CVE-2021-30957

CVE-2021-30957 is an Apple vulnerability describing a buffer overflow in CoreAudio that could allow arbitrary code execution when processing a malicious audio file. It affects macOS Monterey 12.1 and iOS/iPadOS/watchOS/tvOS releases listed for that fix (e.g., macOS Monterey 12.1, iOS 15.2, iPadOS...

CVE-2022-22579

CVE-2022-22579 is an information-disclosure vulnerability in Apple macOS components (Model I/O) caused by improper state management. Publicly referenced in macOS advisories HT213054 (macOS 12.x before 12.2) and HT213055 (macOS 11.x before 11.6.3), with fixed updates described as Security Update 2...

CVE-2022-32817

CVE-2022-32817 is an Apple vulnerability describing an out-of-bounds read that may allow an app to disclose kernel memory. The issue affects Apple operating systems including watchOS 8.7, tvOS 15.6, iOS 15.6 / iPadOS 15.6, and macOS Monterey 12.5, with fixes provided in those respective 8.7/15.6/...

CVE-2022-32938

CVE-2022-32938 affects Apple Shortcuts handling of directory paths. A parsing issue allowed a shortcut to check for the existence of an arbitrary path on the file system. Affected products/versions: iOS 16.1 and iPadOS 16; macOS Ventura 13. The issue is mitigated by the vendor’s fix through impro...

CVE-2023-32422

CVE-2023-32422 is an Apple security issue addressed by adding extra SQLite logging restrictions. The vulnerability allowed an app to bypass Privacy preferences, and Apple states fixes across multiple OSes: iOS 16.5 and iPadOS 16.5, tvOS 16.5, and macOS Ventura 13.4. The public descriptions consis...

CVE-2024-23203

CVE-2024-23203 affects Apple Shortcuts on macOS Sonoma 14.3, iOS 17.3, and iPadOS 17.3. A shortcut may access sensitive data via certain actions without prompting the user. Root cause: insufficient permissions checks; fixed by additional permissions checks. Remediation: update to macOS Sonoma 14....

CVE-2024-23242

CVE-2024-23242 describes a privacy issue where content in text fields was logged, allowing an app to view Mail data. The NCIS of this flaw is not logging such information and affects Apple platforms: the vulnerability is fixed in macOS Sonoma 14.4 and in iOS/iPadOS 17.4. The root cause is not det...

CVE-2025-24177

CVE-2025-24177 is an Apple AirPlay vulnerability. The description notes a null pointer dereference that was addressed by improved input validation, with a fixed patch in macOS Sequoia 15.3 and iOS/iPadOS 18.3. The CVE entry indicates a possible remote denial-of-service if exploited. Connected App...

CVE-2025-24180

CVE-2025-24180 affects Apple Safari (and related Apple OS components: visionOS 2.4, iOS 18.4, iPadOS 18.4, macOS Sequoia 15.4). The issue arises from insufficient input validation that could allow a malicious website to claim WebAuthn credentials from another site sharing a registrable suffix. Th...

CVE-2025-30456

CVE-2025-30456 involves a parsing issue in how directory paths are handled. Apple fixed it with improved path validation in macOS Ventura 13.7.5, macOS Sonoma 14.7.5, macOS Sequoia 15.4, and iOS/iPadOS 18.4. The issue could allow an app to gain root privileges. Affected component/firmware version...

CVE-2011-1114

CVE-2011-1114 affects Google Chrome prior to 9.0.597.107, where improper handling of tables may lead to a stale node, enabling remote denial of service or potentially other unspecified impact via unknown vectors. No explicit exploitation details or remediation are provided in the connected docume...

CVE-2011-3078

CVE-2011-3078 is a use-after-free vulnerability in the handling of floated elements in Google Chrome/Chromium prior to version 18.0.1025.168. Exploitation could lead to a denial of service or potentially unspecified impact. Connected advisories confirm the issue as part of multiple Chrome/Chromiu...

