CVE-2020-11758

CVE-2020-11758 affects OpenEXR before 2.4.1 via an out-of-bounds read in ImfOptimizedPixelReading.h. Public docs (Debian DLA-2358-1) note potential denial of service and possible arbitrary code execution when processing malformed EXR files; OpenEXR/ImageIO entries reference the same CVE family. R...

CVE-2020-11760

CVE-2020-11760 affects OpenEXR before 2.4.1. There is an out-of-bounds read during RLE uncompression in ImfRle.cpp (function rleUncompress). OpenEXR releases indicate the fix is to upgrade to v2.4.1. Public references in the connected documents confirm the CVE entry is included among OpenEXR issu...

CVE-2020-11765

CVE-2020-11765 concerns OpenEXR prior to 2.4.1, where an off-by-one error in the ImfXdr.h read function used by DwaCompressor::Classifier::Classifier caused an out-of-bounds read. Public disclosures and vendor advisories (OpenEXR/OpenEXR 2.4.1 release notes; GLSA-202107-27; Debian DLA-2358-1) con...

CVE-2023-40413

CVE-2023-40413 affects Apple platforms (iOS 17.1/iPadOS 17.1 and earlier/macOS/macOS Sonoma 14.1 etc.) in the Find My component. The issue is described as an improvement in cache handling that could allow an app to read sensitive location information. The vulnerability is fixed in iOS 17.1/iPadOS...

CVE-2019-8689

CVE-2019-8689 pertains to multiple memory corruption issues in Apple’s WebKit/Safari stack that, when processing malicious web content, could lead to arbitrary code execution. The entry is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, a...

CVE-2019-8551

CVE-2019-8551 affects WebKit-based components on Apple platforms (iOS 12.2, tvOS 12.2, Safari 12.1, iTunes/Windows, iCloud for Windows 7.11). Root cause: a logic issue corrected by improved input/content validation in web content processing. Impact: processing maliciously crafted web content may ...

CVE-2022-32816

CVE-2022-32816 is a WebKitGTK/WebKit issue where visiting a website that frames malicious content may lead to UI spoofing. Connected advisories confirm this vulnerability in WebKitGTK/WebKit related packages (e.g., webkitgtk/webkit2gtk) with upstream fixes around version 2.36.5+; Arch Linux ASA-2...

CVE-2023-40449

CVE-2023-40449 is an Apple vulnerability where an application may cause a denial-of-service due to an issue in memory handling. The published entry specifies a local attack surface with user interaction required, and the root cause is related to memory handling that could be exploited by a compro...

CVE-2023-41977

CVE-2023-41977 is a Safari-related issue where improved cache handling fixes a vulnerability that could allow a malicious website to reveal browsing history. Affected products/versions (per connected sources): macOS Sonoma 14.1; iOS 16.7.2; iPadOS 16.7.2. Remedy: Apple has addressed the issue in ...

CVE-2019-8607

CVE-2019-8607 describes an out-of-bounds read in WebKit that could disclose process memory when processing malicious web content. Affected products include Apple platforms (iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, Safari 12.1.1, iTunes/Windows, iCloud for Windows 7.12). The root ...

CVE-2020-3894

CVE-2020-3894 describes a race condition in WebKit that could allow an application to read restricted memory. The issue affects Apple WebKit-related components across multiple platforms (iOS, iPadOS, tvOS, Safari, and Windows via iTunes/iCloud) and is fixed in iOS 13.4, iPadOS 13.4, tvOS 13.4, Sa...

CVE-2021-1817

CVE-2021-1817 is a memory corruption bug in Apple WebKit/WebKitGTK components exploited by processing maliciously crafted web content. Affected in macOS Big Sur 11.3, iOS 14.5, iPadOS 14.5, watchOS 7.4, tvOS 14.5; remediation is to upgrade to the fixed OS versions (e.g., macOS Big Sur 11.3+, iOS/...

