Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-20643 (GCVE-0-2026-20643)
Vulnerability from cvelistv5 – Published: 2026-03-17 22:29 – Updated: 2026-08-17 21:30
VLAI
EPSS
VEX
Summary
A cross-origin issue in the Navigation API was addressed with improved input validation. This issue is fixed in Background Security Improvements for iOS, iPadOS, and macOS, Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may bypass Same Origin Policy.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-18 13:14 UTC
CWE
Assigner
References
7 references
Impacted products
4 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Apple | Safari |
Affected:
0 , < 26.4
(custom)
|
guessed | |
| Apple | iOS and iPadOS |
Affected:
0 , < 18.7.7
(custom)
Affected: 0 , < 26.3.1 (a) (custom) Affected: 0 , < 26.4 (custom) |
guessed | |
| Apple | macOS |
Affected:
0 , < 26.3.1 (a)
(custom)
Affected: 0 , < 26.3.2 (a) (custom) Affected: 0 , < 26.4 (custom) |
guessed | |
| Apple | visionOS |
Affected:
0 , < 26.4
(custom)
|
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-20643",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-18T13:14:53.546083Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346 Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-18T13:14:56.139Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-03-19T16:18:46.731Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2026/Mar/10"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Safari",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "18.7.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "26.3.1 (a)",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "26.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.3.1 (a)",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "26.3.2 (a)",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "26.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "visionOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A cross-origin issue in the Navigation API was addressed with improved input validation. This issue is fixed in Background Security Improvements for iOS, iPadOS, and macOS, Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may bypass Same Origin Policy."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Processing maliciously crafted web content may bypass Same Origin Policy",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T21:30:53.812Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/126604"
},
{
"url": "https://support.apple.com/en-us/126792"
},
{
"url": "https://support.apple.com/en-us/126793"
},
{
"url": "https://support.apple.com/en-us/126794"
},
{
"url": "https://support.apple.com/en-us/126799"
},
{
"url": "https://support.apple.com/en-us/126800"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-20643",
"datePublished": "2026-03-17T22:29:48.227Z",
"dateReserved": "2025-11-11T14:43:07.862Z",
"dateUpdated": "2026-08-17T21:30:53.812Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-20643",
"date": "2026-09-10",
"epss": "0.00354",
"percentile": "0.28623"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-20643\",\"sourceIdentifier\":\"product-security@apple.com\",\"published\":\"2026-03-17T23:16:17.193\",\"lastModified\":\"2026-06-17T10:17:35.967\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A cross-origin issue in the Navigation API was addressed with improved input validation. This issue is fixed in Background Security Improvements for iOS, iPadOS, and macOS, Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may bypass Same Origin Policy.\"},{\"lang\":\"es\",\"value\":\"Se abord\u00f3 un problema de origen cruzado en la API de Navegaci\u00f3n con una validaci\u00f3n de entrada mejorada. Este problema se solucion\u00f3 en las Mejoras de Seguridad en Segundo Plano para iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1 y macOS 26.3.2. El procesamiento de contenido web creado con fines maliciosos podr\u00eda eludir la Pol\u00edtica del Mismo Origen.\"}],\"affected\":[{\"source\":\"product-security@apple.com\",\"affectedData\":[{\"vendor\":\"Apple\",\"product\":\"Safari\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"26.4\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"18.7.7\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"26.3.1 (a)\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"26.4\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Apple\",\"product\":\"macOS\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"26.3.1 (a)\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"26.3.2 (a)\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"26.4\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Apple\",\"product\":\"visionOS\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"26.4\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.5}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-03-18T13:14:53.546083Z\",\"id\":\"CVE-2026-20643\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"},{\"lang\":\"en\",\"value\":\"CWE-346\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"26.3.1\",\"matchCriteriaId\":\"A9117B15-6B46-4C64-BC4A-DDF9D9FBBEB5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"26.3.1\",\"matchCriteriaId\":\"60C61D06-6323-4C2E-96BC-F05F0C459568\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"26.3.1\",\"matchCriteriaId\":\"68370079-081F-40B1-A93F-F2B042B813E4\"}]}]}],\"references\":[{\"url\":\"https://support.apple.com/en-us/126604\",\"source\":\"product-security@apple.com\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"https://support.apple.com/en-us/126792\",\"source\":\"product-security@apple.com\"},{\"url\":\"https://support.apple.com/en-us/126793\",\"source\":\"product-security@apple.com\"},{\"url\":\"https://support.apple.com/en-us/126794\",\"source\":\"product-security@apple.com\"},{\"url\":\"https://support.apple.com/en-us/126799\",\"source\":\"product-security@apple.com\"},{\"url\":\"https://support.apple.com/en-us/126800\",\"source\":\"product-security@apple.com\"},{\"url\":\"http://seclists.org/fulldisclosure/2026/Mar/10\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-06-28T11:28:12+00:00",
