CVE-2023-37450

CVE-2023-37450 is a WebKit/WebKitGTK-related vulnerability where processing web content may lead to arbitrary code execution. Apple’s documentation states the issue was addressed with improved checks and memory handling, with fixes in iOS 16.6 / iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventur...

CVE-2023-23529

CVE-2023-23529 is a type confusion vulnerability in WebKit/WebKitGTK that could allow arbitrary code execution when processing malicious web content. Apple’s advisory covers iOS/iPadOS/macOS/Safari patches (iOS 15.7.4, 16.3.1, macOS Ventura 13.2.1, Safari 16.3) and notes active exploitation repor...

CVE-2021-30807

CVE-2021-30807 is a memory-corruption flaw in Apple’s IOMobileFrameBuffer kernel extension that can allow an app to execute arbitrary code with kernel privileges. The issue affects iOS, iPadOS, macOS (and watchOS via related advisories) and is fixed in macOS Big Sur 11.5.1, iOS 14.7.1 and iPadOS ...

CVE-2016-9843

CVE-2016-9843 concerns zlib 1.2.8 and its crc32_big implementation (big-endian CRC calculation). Connected docs show affected packages: FLTK builds for zlib before 1.3.8-1 in CBLMariner, and Cloud Foundry/ALAS advisories link multiple zlib-related CVEs with remediation guidance. The FLTK note sta...

CVE-2020-27950

CVE-2020-27950 is a memory initialization issue in Apple’s XNU kernel that could allow a malicious app to disclose kernel memory. The CVE is fixed in multiple Apple updates: macOS Big Sur 11.0.1, iOS 14.2/iPadOS 14.2, watchOS 7.1, watchOS 6.2.9, and Security Updates for macOS Catalina 10.15.7 (Su...

CVE-2021-30883

CVE-2021-30883 is an memory-corruption vulnerability in Apple’s IOMobileFrameBuffer that can allow a malicious app to execute arbitrary code with kernel privileges. Apple patched it across iOS/iPadOS 14.8.1 and 15.0.2, macOS Big Sur 11.6.1 and Monterey 12.0.1, tvOS 15.1, and watchOS 8.1. The Appl...

CVE-2020-27932

CVE-2020-27932 is a kernel-type-confusion issue in Apple’s XNU (mach turnstiles) that could allow a malicious app to execute code with kernel privileges. Connected sources confirm the root cause as a type confusion in kernel IPC machinery and note exploitation in-the-wild only in a macOS/iOS/macO...

CVE-2023-32367

CVE-2023-32367: Apple documents an entitlement-related issue where an app may access user-sensitive data. The vulnerability is mitigated in iOS 16.5 and iPadOS 16.5, and macOS Ventura 13.4 (Patch/UPDATE_REQUIRED). No exploitation details are provided in the connected documents; remediation is to ...

CVE-2019-8605

CVE-2019-8605 is a use-after-free vulnerability in Apple’s XNU kernel (iOS, macOS, tvOS, watchOS) that could allow a malicious app to execute arbitrary code with system privileges. The initial description notes a use-after-free that was fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, and watc...

CVE-2022-32917

CVE-2022-32917 is a kernel-level remote code execution risk in Apple OSes addressed by fixes that implement improved bounds checks. Affected: macOS Big Sur 11.7, macOS Monterey 12.6, iOS 15.7, iPadOS 15.7, iOS 16. The issue allowed an application to execute arbitrary code with kernel privileges a...

CVE-2020-9818

CVE-2020-9818 describes an out‑of‑bounds write in the Mail component of Apple iOS/iPadOS/watchOS. Affected versions: iOS 13.5 and iPadOS 13.5, iOS 12.4.7, and watchOS 6.2.5. Root cause: improved bounds checking in handling of malicious mail messages may prevent memory corruption. Impact as stated...

CVE-2021-1782

CVE-2021-1782 is an iOS/XNU in-the-wild vulnerability in the IPC vouchers subsystem. Project Zero details a race window around user_data handling: an non-atomic increment of e_made in a user_data_value_element can desynchronize with ivace->ivace_made, enabling a race between releasing and revi...

