ventura 13.6.3, iOS 17.2, iPadOS 17.2, tvOS 17.2, ...

CVE-2024-27799

CVE-2024-27799 affects Apple OSes: macOS Sonoma 14.5, macOS Ventura 13.6.7, macOS Monterey 12.7.5, and iOS 16.7.8 / iPadOS 16.7.8. The issue arises from insufficient entitlement checks, allowing an unprivileged app to log keystrokes in other apps, including those using secure input mode. Apple’s ...

CVE-2024-27810

CVE-2024-27810 is a path handling issue fixed by improved validation. Affected platforms: iOS/iPadOS 17.5, tvOS 17.5, watchOS 10.5, macOS Sonoma 14.5. Impact stated: an app may read sensitive location information. Remediation: upgrade to the fixed OS versions (iOS/iPadOS 17.5, tvOS 17.5, watchOS ...

CVE-2024-27839

The CVE-2024-27839 entry describes a Find My privacy vulnerability in iOS/iPadOS where a malicious app could determine a user’s current location. impact is privacy leakage; root cause relates to how location data is handled for Find My. Apple fixed this in iOS 17.5 and iPadOS 17.5. Affected produ...

CVE-2024-40836

CVE-2024-40836 relates to a logic issue in Shortcuts on Apple platforms. Affected products include watchOS 10.6, macOS Sonoma 14.6, iOS 17.6 and iPadOS 17.6, and iOS 16.7.9 / iPadOS 16.7.9. The issue could allow a shortcut to access sensitive data via certain actions without prompting the user. I...

CVE-2024-44240

CVE-2024-44240 is a font-processing vulnerability in Apple platforms where processing a maliciously crafted font may disclose process memory. According to the primary description, impact is limited to confidentiality (C) with no integrity/availability impact stated, and the issue is fixed in mult...

CVE-2024-44241

CVE-2024-44241 affects Apple iOS and iPadOS components in DCP firmware. Connected sources confirm that the vulnerability was addressed by improved bounds checks and is fixed in iOS 18.1 and iPadOS 18.1. The CVE is described as enabling a potential attacker to cause unexpected system termination o...

CVE-2024-54564

The CVE-2024-54564 issue concerns Apple platforms, where a file received over AirDrop may not have the quarantine flag applied due to an improved state-management approach. This affects visionOS 1.3, macOS Sonoma 14.6, iOS 17.6, and iPadOS 17.6, where the quarantine handling was addressed and fix...