CVE-2025-24141

Apple fixed an authentication issue in iOS 18.3 and iPadOS 18.3 that could allow an attacker with physical access to an unlocked device to access Photos when the app is locked. The vulnerability (CVE-2025-24141) is tied to improved state management in the Accessibility flow, with the impact descr...

CVE-2024-23206

CVE-2024-23206 is a WebKitGTK fingerprinting vulnerability observed across multiple ecosystems. The connected documents show an access issue where a maliciously crafted webpage can fingerprint the user, with fixes implemented in WebKit-derived GTK ports. Affected components include webkitgtk/webk...

CVE-2023-42890

CVE-2023-42890 affects WebKitGTK/WebKitGTK+ via a memory-handling issue when processing web content that could lead to arbitrary code execution. Affected platforms include Apple Safari/WebKit on macOS/iOS/watchOS/tvOS and WebKitGTK4 deployments. Mitigation provided by upstream patches and platfor...

CVE-2024-44136

CVE-2024-44136 affects Apple iOS and iPadOS, with fixed in iOS 17.5 and iPadOS 17.5. Root cause: improved state management. Impact: a local attacker with physical access may disable Stolen Device Protection. Affected component: Face ID-related flow per Apple security content; remediation is upgra...

CVE-2022-32888

CVE-2022-32888 is an out-of-bounds write vulnerability in WebKit/related components that affects Apple platforms. The connected documents confirm the issue is addressed with improved bounds checking and is fixed in macOS Big Sur 11.7, macOS Monterey 12.6, macOS Ventura 13, iOS 16, iOS 15.7 and iP...

CVE-2022-32947

CVE-2022-32947 affects Apple platforms (iOS/iPadOS/macOS) and is tied to memory handling issues in GPU/Kernel components that could allow an app to execute arbitrary code with kernel privileges. Public documentation confirms the vulnerability could enable kernel-level code execution and that patc...

CVE-2020-3878

CVE-2020-3878 is an out-of-bounds read vulnerability in Apple’s ImageIO component. According to Apple security updates, it affects iOS 13.5/iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5, iTunes for Windows, and iCloud for Windows; processing a maliciously crafted image may lead ...

CVE-2020-9910

CVE-2020-9910 is a WebKit-related vulnerability that allowed a malicious attacker with arbitrary read and write capability to bypass Pointer Authentication. Apple's security updates indicate this issue affects iOS/iPadOS (13.6), tvOS (13.4.8), watchOS (6.2.8), Safari (13.1.2), and corresponding W...

CVE-2022-32788

CVE-2022-32788 is a buffer overflow in Apple’s AppleAVD component that could allow a remote attacker to cause kernel code execution. Affected products include watchOS 8.7, tvOS 15.6, iOS 15.6, iPadOS 15.6, and macOS Monterey 12.5. The issue was mitigated by applying bounds checking improvements a...

CVE-2024-23271

CVE-2024-23271 is a logic-issue in WebKit/WebKitGTK affecting Apple platforms (iOS/iPadOS/macOS/tvOS/watchOS) and WebKitGTK. It can cause unexpected cross-origin behavior when visiting a malicious site. Public details confirm fixes in iOS/iPadOS 17.3, macOS Sonoma 14.3, Safari 17.3, tvOS 17.3, wa...

CVE-2024-54508

CVE-2024-54508 affects WebKitGTK (webkit2gtk). The issue arises from processing maliciously crafted web content and can lead to an unexpected process crash; memory-related impact is also indicated in related entries. Public advisories confirm fixes in WebKitGTK/WebKit2GTK packages across distribu...

CVE-2021-30740

CVE-2021-30740 is a logic issue addressed by improved input validation, fixed in macOS Big Sur 11.4 and iOS/iPadOS 14.6, tvOS 14.6, and watchOS 7.5. A malicious app could potentially execute arbitrary code with kernel privileges. The description and connected records confirm the affected platform...

CVE-2022-32912

CVE-2022-32912 - Summary: An out-of-bounds read vulnerability in WebKit/WebKitGTK was addressed by improving bounds checking. The issue could allow memory disclosure or arbitrary code execution when processing malicious web content. Affected/affected components appear in WebKitGTK/WebKit across m...