CVE-2020-11762

OpenEXR CVE-2020-11762: An out-of-bounds read and write in DwaCompressor::uncompress (ImfDwaCompressor.cpp) occurs when handling the UNKNOWN compression case, affecting versions before 2.4.1. The issue is addressed in OpenEXR 2.4.1 (upgrade recommended).

CVE-2023-23520

CVE-2023-23520 involves a race condition in the Apple Crash Reporter that could allow a user to read arbitrary files as root. The issue was addressed with additional validation and patched in watchOS 9.3, tvOS 16.3, macOS Ventura 13.2, iOS 16.3, and iPadOS 16.3. Affected components and exact root...

CVE-2019-8584

CVE-2019-8584 is a memory corruption issue in Apple’s WebKit/WebKit-based components (affecting Safari and related Apple software). The description indicates multiple memory corruption flaws were addressed via improved memory handling, with the fixed versions listed as iOS 12.3, macOS Mojave 10.1...

CVE-2021-30851

CVE-2021-30851 affects WebKitGTK and WPE WebKit. A memory corruption vulnerability could allow arbitrary code execution when processing malicious web content. Upstream fix is WebKitGTK/WebKit/WPE WebKit 2.34.1; Debian/Arch Linux advisories (DSA-4995/4996, ASA-202110-10) note remediation by upgrad...

CVE-2022-26706

CVE-2022-26706 concerns an access issue in Apple’s sandboxing that allowed a sandboxed process to circumvent sandbox restrictions. Apple fixed the bug in tvOS 15.5, iOS 15.5 / iPadOS 15.5, watchOS 8.6, macOS Big Sur 11.6.6, and macOS Monterey 12.4. The vulnerability was addressed by tightening sa...

CVE-2019-8615

CVE-2019-8615 concerns memory corruption in WebKit components used by Apple products (iOS, macOS, tvOS, Safari, iTunes/iCloud clients). The issue is described as multiple memory corruption problems that could allow arbitrary code execution when processing malicious web content. Mitigation steps a...

CVE-2022-21658

CVE-2022-21658 affects Rust’s std::fs::remove_dir_all, due to a race condition (CWE-363) that could allow an attacker to trick a privileged process into deleting files/directories outside the target. Affected Rust releases: 1.0.0–1.58.0; patch released in 1.58.1. Impact can be significant for pri...

CVE-2019-8586

CVE-2019-8586 is a memory corruption vulnerability in Apple’s WebKit components. According to the connected advisories, it affects iOS, macOS, tvOS, Safari (and related Apple software), with exploitation triggered by processing malicious web content and potentially leading to arbitrary code execu...

CVE-2019-6237

CVE-2019-6237 affects WebKitGTK/WebKit; is a set of memory corruption issues. The MiracleLinux/Rocky/AlmaLinux advisories and linked Nessus plugins confirm the issue is addressed by memory handling fixes and is fixed in Apple platforms including iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 1...

CVE-2022-26711

CVE-2022-26711 describes an integer overflow in Apple's ImageIO WebP parsing. The root cause is an overflow in row-bytes calculation leading to an undersized buffer and out-of-bounds access during image decoding, enabling arbitrary code execution in apps using ImageIO (Safari, Preview, Mail, Mess...

CVE-2021-30846

CVE-2021-30846 is a memory corruption vulnerability in WebKitGTK and WPE WebKit that could allow remote code execution when processing malicious web content. It is publicly fixed upstream in WebKitGTK/WPE WebKit around version 2.34.1 (Arch Linux ASA-202110-9/ASA-202110-10 indicate vulnerability i...

CVE-2022-32885

CVE-2022-32885 is a WebKitGTK/WebKit memory corruption issue triggered by processing malicious web content. The connected advisories confirm the root cause as memory corruption from handling web content and show affected/patch targets across platforms: Apple devices (iOS 15.6, iPadOS 15.6, macOS ...