"cve": "CVE-2026-20643",
"id": "CVE-2026-20643",
"initial_release_date": "2026-03-28T20:00:00+00:00",
"product_status:fixed": "509",
"product_status:known_affected": "4",
"product_status:known_not_affected": "5",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "webkitgtk: Processing maliciously crafted web content may bypass Same Origin Policy",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-20643.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "moderate",
"current_release_date": "2026-08-18T17:03:55Z",
"cve": "CVE-2026-20643",
"id": "CVE-2026-20643",
"initial_release_date": "2026-03-31T23:28:37Z",
"product_status:known_affected": "122",
"product_status:recommended": "336",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2026-20643",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-20643.json",
"version": "12"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://seclists.org/fulldisclosure/2026/Mar/10\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-03-19T16:18:46.731Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-20643\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-18T13:14:53.546083Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20 Improper Input Validation\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-346\", \"description\": \"CWE-346 Origin Validation Error\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-18T13:14:49.567Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"Apple\", \"product\": \"Safari\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"26.4\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Apple\", \"product\": \"iOS and iPadOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"18.7.7\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"26.3.1 (a)\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"26.4\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Apple\", \"product\": \"macOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"26.3.1 (a)\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"26.3.2 (a)\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"26.4\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Apple\", \"product\": \"visionOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"26.4\", \"versionType\": \"custom\"}]}], \"references\": [{\"url\": \"https://support.apple.com/en-us/126604\"}, {\"url\": \"https://support.apple.com/en-us/126792\"}, {\"url\": \"https://support.apple.com/en-us/126793\"}, {\"url\": \"https://support.apple.com/en-us/126794\"}, {\"url\": \"https://support.apple.com/en-us/126799\"}, {\"url\": \"https://support.apple.com/en-us/126800\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A cross-origin issue in the Navigation API was addressed with improved input validation. This issue is fixed in Background Security Improvements for iOS, iPadOS, and macOS, Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may bypass Same Origin Policy.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"Processing maliciously crafted web content may bypass Same Origin Policy\"}]}], \"providerMetadata\": {\"orgId\": \"286789f9-fbc2-4510-9f9a-43facdede74c\", \"shortName\": \"apple\", \"dateUpdated\": \"2026-08-17T21:30:53.812Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-20643\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-17T21:30:53.812Z\", \"dateReserved\": \"2025-11-11T14:43:07.862Z\", \"assignerOrgId\": \"286789f9-fbc2-4510-9f9a-43facdede74c\", \"datePublished\": \"2026-03-17T22:29:48.227Z\", \"assignerShortName\": \"apple\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
alsa-2026:10702
Vulnerability from osv_almalinux
Published
2026-04-27 00:00
Modified
2026-04-28 13:23
Summary
Important: webkit2gtk3 security update
Details
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43213)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43214)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43457)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43511)
- webkitgtk: Processing maliciously crafted web content may disclose internal states of the app (CVE-2025-46299)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20608)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20635)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20636)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20644)
- webkitgtk: A remote attacker may be able to cause a denial-of-service (CVE-2026-20652)
- webkitgtk: A website may be able to track users through Safari web extensions (CVE-2026-20676)
- webkitgtk: Processing maliciously crafted web content may bypass Same Origin Policy (CVE-2026-20643)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20664)
- webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced (CVE-2026-20665)
- webkitgtk: A maliciously crafted webpage may be able to fingerprint the user (CVE-2026-20691)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28857)
- webkitgtk: A malicious website may be able to process restricted web content outside the sandbox (CVE-2026-28859)