CVE-2020-27930

CVE-2020-27930 is a memory corruption vulnerability in font parsing that can lead to arbitrary code execution when processing a malicious font. Affected Apple software includes macOS Big Sur 11.0.1, iOS 14.2, iPadOS 14.2, watchOS 7.1, and corresponding Security Updates (e.g., High Sierra/Mojave)....

CVE-2025-6965

CVE-2025-6965 affects SQLite prior to 3.50.2, where the number of aggregate terms could exceed available columns, causing a memory corruption issue. The description in the Initial document notes upgrading to 3.50.2 or newer as the recommended fix. Connected documents corroborate the vulnerability...

CVE-2020-9819

CVE-2020-9819 is a memory consumption issue in Apple’s Mail processing that can lead to heap corruption when handling a maliciously crafted mail message. Public sources confirm the vulnerability affects Apple platforms and was fixed in specific updates: iOS 13.5, iPadOS 13.5, iOS 12.4.7, watchOS ...

CVE-2014-4404

CVE-2014-4404 describes a heap-based buffer overflow in IOHIDFamily that affects Apple iOS prior to 8 and Apple TV prior to 7. The vulnerability occurs when parsing crafted key-mapping properties, enabling an attacker to execute arbitrary code in a privileged context via a user-space application....

CVE-2019-6223

CVE-2019-6223 – Summary (Mode C) Affected products: Apple iOS and macOS with Group FaceTime support (Group FaceTime calls). Root cause: A logic issue in the handling of Group FaceTime calls leading to improper state management. Impact: The initiator of a Group FaceTime call may cause the recipien...

CVE-2022-42856

CVE-2022-42856 is a type-confusion vulnerability in WebKit/WebKitGTK that could allow arbitrary code execution when processing malicious web content. The connected documents confirm impact across WebKit-based products, including Apple WebKit (Safari) and WebKitGTK, with fixes in Safari 16.2, macO...

CVE-2016-4656

CVE-2016-4656 is an Apple iOS kernel memory‑corruption vulnerability that can allow an attacker to execute arbitrary code with kernel privileges or cause a DoS via a crafted app. Affected are iOS versions prior to 9.3.5; Apple’s security content notes the kernel memory corruption issue was addres...

CVE-2023-27930

CVE-2023-27930 is a kernel-level type confusion vulnerability addressed by Apple in iOS 16.5 / iPadOS 16.5, watchOS 9.5, tvOS 16.5, and macOS Ventura 13.4. The issue allows an app to potentially execute arbitrary code with kernel privileges due to a type confusion in the kernel; Apple notes impro...

CVE-2023-5217

CVE-2023-5217 is a heap buffer overflow in VP8 encoding in libvpx (affecting Google Chrome before 117.0.5938.132 and libvpx 1.13.1). A crafted HTML page could remotely trigger heap corruption. Multiple connected sources confirm the vulnerability in libvpx/WebP contexts; Apple’s advisory notes CVE...

CVE-2016-4655

CVE-2016-4655 is an iOS kernel information-disclosure vulnerability that allowed memory disclosure via a crafted app on affected iOS versions (pre-9.3.5). The connected docs include PoC exploit references (Trident for iOS

CVE-2023-32434

CVE-2023-32434 is an Apple kernel vulnerability in the XNU VM layer causing an integer overflow that could allow an app to execute code with kernel privileges. Public documentation confirms fixed in multiple OS versions (watchOS 9.5.2, macOS Big Sur 11.7.8, iOS 15.7.7 / iPadOS 15.7.7, macOS Monte...

CVE-2020-3837

CVE-2020-3837 is an Apple memory-corruption issue fixed in iOS 13.3.1, iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, and watchOS 6.1.2, with potential to run arbitrary code with kernel privileges. Connected analysis documents reveal concrete Android exploitation research tied to this CVE fa...

CVE-2022-32894

CVE-2022-32894 is an out-of-bounds write in Apple’s kernel code that could allow arbitrary code execution with kernel privileges. Affected products include iOS/iPadOS/macOS kernel components (macOS Big Sur and newer). The issue was fixed in iOS 15.6.1, iPadOS 15.6.1, and macOS Monterey 12.5.1, wi...