CVE-2019-8524

CVE-2019-8524 is a set of memory corruption issues in WebKit components that are triggered by processing malicious web content. The vulnerability is addressed by updates across multiple platforms, with upstream fixes described as improved memory handling and related mitigations. Affected: WebKit/...

CVE-2018-4200

CVE-2018-4200 concerns WebKit in Apple products. A crafted web site could trigger a WebCore::jsElementScrollHeightGetter use-after-free, leading to arbitrary code execution or a denial of service (memory corruption/crash). Affected: iOS < 11.3.1; Safari < 11.1; iCloud for Windows < 7.5; ...

CVE-2021-30888

CVE-2021-30888 is an information-leakage flaw in WebKitGTK and WebKit where a malicious website using Content Security Policy can leak information via redirect behavior. Remediation is provided by Apple in the iOS 15.1/iPadOS 15.1, macOS Monterey 12.0.1, iOS 14.8.1/iPadOS 14.8.1, tvOS 15.1, and w...

CVE-2021-30889

CVE-2021-30889 : Buffer overflow in WebKitGTK leading to arbitrary code execution when processing malicious web content. Affected product: WebKitGTK/WebKit. Root cause: buffer overflow in WebKitGTK components (WebCore::ImageBufferCairoImageSurfaceBackend::create). Public references in ALAS2 advis...

CVE-2019-8622

CVE-2019-8622 is a WebKit memory-corruption issue affecting Apple platforms (iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, Safari 12.1.1, etc.). The vulnerability can lead to arbitrary code execution when processing malicious web content. Remediation is to upgrade to the patched WebKi...

CVE-2019-8571

CVE-2019-8571 involves memory corruption issues addressed by Apple and partners, affecting Apple platforms that include iOS, macOS Mojave, tvOS, Safari, and related Windows components. The description states that multiple memory corruption flaws were fixed by improved memory handling, with the im...

CVE-2019-8587

CVE-2019-8587 is a WebKit memory-corruption vulnerability affecting Apple platforms. The issue potentially allows arbitrary code execution when processing malicious web content. It is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, and corresponding Windows/iTunes/iCloud compon...

CVE-2019-8684

CVE-2019-8684 is listed among multiple memory-corruption fixes in WebKitGTK/WebKitGTK4 updates (ALAS2-2020-1563). The advisory confirms issues addressed by memory-management improvements and states the vulnerability could allow arbitrary code execution when processing malicious web content. Affec...

CVE-2019-8597

CVE-2019-8597 relates to memory corruption issues in the WebKit/WebKitGTK components that could allow arbitrary code execution when processing malicious web content. The initial CVE entry notes multiple memory corruption vulnerabilities addressed by improved memory handling. Public advisories ide...

CVE-2019-8649

CVE-2019-8649 concerns a logic issue in how synchronous page loads are handled within WebKit components. The flaw could enable universal cross-site scripting when processing malicious web content. Reports indicate the fix was implemented via improved state management and is addressed in Apple upd...

CVE-2019-8658

CVE-2019-8658 is a logic issue in WebKit/Apple WebKit that could lead to universal cross-site scripting when processing malicious web content. The patch set fixes the issue in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13...

CVE-2020-3897

CVE-2020-3897 is a type confusion in WebKitGTK/WebKit (WebKitGTK4). The issue could allow a remote attacker to cause arbitrary code execution. Public fixes are in upstream WebKit/WebKitGTK4 2.28.2 (and related downstream advisories) and are reflected in vendor-specific updates (e.g., ALAS2-2020-1...

CVE-2022-26709

CVE-2022-26709 is a use-after-free in WebKitGTK that can lead to arbitrary code execution when processing malicious web content. The initial CVE entry notes the fix across Apple platforms (tvOS 15.5, iOS 15.5/iPadOS 15.5, watchOS 8.6, macOS Monterey 12.4, Safari 15.5). Connected advisories (Debia...