- webkitgtk: Visiting a maliciously crafted website may lead to a cross-site scripting attack (CVE-2026-28871)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "webkit2gtk3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.52.3-1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "webkit2gtk3-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.52.3-1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "webkit2gtk3-jsc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.52.3-1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "webkit2gtk3-jsc-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.52.3-1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. \n\nSecurity Fix(es): \n\n * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43213)\n * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43214)\n * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43457)\n * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43511)\n * webkitgtk: Processing maliciously crafted web content may disclose internal states of the app (CVE-2025-46299)\n * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20608)\n * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20635)\n * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20636)\n * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20644)\n * webkitgtk: A remote attacker may be able to cause a denial-of-service (CVE-2026-20652)\n * webkitgtk: A website may be able to track users through Safari web extensions (CVE-2026-20676)\n * webkitgtk: Processing maliciously crafted web content may bypass Same Origin Policy (CVE-2026-20643)\n * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20664)\n * webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced (CVE-2026-20665)\n * webkitgtk: A maliciously crafted webpage may be able to fingerprint the user (CVE-2026-20691)\n * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28857)\n * webkitgtk: A malicious website may be able to process restricted web content outside the sandbox (CVE-2026-28859)\n * webkitgtk: Visiting a maliciously crafted website may lead to a cross-site scripting attack (CVE-2026-28871)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
"id": "ALSA-2026:10702",
"modified": "2026-04-28T13:23:05Z",
"published": "2026-04-27T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:10702"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-43213"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-43214"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-43457"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-43511"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-46299"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-20608"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-20635"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-20636"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-20643"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-20644"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-20652"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-20664"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-20665"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-20676"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-20691"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-28857"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-28859"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-28871"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2448781"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2448782"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2448786"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2448787"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2448788"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2448789"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2448790"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2448791"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2448792"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2448793"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2448794"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2453000"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2453001"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2453002"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2453003"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2453004"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2453006"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2453008"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/8/ALSA-2026-10702.html"
}
],
"related": [
"CVE-2025-43213",
"CVE-2025-43214",
"CVE-2025-43457",
"CVE-2025-43511",
"CVE-2025-46299",
"CVE-2026-20608",
"CVE-2026-20635",
"CVE-2026-20636",
"CVE-2026-20644",
"CVE-2026-20652",
"CVE-2026-20676",
"CVE-2026-20643",
"CVE-2026-20664",
"CVE-2026-20665",
"CVE-2026-20691",
"CVE-2026-28857",
"CVE-2026-28859",
"CVE-2026-28871"
],
"summary": "Important: webkit2gtk3 security update"
}
alsa-2026:19206
Vulnerability from osv_almalinux
Published
2026-05-19 00:00
Modified
2026-05-26 12:32
Summary
Important: webkit2gtk3 security update
Details
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43213)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43214)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43457)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43511)
- webkitgtk: Processing maliciously crafted web content may disclose internal states of the app (CVE-2025-46299)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20608)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20635)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20636)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20644)
- webkitgtk: A remote attacker may be able to cause a denial-of-service (CVE-2026-20652)
- webkitgtk: A website may be able to track users through Safari web extensions (CVE-2026-20676)
- webkitgtk: Processing maliciously crafted web content may bypass Same Origin Policy (CVE-2026-20643)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20664)
- webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced (CVE-2026-20665)
- webkitgtk: A maliciously crafted webpage may be able to fingerprint the user (CVE-2026-20691)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28857)
- webkitgtk: A malicious website may be able to process restricted web content outside the sandbox (CVE-2026-28859)
- webkitgtk: Visiting a maliciously crafted website may lead to a cross-site scripting attack (CVE-2026-28871)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