CVE-2022-32854

CVE-2022-32854 affects Apple platforms (iOS/iPadOS/macOS). The issue is a logic flaw in privacy-related components (ATS/Contacts) that could allow an app to bypass Privacy preferences. Fixed in iOS 15.7, iPadOS 15.7, iOS 16, and macOS Big Sur 11.7 (and related updates). The primary impact stated ...

CVE-2025-24143

CVE-2025-24143 is a fingerprinting vulnerability involving WebKit-derived components. The core issue appears to be insufficient access restrictions to the local file system, allowing a malicious webpage to fingerprint the user. Apple patched this in macOS Sequoia 15.3, Safari 18.3, iOS 18.3, iPad...

CVE-2021-30737

CVE-2021-30737 is an iOS/macOS NSS ASN.1 decoding issue in Apple’s secasn1d.c, fixed in iOS 14.6. The root cause is a memory corruption primitive arising from Apple’s NSS fork’s ASN.1 bit-string handling. A path in sec_asn1d_parse_bit_string can set the destination item’s Data pointer to NULL for...

CVE-2022-22633

CVE-2022-22633 is a memory corruption vulnerability in Apple’s Accelerate Framework that can be triggered by opening a maliciously crafted PDF, potentially leading to arbitrary code execution. It is fixed in watchOS 8.5, iOS 15.4 / iPadOS 15.4, macOS Big Sur 11.6.5, and macOS Monterey 12.3. Publi...

CVE-2024-54502

CVE-2024-54502 is a WebKitGTK/WebKit-based issue where processing maliciously crafted web content could cause an unexpected process crash. Publicly provided connected documents confirm this CVE is discussed across multiple advisories and platforms, with fixes released in various vendor updates. A...

CVE-2022-42825

CVE-2022-42825 affects Apple platforms including tvOS, macOS, iOS, iPadOS, watchOS and macOS Big Sur/Monterey/Ventura families. The issue stems from entitlement handling that allowed an app to modify protected parts of the file system. Fixed releases: tvOS 16.1, macOS Ventura 13, watchOS 9.1, iOS...

CVE-2023-23503

CVE-2023-23503 describes a logic issue in Apple’s privacy state management that may allow an app to bypass Privacy preferences. The vulnerability is fixed in macOS Ventura 13.2, iOS 16.3/iPadOS 16.3, iOS 15.7.3/iPadOS 15.7.3, tvOS 16.3, and watchOS 9.3. No exploit details are provided in the sour...

CVE-2023-40446

CVE-2023-40446 in Apple software was mitigated by improved memory handling. Processing malicious input could lead to arbitrary code execution in user-installed apps. Fixed in macOS Monterey 12.7.1; iOS 16.7.2 and iPadOS 16.7.2; iOS 17.1 and iPadOS 17.1. No exploitation details are provided in the...

CVE-2020-9800

CVE-2020-9800 is a type-confusion vulnerability in WebKit that was fixed in Apple platforms (iOS 13.5/iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, Windows/iCloud components as noted). The issue involved improved memory handling and could lead to arbitrary code execution when processing...

CVE-2022-22634

CVE-2022-22634 affects Apple’s AVEVideoEncoder component on tvOS, iOS, and iPadOS. The issue is a buffer overflow that was addressed by improved bounds checking, enabling arbitrary code execution with kernel privileges on the affected devices. Affected firmwares include tvOS 15.4, iOS 15.4, and i...

CVE-2020-3825

CVE-2020-3825 concerns memory corruption in WebKit-based components used by Apple Safari/WebKit across multiple platforms. The Initial document notes that processing maliciously crafted web content may lead to arbitrary code execution. Affected products/areas (from Apple advisories) include Safar...

CVE-2022-26766

CVE-2022-26766 is a certificate parsing issue addressed by Apple in updates for multiple OSes. The advisory states that a malicious app may bypass signature validation due to improved checks in certificate parsing. Affected and fixed versions include: tvOS 15.5; iOS 15.5 and iPadOS 15.5; watchOS ...