CVE-2017-13791

CVE-2017-13791 is a WebKit use-after-free remote code execution issue disclosed in Apple advisories. It affected iOS before 11.1, Safari before 11.0.1, tvOS before 11.1, and Windows components (iTunes 12.7.1, iCloud 7.1) via crafted web content. An exploit exists (Exploit-DB: 43176). Patches were...

CVE-2017-13792

CVE-2017-13792 is a WebKit use-after-free/memory corruption issue that could allow remote code execution or a memory corruption crash via a crafted web page. Affected products per Apple advisories: iOS before 11.1, Safari before 11.0.1, iCloud on Windows, iTunes 12.7.1 for Windows, and tvOS befor...

CVE-2017-2504

CVE-2017-2504 affects Apple WebKit components in iOS prior to 10.3.2, Safari prior to 10.1.1, and tvOS prior to 10.2.1. The issue is a logic/handling flaw in WebKit Editor commands that enables remote, universal cross‑site scripting (UXSS) via crafted web content. The vulnerability is tied to a W...

CVE-2018-4150

CVE-2018-4150 is a race condition in Apple’s XNU BPF subsystem that can trigger a linear heap buffer overflow when a buffer’s length is increased without reallocation. The described exploit path involves overflowing into a subsequent out-of-line (OOL) ports array, enabling a crafted heap state th...

CVE-2018-4401

CVE-2018-4401 is an Apple-family memory corruption vulnerability addressed by Apple in 2018 security updates. Affected products/versions include iOS prior to 12, macOS Mojave 10.14, tvOS 12, and watchOS 5. The issue was mitigated by Apple through memory-management fixes in the corresponding secur...

CVE-2020-27931

CVE-2020-27931 affects Apple’s FontParser/CoreText stack on macOS/iOS/watchOS/tvOS, where a memory corruption issue in parsing font files can lead to arbitrary code execution. The root cause is an input-validation weakness while processing font data (TTF fonts), enabling maliciously crafted fonts...

CVE-2020-29617

CVE-2020-29617 relates to an out-of-bounds read in ImageIO processing that could lead to heap corruption when handling maliciously crafted images. Affected software versions include tvOS 14.3; macOS Big Sur 11.1; Security Update 2020-001 Catalina and 2020-007 Mojave; iOS 14.3 and iPadOS 14.3; iCl...

CVE-2020-9791

CVE-2020-9791 affects Apple devices (iOS/iPadOS 13.5; macOS Catalina 10.15.5; tvOS 13.4.5; watchOS 6.2.5) and concerns processing of a maliciously crafted audio file. The underlying issue is an out-of-bounds read that was addressed by improved input validation. The vulnerability could lead to arb...

CVE-2020-9813

CVE-2020-9813 describes a logic issue causing memory corruption in Apple systems. The issue could allow a malicious application to execute arbitrary code with kernel privileges. Apple’s advisories show the fix being applied in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, and wat...

CVE-2020-9838

CVE-2020-9838 is supported by connected Apple advisories: it is an out-of-bounds read in the Bluetooth component of iOS/iPadOS fixed in 13.5. The Apple bulletin notes a remote attacker could cause arbitrary code execution, and remediation is to update to iOS 13.5/iPadOS 13.5. Other sources corrob...

CVE-2020-9872

CVE-2020-9872 is an out-of-bounds write in ImageIO that may permit arbitrary code execution when processing a maliciously crafted image. Affected products/versions and fixes are documented in Apple advisories: iOS 13.6 and iPadOS 13.6; macOS Catalina 10.15.6; tvOS 13.4.8; watchOS 6.2.8; iTunes 12...

CVE-2020-9874

CVE-2020-9874 is an out-of-bounds write issue affecting Apple's ImageIO/OpenEXR-related image processing paths. The description in the CVE notes that processing a maliciously crafted image may lead to arbitrary code execution, with fixed versions listed as iOS 13.6 / iPadOS 13.6, macOS Catalina 1...

CVE-2021-1738

CVE-2021-1738 is an out-of-bounds write vulnerability in macOS components that process images, enabling arbitrary code execution when handling a malicious image. Apple’s advisory (HT212147) attributes the issue to image processing paths and notes the root cause as an improper input validation/mem...