| URL | Type | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "webkit2gtk3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.52.3-1.el9_8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "webkit2gtk3-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.52.3-1.el9_8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "webkit2gtk3-jsc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.52.3-1.el9_8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "webkit2gtk3-jsc-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.52.3-1.el9_8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. \n\nSecurity Fix(es): \n\n * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43213)\n * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43214)\n * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43457)\n * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43511)\n * webkitgtk: Processing maliciously crafted web content may disclose internal states of the app (CVE-2025-46299)\n * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20608)\n * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20635)\n * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20636)\n * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20644)\n * webkitgtk: A remote attacker may be able to cause a denial-of-service (CVE-2026-20652)\n * webkitgtk: A website may be able to track users through Safari web extensions (CVE-2026-20676)\n * webkitgtk: Processing maliciously crafted web content may bypass Same Origin Policy (CVE-2026-20643)\n * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20664)\n * webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced (CVE-2026-20665)\n * webkitgtk: A maliciously crafted webpage may be able to fingerprint the user (CVE-2026-20691)\n * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28857)\n * webkitgtk: A malicious website may be able to process restricted web content outside the sandbox (CVE-2026-28859)\n * webkitgtk: Visiting a maliciously crafted website may lead to a cross-site scripting attack (CVE-2026-28871)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
"id": "ALSA-2026:19206",
"modified": "2026-05-26T12:32:37Z",
"published": "2026-05-19T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:19206"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-43213"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-43214"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-43457"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-43511"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-46299"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-20608"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-20635"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-20636"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-20643"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-20644"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-20652"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-20664"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-20665"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-20676"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-20691"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-28857"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-28859"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-28871"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2448781"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2448782"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2448786"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2448787"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2448788"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2448789"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2448790"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2448791"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2448792"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2448793"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2448794"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2453000"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2453001"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2453002"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2453003"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2453004"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2453006"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2453008"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/9/ALSA-2026-19206.html"
}
],
"related": [
"CVE-2025-43213",
"CVE-2025-43214",
"CVE-2025-43457",
"CVE-2025-43511",
"CVE-2025-46299",
"CVE-2026-20608",
"CVE-2026-20635",
"CVE-2026-20636",
"CVE-2026-20644",
"CVE-2026-20652",
"CVE-2026-20676",
"CVE-2026-20643",
"CVE-2026-20664",
"CVE-2026-20665",
"CVE-2026-20691",
"CVE-2026-28857",
"CVE-2026-28859",
"CVE-2026-28871"
],
"summary": "Important: webkit2gtk3 security update"
}
alsa-2026:9692
Vulnerability from osv_almalinux
Published
2026-04-22 00:00
Modified
2026-04-24 10:02
Summary
Important: webkit2gtk3 security update
Details
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43213)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43214)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43457)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43511)
- webkitgtk: Processing maliciously crafted web content may disclose internal states of the app (CVE-2025-46299)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20608)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20635)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20636)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20644)
- webkitgtk: A remote attacker may be able to cause a denial-of-service (CVE-2026-20652)
- webkitgtk: A website may be able to track users through Safari web extensions (CVE-2026-20676)
- webkitgtk: Processing maliciously crafted web content may bypass Same Origin Policy (CVE-2026-20643)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20664)
- webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced (CVE-2026-20665)