CVE-2023-23500

CVE-2023-23500 is a memory-handling issue in Apple operating systems that could allow an app to leak sensitive kernel state. The vulnerability is addressed in macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3, and in older releases iOS 15.7.3/iPadOS 15.7.3, tvOS 16.3, and watchOS 9.3. Connected source...

CVE-2024-23208

CVE-2024-23208 affects Apple’s kernel memory handling and can enable an app to execute arbitrary code with kernel privileges. Publicly documented fixes apply to macOS Sonoma 14.3, watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3. The Apple IOS 17.3 advisory confirms the Kernel impact and the mem...

CVE-2025-31204

The CVE-2025-31204 issue affects WebKitGTK/WebKit components as applied in affected platforms, where processing maliciously crafted web content may lead to memory corruption. The available connected documents indicate the root cause is memory handling deficiencies, with the vulnerability fixed by...

CVE-2022-42803

CVE-2022-42803 describes a race condition that could allow an app to execute arbitrary code with kernel privileges. The vulnerability is addressed by multiple Apple operating system updates: tvOS 16.1, iOS 15.7.1 and iPadOS 15.7.1, macOS Ventura 13, watchOS 9.1, iOS 16.1 and iPadOS 16, and macOS ...

CVE-2020-3829

CVE-2020-3829 corresponds to an out-of-bounds read fixed by Apple across multiple platforms. The Apple advisories show the vulnerability contributing to elevated-privilege risk and are mitigated by updates: iOS 13.3.1, iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, and watchOS 6.1.2. In the ...

CVE-2025-31278

CVE-2025-31278 is a WebKitGTK/WebKit2GTK memory corruption issue triggered by processing malicious web content. The connected documents confirm the vulnerability affecting WebKitGTK/WebKit in multiple ecosystems and provide concrete fixes: Debian/Ubuntu-style advisories fix webkit2gtk to version ...

CVE-2022-22643

CVE-2022-22643 concerns FaceTime on Apple devices. Description: A user may send audio and video in a FaceTime call without knowing that they have done so. Connected docs confirm affected platforms (iOS/iPadOS/macOS) and state the issue was fixed in iOS 15.4, iPadOS 15.4, and macOS Monterey 12.3 t...

CVE-2024-44185

CVE-2024-44185 affects Apple’s WebKit-based components and is fixed by updated builds in multiple Apple OS releases. The issue causes an unexpected process crash when processing maliciously crafted web content and is addressed in tvOS 17.6, visionOS 1.3, Safari 17.6, watchOS 10.6, iOS 17.6 / iPad...

CVE-2022-26731

CVE-2022-26731 is a logic-issue vulnerability in Apple software where a malicious website could track users in Safari private browsing mode. The issue is addressed through improved state management and is fixed in macOS Monterey 12.4, iOS 15.5, and iPadOS 15.5. Affected components include Safari/...

CVE-2023-23498

CVE-2023-23498 pertains to a logic issue in Apple's software stack where improved state management fixes an issue that could cause the quoted original message to be selected from the wrong email when forwarding an Exchange message. Affected platforms include iOS 15.7.3/iPadOS 15.7.3, iOS 16.3/iPa...

CVE-2022-22596

CVE-2022-22596 covers a memory corruption issue in Apple kernel components that could allow arbitrary code execution with kernel privileges. The vulnerability is addressed by updates in iOS 15.4, iPadOS 15.4, and watchOS 8.5. The initial description notes a memory corruption problem mitigated by ...

CVE-2023-42833

CVE-2023-42833 is a WebKitGTK/WebKitGTK+ correctness issue where processing web content could lead to arbitrary code execution. The vendor advisory notes fixes in macOS Sonoma 14, Safari 17, iOS 17, and iPadOS 17. Root cause: improved checks in WebKit to address the vulnerability. Practical impac...

CVE-2024-40782

CVE-2024-40782 is a WebKitGTK/use-after-free vulnerability where processing malicious web content could cause an unexpected process crash. It is addressed in Apple platforms as: iOS 16.7.9 and iPadOS 16.7.9; Safari 17.6; iOS 17.6 and iPadOS 17.6; watchOS 10.6; tvOS 17.6; visionOS 1.3; macOS Sonom...