CVE-2016-4657

CVE-2016-4657 refers to a memory corruption vulnerability in Apple WebKit used by iOS, prior to 9.3.5. The issue could allow a remote attacker to execute arbitrary code or cause a denial of service when a user visits a crafted website. Affected product is WebKit in iOS (and related WebKit-based c...

CVE-2019-7286

CVE-2019-7286 is a memory corruption bug in iOS CFPrefsDaemon that could enable privilege escalation. Project Zero and related analyses show it as one of five iPhone exploit chains used in targeted in-the-wild campaigns, with chain components exploiting iOS WebKit/kernel paths. Apple released a f...

CVE-2022-42827

CVE-2022-42827 is an Apple kernel out-of-bounds write vulnerability. It affects iOS/iPadOS; exploit could allow arbitrary code execution with kernel privileges. Fixed in iOS 15.7.1/iPadOS 15.7.1 and iOS 16.x/iPadOS 16.x. Some sources indicate active exploitation; update to patched releases is rec...

CVE-2019-7287

CVE-2019-7287 is described in the connected materials as a memory corruption/heap overflow in Apple iOS, arising from an unchecked memcpy in the IOKit ProvInfoIOKitUserClient::ucEncryptSUInfo() path. The initial description notes a memory corruption fix in iOS 12.1.4 and potential kernel code exe...

CVE-2023-28205

CVE-2023-28205 is a use-after-free vulnerability in WebKitGTK/WebKitGTK4 that can be triggered by processing malicious web content, leading to arbitrary code execution. The initial CVE entry notes a memory-management fix in Safari, iOS, iPadOS and macOS, with active exploitation reports. Connecte...

CVE-2021-30983

CVE-2021-30983 is a buffer overflow in Apple’s IOMobileFrameBuffer path that can lead to arbitrary code execution with kernel privileges. Technical analysis in the connected documents shows the vulnerability involving a privilege-escalation flow across the Display Co-Processor (DCP) where an IOCo...

CVE-2020-9907

CVE-2020-9907 is an Apple AVEVideoEncoder-related memory corruption vulnerability. The issue was mitigated by removing the vulnerable code and is fixed in iOS 13.6 and iPadOS 13.6, and tvOS 13.4.8. Apple’s entry documents indicate the impact as an application potentially executing arbitrary code ...

CVE-2018-4344

CVE-2018-4344 is a memory corruption issue often referred to as LightSpeed. The official entry notes a memory corruption in Apple OS components that was fixed with memory handling improvements, affecting iOS versions older than iOS 12, macOS Mojave 10.14, tvOS 12, and watchOS 5. Several connected...

CVE-2023-28206

CVE-2023-28206 is an IOSurfaceAccelerator out-of-bounds write vulnerability in Apple’s iOS/macOS stack. The connected analysis documents an in-the-wild exploit chain targeting Safari IPC to escalate to GPU-process code execution, including a sequence of heap grooming and IPC misuse that yields ar...

CVE-2024-27804

CVE-2024-27804 affects Apple platforms (iOS 17.5/iPadOS 17.5, tvOS 17.5, watchOS 10.5, macOS Sonoma 14.5). The issue is described as improved memory handling that may allow an app to execute arbitrary code with kernel privileges. Affected component/behavior: memory handling in the kernel space. I...

CVE-2023-32435

CVE-2023-32435 is a memory corruption vulnerability in WebKit-based components affecting Apple platforms. The connected sources specify that processing web content could lead to arbitrary code execution and that the issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, and ...

CVE-2020-9934

CVE-2020-9934 describes a local macOS/TCC bypass via environment-variable poisoning. The root issue is how tccd expands HOME/USER home paths to locate the TCC.db, enabling an attacker with local access to plant a malicious TCC database and alter an app’s entitlements (e.g., microphone/camera) wit...

CVE-2023-32439

CVE-2023-32439 is a type confusion vulnerability in Apple’s WebKit used by iOS, iPadOS, macOS and Safari. The issue allows arbitrary code execution when processing malicious web content and is fixed in iOS 16.5.1/iPadOS 16.5.1, iOS 15.7.7/iPadOS 15.7.7, macOS Ventura 13.4.1, and Safari 16.5.1. Ea...