- webkitgtk: A maliciously crafted webpage may be able to fingerprint the user (CVE-2026-20691)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28857)
- webkitgtk: A malicious website may be able to process restricted web content outside the sandbox (CVE-2026-28859)
- webkitgtk: Visiting a maliciously crafted website may lead to a cross-site scripting attack (CVE-2026-28871)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
| URL | Type | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "webkit2gtk3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.52.3-0.el9_7.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "webkit2gtk3-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.52.3-0.el9_7.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "webkit2gtk3-jsc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.52.3-0.el9_7.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "webkit2gtk3-jsc-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.52.3-0.el9_7.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. \n\nSecurity Fix(es): \n\n * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43213)\n * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43214)\n * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43457)\n * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43511)\n * webkitgtk: Processing maliciously crafted web content may disclose internal states of the app (CVE-2025-46299)\n * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20608)\n * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20635)\n * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20636)\n * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20644)\n * webkitgtk: A remote attacker may be able to cause a denial-of-service (CVE-2026-20652)\n * webkitgtk: A website may be able to track users through Safari web extensions (CVE-2026-20676)\n * webkitgtk: Processing maliciously crafted web content may bypass Same Origin Policy (CVE-2026-20643)\n * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20664)\n * webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced (CVE-2026-20665)\n * webkitgtk: A maliciously crafted webpage may be able to fingerprint the user (CVE-2026-20691)\n * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28857)\n * webkitgtk: A malicious website may be able to process restricted web content outside the sandbox (CVE-2026-28859)\n * webkitgtk: Visiting a maliciously crafted website may lead to a cross-site scripting attack (CVE-2026-28871)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
"id": "ALSA-2026:9692",
"modified": "2026-04-24T10:02:57Z",
"published": "2026-04-22T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:9692"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-43213"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-43214"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-43457"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-43511"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-46299"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-20608"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-20635"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-20636"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-20643"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-20644"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-20652"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-20664"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-20665"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-20676"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-20691"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-28857"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-28859"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-28871"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2448781"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2448782"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2448786"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2448787"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2448788"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2448789"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2448790"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2448791"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2448792"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2448793"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2448794"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2453000"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2453001"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2453002"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2453003"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2453004"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2453006"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2453008"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/9/ALSA-2026-9692.html"
}
],
"related": [
"CVE-2025-43213",
"CVE-2025-43214",
"CVE-2025-43457",
"CVE-2025-43511",
"CVE-2025-46299",
"CVE-2026-20608",
"CVE-2026-20635",
"CVE-2026-20636",
"CVE-2026-20644",
"CVE-2026-20652",
"CVE-2026-20676",
"CVE-2026-20643",
"CVE-2026-20664",
"CVE-2026-20665",
"CVE-2026-20691",
"CVE-2026-28857",
"CVE-2026-28859",
"CVE-2026-28871"
],
"summary": "Important: webkit2gtk3 security update"
}
CERTFR-2026-AVI-0313
Vulnerability from certfr_avis - Published: 2026-03-18 - Updated: 2026-03-18
Une vulnérabilité a été découverte dans les produits Apple. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "iPadOS versions ant\u00e9rieures \u00e0 26.3.1 (a)",
"product": {
"name": "iPadOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS versions ant\u00e9rieures \u00e0 26.3.1 (a)",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS versions ant\u00e9rieures \u00e0 26.3.2 (a)",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iOS versions ant\u00e9rieures \u00e0 26.3.1 (a)",
"product": {