CVE-2020-3840

CVE-2020-3840 describes an off-by-one error in the handling of racoon configuration files within IPSec-related components. The underlying issue arises from improper bounds checking, which could allow a maliciously crafted racoon config to trigger arbitrary code execution. Apple and Red Hat record...

CVE-2022-22614

CVE-2022-22614 is a use-after-free vulnerability that Apple addressed across multiple platforms. The issue could allow arbitrary code execution with kernel privileges and is fixed by updates: tvOS 15.4; iOS 15.4 and iPadOS 15.4; macOS Big Sur 11.6.5; Security Update 2022-003 Catalina; watchOS 8.5...

CVE-2025-24137

CVE-2025-24137 is a type confusion issue addressed by Apple in multiple updates: iPadOS 17.7.4, macOS Sonoma 14.7.3, visionOS 2.3, iOS 18.3, iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, and tvOS 18.3. The vulnerability could allow a remote attacker to cause an unexpected application termination...

CVE-2022-46693

The CVE-2022-46693 entry describes an out-of-bounds write vulnerability addressed by input-validation improvements. Affected products/versions include tvOS 16.2, iCloud for Windows 14.1, macOS Ventura 13.1, iOS 16.2, iPadOS 16.2, and watchOS 9.2. The issue can be triggered by processing a malicio...

CVE-2023-23531

CVE-2023-23531 affects Apple platforms (macOS Ventura 13.2, iOS 16.3, iPadOS 16.3) and was caused by memory-handling issues that could let an app execute arbitrary code in its sandbox or with elevated privileges. Apple indicates the issue is fixed in the listed updates. Any exploitation requires ...

CVE-2023-35074

CVE-2023-35074 relates to a memory handling issue in WebKit/WebKitGTK used by Apple platforms (tvOS, Safari, watchOS, iOS, iPadOS, macOS Sonoma) and WebKitGTK-based environments. The vendor advisories state that processing web content may lead to arbitrary code execution, and the fix is a memory-...

CVE-2023-42875

CVE-2023-42875 is an arbitrary-code-execution vulnerability in WebKit/WebKitGTK components triggered by processing certain web content. The issue stems from improper memory handling. It is addressed in various advisories: Apple platforms (iOS 17, iPadOS 17, macOS Sonoma 14, watchOS 10, tvOS 17, S...

CVE-2023-42883

CVE-2023-42883 involves WebKitGTK/WebKit-based components where processing an image can cause a denial-of-service due to an underlying memory handling issue. The vulnerability is addressed in Apple platforms (Safari 17.2, macOS Sonoma 14.2, iOS 17.2/iPadOS 17.2, watchOS 10.2, tvOS 17.2; with olde...

CVE-2020-9976

CVE-2020-9976 is an Apple security issue identified as a logic bug in a state-management path that could allow a malicious app to leak sensitive user information. The vulnerability is documented across Apple advisories for iOS 14.0/iPadOS 14.0, tvOS 14.0, and watchOS 7.0, with remediation deliver...

CVE-2025-24223

The CVE-2025-24223 issue is a memory corruption vulnerability in WebKit-based components affecting multiple Apple platforms. The advisory states that the flaw is triggered by processing maliciously crafted web content and is mitigated by memory handling improvements, with fixes shipped in: watchO...

CVE-2026-64778

CVE-2026-64778 affects WebKit History in Apple platforms: a logic issue allowed visiting a malicious website to leak sensitive data. Fixed in iOS 18.7.10, iPadOS 18.7.10, iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2 via improved checks. No in-the-wild exploitation reported; CVSS 6.5 (Medium).

CVE-2020-9870

CVE-2020-9870 is a WebKit/JavaScriptCore-related logic issue that allowed bypassing exploit mitigations (StructureID randomization, the Gigacage, and PAC/APRR) to achieve arbitrary memory read/write. The published material describes bypassing StructureID checks via crafted JSArray/JSCell headers,...