CVE-2021-1778

CVE-2021-1778 describes an out-of-bounds read in curl triggered while processing a malicious image. The issue is addressed by improved bounds checking and is fixed in Apple platforms: macOS Big Sur 11.2, Catalina Mojave/Big Sur security updates, and iOS/watchOS/tvOS updates (Security Update 2021-...

CVE-2021-1884

CVE-2021-1884 is a race condition reported in the Heimdal component. Public docs tie it to macOS security updates: Mojave Security Update 2021-004 and Catalina Security Update 2021-003, with potential for a remote attacker to cause a denial of service. The related Apple advisories confirm the aff...

CVE-2021-30709

CVE-2021-30709 affects macOS and iOS platforms where processing a maliciously crafted USD file could disclose memory contents. The issue was addressed by Apple with fixes in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave, and iOS/iPadOS 14.6. Root cause det...

CVE-2021-30776

CVE-2021-30776 is an Apple logic-issue vulnerability fixed in iOS 14.7, macOS Big Sur 11.5, watchOS 7.6, and tvOS 14.7 (Security Update 2021-004 Catalina). Description: Playing a malicious audio file may cause an unexpected application termination. Connected sources (ENISA EUVD-2021-17693, RH Red...

CVE-2021-30945

CVE-2021-30945 affects Apple platforms: macOS Big Sur 11.6.2, tvOS 15.2, macOS Monterey 12.1, Security Update 2021-008 Catalina, iOS 15.2 / iPadOS 15.2, and watchOS 8.3. The issue is described as fixed by improved checks, with the vulnerability enabling a local attacker to elevate privileges. Aff...

CVE-2022-22622

CVE-2022-22622 concerns an information-disclosure vulnerability in Apple iOS/iPadOS where, on devices with physical access, sensitive information could be exposed via keyboard suggestions. The issue was fixed in iOS 15.4 and iPadOS 15.4 through improved checks/state management. Affected component...

CVE-2022-22641

CVE-2022-22641 is a use-after-free issue resolved by memory management fixes in Apple OS updates. It affects tvOS 15.4, iOS 15.4, iPadOS 15.4, and macOS Monterey 12.3, where an app may gain elevated privileges. Remediation per provided documents: update systems to the listed fixed versions (tvOS ...

CVE-2022-32825

CVE-2022-32825 affects Apple platforms (iOS 15.6, iPadOS 15.6, macOS Big Sur 11.6.8, macOS Monterey 12.5, watchOS 8.7, tvOS 15.6). Root cause: memory handling issue that may allow an app to disclose kernel memory. Fixed in the listed OS updates; remediation is to upgrade to versions containing th...

CVE-2022-42851

CVE-2022-42851 involves an information disclosure vulnerability in Apple's ImageIO/TIFF handling that is fixed in iOS 16.2, iPadOS 16.2, and tvOS 16.2. The root cause is described as improved memory handling during parsing of maliciously crafted TIFF files, which may lead to disclosure of user in...

CVE-2023-23502

CVE-2023-23502 is an information-disclosure flaw that Apple fixed by removing the vulnerable code. The cited advisories state the issue could allow an app to determine kernel memory layout. Affected platforms include macOS (Monterey 12.6.3, Ventura 13.2) and iOS/iPadOS (16.3), as well as tvOS/wat...

CVE-2023-40395

The CVE-2023-40395 entry concerns multiple Apple platforms (tvOS, iOS, iPadOS, macOS Monterey/Sonoma, watchOS) where an issue in cache handling could allow an app to access contacts. The NVD description states the problem was addressed with improved cache handling and lists fixed versions: tvOS 1...

CVE-2023-42922

The CVE-2023-42922 issue affects Apple platforms (macOS and iOS/iPadOS) and involves an app potentially reading sensitive location information due to insufficient redaction. The vulnerability is addressed in macOS Sonoma 14.2, macOS Ventura 13.6.3, macOS Monterey 12.7.2, and iOS/iPadOS 17.2 and 1...