"name": "iOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-20643",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20643"
}
],
"initial_release_date": "2026-03-18T00:00:00",
"last_revision_date": "2026-03-18T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0313",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-03-18T00:00:00.000000"
}
],
"risks": [
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans les produits Apple. Elle permet \u00e0 un attaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Vuln\u00e9rabilit\u00e9 dans les produits Apple",
"vendor_advisories": [
{
"published_at": "2026-03-17",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 126604",
"url": "https://support.apple.com/en-us/126604"
}
]
}
CERTFR-2026-AVI-0355
Vulnerability from certfr_avis - Published: 2026-03-25 - Updated: 2026-03-25
De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Apple | iOS | iOS versions antérieures à 26.4 | ||
| Apple | iPadOS | iPadOS versions antérieures à 26.4 | ||
| Apple | iPadOS | iPadOS versions antérieures à 18.7.7 | ||
| Apple | Xcode | Xcode versions antérieures à 26.4 | ||
| Apple | visionOS | visionOS versions antérieures à 26.4 | ||
| Apple | watchOS | watchOS versions antérieures à 26.4 | ||
| Apple | macOS | macOS Tahoe versions antérieures à 26.4 | ||
| Apple | macOS | macOS Sonoma versions antérieures à 14.8.5 | ||
| Apple | Safari | Safari versions antérieures à 26.4 | ||
| Apple | macOS | macOS Sequoia versions antérieures à 15.7.5 | ||
| Apple | tvOS | tvOS versions antérieures à 26.4 | ||
| Apple | iOS | iOS versions antérieures à 18.7.7 |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "iOS versions ant\u00e9rieures \u00e0 26.4",
"product": {
"name": "iOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iPadOS versions ant\u00e9rieures \u00e0 26.4",
"product": {
"name": "iPadOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iPadOS versions ant\u00e9rieures \u00e0 18.7.7",
"product": {
"name": "iPadOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Xcode versions ant\u00e9rieures \u00e0 26.4",
"product": {
"name": "Xcode",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "visionOS versions ant\u00e9rieures \u00e0 26.4",
"product": {
"name": "visionOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "watchOS versions ant\u00e9rieures \u00e0 26.4",
"product": {
"name": "watchOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS Tahoe versions ant\u00e9rieures \u00e0 26.4",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS Sonoma versions ant\u00e9rieures \u00e0 14.8.5",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Safari versions ant\u00e9rieures \u00e0 26.4",
"product": {
"name": "Safari",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS Sequoia versions ant\u00e9rieures \u00e0 15.7.5",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "tvOS versions ant\u00e9rieures \u00e0 26.4",
"product": {
"name": "tvOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iOS versions ant\u00e9rieures \u00e0 18.7.7",
"product": {
"name": "iOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-20684",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20684"
},
{
"name": "CVE-2026-28875",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28875"
},
{
"name": "CVE-2026-28862",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28862"
},
{
"name": "CVE-2026-20698",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20698"
},
{
"name": "CVE-2025-59775",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59775"
},
{
"name": "CVE-2026-20664",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20664"
},
{
"name": "CVE-2026-20692",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20692"
},
{
"name": "CVE-2025-43376",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43376"
},
{
"name": "CVE-2026-28879",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28879"
},
{
"name": "CVE-2026-28834",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28834"
},
{
"name": "CVE-2026-28882",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28882"
},
{
"name": "CVE-2026-20631",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20631"
},
{
"name": "CVE-2025-55753",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-55753"
},
{
"name": "CVE-2026-28874",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28874"
},
{
"name": "CVE-2026-20665",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20665"
},
{
"name": "CVE-2026-28822",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28822"
},
{
"name": "CVE-2026-28827",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28827"
},
{
"name": "CVE-2026-28892",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28892"
},
{
"name": "CVE-2026-28895",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28895"
},
{
"name": "CVE-2026-28837",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28837"
},
{
"name": "CVE-2026-28878",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28878"
},
{
"name": "CVE-2026-28823",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28823"
},
{
"name": "CVE-2026-28845",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28845"
},
{
"name": "CVE-2026-28826",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28826"
},
{
"name": "CVE-2026-28886",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28886"
},
{
"name": "CVE-2026-28880",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28880"
},
{
"name": "CVE-2025-66200",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66200"
},
{
"name": "CVE-2026-20687",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20687"
},
{
"name": "CVE-2026-28866",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28866"
},
{
"name": "CVE-2026-20697",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20697"
},
{
"name": "CVE-2026-28863",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28863"
},
{
"name": "CVE-2026-28817",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28817"
},
{