CVE-2022-22594

CVE-2022-22594 describes a cross-origin data exfiltration issue in WebKit/WebKitGTK via cross-origin tracking, later fixed in Safari 15.3, iOS 15.3, iPadOS 15.3, watchOS 8.4, tvOS 15.3, and macOS Monterey 12.2. The connected documents indicate the vulnerability allowed tracking of sensitive user ...

CVE-2025-31257

CVE-2025-31257 affects WebKit/WebKitGTK components used by Safari across Apple platforms. The issue is described as a memory handling problem that may cause a crash when processing maliciously crafted web content. Concrete fixes exist in watchOS 11.5, tvOS 18.5, iOS 18.5, iPadOS 18.5, macOS Sequo...

CVE-2019-8683

CVE-2019-8683 is a WebKit-related memory-corruption issue attributed to lokihardt (Google Project Zero) and addressed by Apple in WebKit updates. Affected components: WebKit on iOS, macOS (Safari/WebKit), watchOS/tvOS; affected platforms include iOS 12.x, macOS Mojave 10.14.x, Safari 12.x, and co...

CVE-2026-65346

An integer overflow in Apple's ImageIO framework (CVE-2026-65346) allows arbitrary code execution when processing a malicious image on iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2. No in-the-wild exploitation is reported; updates are available via Apple's security advisories.

CVE-2019-8623

CVE-2019-8623 is a WebKit memory-corruption vulnerability affecting Apple platforms. The issue arises when processing maliciously crafted web content and is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, Safari 12.1.1, iTunes for Windows 12.9.5, and iCloud for Windows 7.12. Th...

CVE-2021-30890

CVE-2021-30890 is a WebKit/WebKitGTK/WebKitGTK-derived vulnerability described as a logic/state issue where processing maliciously crafted web content may lead to universal cross-site scripting. Public mentions appear in multiple connected advisories: Debian DSA-5030-1 (webkit2gtk) and DSA-5031-1...

CVE-2025-24126

CVE-2025-24126 describes an input validation issue in AirPlay across Apple platforms. The vulnerability allows a local-network actor to cause an unexpected termination or memory corruption. Patches are provided in visionOS 2.3, iOS 18.3, iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, and tvOS 18....

CVE-2019-8583

Summary of CVE-2019-8583 : The vulnerability is a set of memory corruption issues in WebKit-related components that could be triggered by processing malicious web content, potentially leading to arbitrary code execution. The CVE is associated with Apple’s ecosystem and is addressed in multiple up...

CVE-2020-3885

CVE-2020-3885 describes a logic issue where a file URL may be incorrectly processed in WebKit-related components. The vulnerability is fixed in Apple platforms (iOS 13.4, iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes/Windows 12.10.5, iCloud for Windows 7.18) and in WebKitGTK/WebKit-based stacks. Pu...

CVE-2022-42867

CVE-2022-42867 is a use-after-free in WebKit/WebKitGTK (WebKitGTK). The root cause is a memory management issue that, when processing malicious web content, could lead to arbitrary code execution. The advisory notes this is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2, iPadOS 16....

CVE-2019-8596

CVE-2019-8596 is a WebKit memory corruption issue reported for Apple platforms (WebKit on iOS/macOS/tvOS/Safari). The initial description indicates multiple memory corruption vulnerabilities addressed with improved memory handling, leading to arbitrary code execution when processing malicious web...

CVE-2022-46698

CVE-2022-46698 is a logic issue in WebKitGTK where processing malicious web content may disclose sensitive user information. Multiple connected advisories confirm this issue in WebKitGTK/WebKit2GTK components and list it among fixed CVEs after updates to WebKitGTK packages. Affected products incl...

CVE-2021-1820

CVE-2021-1820 is a memory initialization issue fixed in macOS Big Sur 11.3, iOS 14.5, iPadOS 14.5, watchOS 7.4, and tvOS 14.5. The description states that processing maliciously crafted web content may lead to disclosure of process memory. Connected documentation confirms the vulnerability is a m...