CVE-2024-23204

CVE-2024-23204 affects macOS Shortcuts (and related OSes) with a root cause of insufficient permissions checks that could allow a shortcut to access sensitive data via certain actions without prompting the user. The issue is fixed in macOS Sonoma 14.3 and across watchOS 10.3, iOS 17.3 and iPadOS ...

CVE-2024-23243

CVE-2024-23243 affects Apple iOS 17.4 and iPadOS 17.4, describing a privacy issue where an app may read sensitive location information due to insufficient private data redaction in log entries. Apple fixes are in iOS 17.4 / iPadOS 17.4. Remediation: update to these versions. Practical impact: lim...

CVE-2024-27847

CVE-2024-27847 affects Apple platforms (iOS/iPadOS/macOS) with a Privacy Preferences bypass due to insufficient checks. The issue is addressed in iOS/iPadOS 17.5 and macOS Sonoma 14.5; update to these or newer releases to mitigate. The NVD score indicates a medium to high impact depending on vect...

CVE-2024-44240

CVE-2024-44240 is a font-processing vulnerability in Apple platforms where processing a maliciously crafted font may disclose process memory. According to the primary description, impact is limited to confidentiality (C) with no integrity/availability impact stated, and the issue is fixed in mult...

CVE-2024-54507

CVE-2024-54507 describes a type confusion in the Apple XNU kernel that could allow a user‑level attacker to read kernel memory. The issue is fixed in macOS Sequoia 15.2, iOS 18.2 and iPadOS 18.2 through improved memory handling. Connected sources confirm the root cause as a type confusion in the ...

CVE-2025-24212

CVE-2025-24212 describes a sandbox-escape issue addressed by Apple via updated checks. Affected platforms include visionOS 2.4, macOS Ventura 13.7.5, tvOS 18.4, iPadOS 17.7.6, iOS 18.4/iPadOS 18.4, macOS Sequoia 15.4, and macOS Sonoma 14.7.5. The issue’s root cause is summarized as improved check...

CVE-2025-30433

The CVE-2025-30433 issue concerns the Shortcuts app on Apple platforms where a shortcut could access files normally inaccessible to Shortcuts. The root cause is insufficient access restrictions within the Shortcuts environment. Affects multiple Apple OS lines; fixes are delivered as OS updates: i...

CVE-2025-31202

CVE-2025-31202 affects Apple platforms via AirPlay components (e.g., AirPlay in Vision Pro, iOS/iPadOS, macOS, tvOS, visionOS). Root cause: a null pointer dereference fixed by input validation improvements. Impact: attacker on the local network can cause a denial-of-service. Affected versions inc...

CVE-2026-65336

CVE-2026-65336 is a state management flaw in WebKit , the web engine used by Safari and other Apple products. Processing maliciously crafted web content can trigger an unexpected Safari crash , resulting in a denial-of-service condition. The issue was identified by Josef Korbel (WebKit Bugzilla 3...

CVE-2016-4728

CVE-2016-4728 affects WebKit in Apple iOS (pre-10), tvOS (pre-10), iTunes for Windows (pre-12.5.1) and Safari (pre-10). Root cause: mishandling of error prototypes, enabling remote attackers to execute arbitrary code via a crafted webpage. Public fixes exist: iOS/tvOS Safari patches in subsequent...

CVE-2017-13798

CVE-2017-13798 affects WebKit components in several Apple platforms (iOS, Safari, tvOS, iCloud/iTunes) prior to their 11.1/11.0.1 updates. The issue enables remote code execution or a memory-corruption-based denial of service via crafted web content, as described by Apple’s security notes for iOS...

CVE-2017-13865

CVE-2017-13865 is a kernel‑level memory read restriction bypass affecting Apple platforms (iOS before 11.2, macOS 10.13.x, watchOS/tvOS variants). The Initial Description states a crafted app can bypass kernel memory read protections. Connected documents provide concrete exploitation details: iOS...

CVE-2017-2493

CVE-2017-2493 corresponds to a WebKit/Safari vulnerability where loading an HTMLObjectElement could bypass Same Origin Policy via crafted objects and JavaScript URLs, enabling potential cross-origin information leakage. The Seebug writeup provides a PoC and notes SOP checks in HTMLPlugInImageElem...