CVE-2023-41993

CVE-2023-41993 is a WebKit code‑execution vulnerability affecting Apple platforms where processing web content could trigger arbitrary code execution. The public record notes the issue was fixed in macOS Sonoma 14 and is associated with Safari/WebKit processing paths. Apple documents indicate the...

CVE-2023-45866

CVE-2023-45866 affects BlueZ Bluetooth HID Hosts. The description states that an unauthenticated Peripheral role HID Device could initiate, establish an encrypted connection, and send HID keyboard reports, potentially injecting HID messages when there is no user interaction in the Central role to...

CVE-2023-32388

CVE-2023-32388 affects Apple platforms (watchOS 9.5; macOS Ventura 13.4; macOS Big Sur 11.7.7; macOS Monterey 12.6.6; iOS 15.7.6 and iPadOS 15.7.6; iOS 16.5 and iPadOS 16.5). The issue is a privacy vulnerability where private data redaction in log entries could be bypassed, enabling an app to byp...

CVE-2021-31010

CVE-2021-31010 is a sandbox-bypass vulnerability affecting Apple platforms, reported in Core Telephony on macOS Catalina. It involves a deserialization issue that may bypass sandbox restrictions. The issue is fixed in Security Update 2021-005 Catalina (and related updates for iOS 12.5.5, iOS 14.8...

CVE-2023-38606

CVE-2023-38606 affects Apple’s kernel across iOS, iPadOS, macOS, tvOS and watchOS; the issue allows an app to modify a sensitive kernel state. The vulnerability was addressed with updated state management and patches, with fixes in macOS Monterey 12.6.8, iOS 15.7.8/iPadOS 15.7.8, iOS 16.6/iPadOS ...

CVE-2025-14174

CVE-2025-14174 = Out-of-bounds memory access in ANGLE within Google Chrome on macOS prior to 143.0.7499.110. A remote attacker could trigger memory access errors via a crafted HTML page. Affected software: Google Chrome on macOS; vulnerable component: ANGLE. Impact: high enough to potentially ena...

CVE-2023-41060

CVE-2023-41060 describes a kernel-type confusion vulnerability that is fixed in macOS Sonoma 14, iOS 17, and iPadOS 17. The root cause is a type confusions issue in the kernel that can allow a remote attacker to execute code with kernel privileges. Affected platforms, per public records, include ...

CVE-2013-0340

CVE-2013-0340 concerns the expat XML parser. The issue arises from improper handling of XML entity expansion (XXE) unless an application enables XML_SetEntityDeclHandler. This can allow a remote attacker to cause denial of service (resource consumption), trigger requests to intranet endpoints, or...

CVE-2021-30836

CVE-2021-30836 is an out-of-bounds read vulnerability in WebKitGTK/WebKitGTK-based WebKit, manifested while processing a malicious audio file. The root cause is an input-validation/bounds-check issue leading to memory disclosure. Affected products include WebKitGTK/WebKitGTK2, with multiple advis...

CVE-2014-1252

CVE-2014-1252 corresponds to a double-free in Apple's Office Viewer when processing Microsoft Word documents. Affected product: macOS/iOS Apple Office components (Office Viewer/Word handling). Root cause: memory management error (double free) in Word document handling. Impact: remote code executi...

CVE-2021-30900

CVE-2021-30900 affects Apple’s GPU Drivers in iOS/iPadOS (Smartphone OS); root cause is an out-of-bounds write leading to memory corruption. Impact: potential arbitrary code execution with kernel privileges, exploitable locally. Apple fixes were released in iOS 14.8.1 / iPadOS 14.8.1 and iOS 15.1...

CVE-2017-11103

CVE-2017-11103 affects Heimdal (Kerberos); vulnerability arises from improper handling of the KDC-REP service name in krb5_extract_ticket, enabling remote service impersonation when the unencrypted service name is used instead of the encrypted enc_part. Apple’s security content (HT208112/HT208221...