"name": "CVE-2026-20637",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20637"
},
{
"name": "CVE-2026-20607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20607"
},
{
"name": "CVE-2026-28889",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28889"
},
{
"name": "CVE-2025-64505",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-64505"
},
{
"name": "CVE-2026-28824",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28824"
},
{
"name": "CVE-2026-28844",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28844"
},
{
"name": "CVE-2026-20632",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20632"
},
{
"name": "CVE-2026-20668",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20668"
},
{
"name": "CVE-2026-28888",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28888"
},
{
"name": "CVE-2026-28852",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28852"
},
{
"name": "CVE-2026-28829",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28829"
},
{
"name": "CVE-2025-65082",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-65082"
},
{
"name": "CVE-2026-28861",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28861"
},
{
"name": "CVE-2026-28894",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28894"
},
{
"name": "CVE-2026-28828",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28828"
},
{
"name": "CVE-2025-58098",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58098"
},
{
"name": "CVE-2026-28871",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28871"
},
{
"name": "CVE-2026-20688",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20688"
},
{
"name": "CVE-2026-20699",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20699"
},
{
"name": "CVE-2026-28831",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28831"
},
{
"name": "CVE-2026-28859",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28859"
},
{
"name": "CVE-2026-20694",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20694"
},
{
"name": "CVE-2026-20633",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20633"
},
{
"name": "CVE-2026-20657",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20657"
},
{
"name": "CVE-2026-28890",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28890"
},
{
"name": "CVE-2026-20651",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20651"
},
{
"name": "CVE-2026-20701",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20701"
},
{
"name": "CVE-2026-28816",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28816"
},
{
"name": "CVE-2026-28877",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28877"
},
{
"name": "CVE-2025-14524",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14524"
},
{
"name": "CVE-2026-20691",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20691"
},
{
"name": "CVE-2026-28820",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28820"
},
{
"name": "CVE-2026-28838",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28838"
},
{
"name": "CVE-2026-28842",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28842"
},
{
"name": "CVE-2025-43534",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43534"
},
{
"name": "CVE-2026-28825",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28825"
},
{
"name": "CVE-2026-28865",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28865"
},
{
"name": "CVE-2026-20660",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20660"
},
{
"name": "CVE-2026-28857",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28857"
},
{
"name": "CVE-2026-20639",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20639"
},
{
"name": "CVE-2026-20643",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20643"
},
{
"name": "CVE-2026-28818",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28818"
},
{
"name": "CVE-2026-20690",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20690"
},
{
"name": "CVE-2026-20693",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20693"
},
{
"name": "CVE-2026-28833",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28833"
},
{
"name": "CVE-2026-28876",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28876"
},
{
"name": "CVE-2026-20695",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20695"
},
{
"name": "CVE-2026-28856",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28856"
},
{
"name": "CVE-2026-28891",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28891"
},
{
"name": "CVE-2026-28868",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28868"
},
{
"name": "CVE-2026-28841",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28841"
},
{
"name": "CVE-2026-28821",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28821"
},
{
"name": "CVE-2026-28835",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28835"
},
{
"name": "CVE-2026-28839",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28839"
},
{
"name": "CVE-2026-28867",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28867"
},
{
"name": "CVE-2026-28864",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28864"
},
{
"name": "CVE-2026-28832",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28832"
},
{
"name": "CVE-2026-28858",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28858"
},
{
"name": "CVE-2026-28870",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28870"
},
{
"name": "CVE-2026-28893",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28893"
},
{
"name": "CVE-2026-28881",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28881"
}
],
"initial_release_date": "2026-03-25T00:00:00",
"last_revision_date": "2026-03-25T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0355",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-03-25T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Apple. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Apple",
"vendor_advisories": [
{
"published_at": "2026-03-24",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 126793",
"url": "https://support.apple.com/en-us/126793"
},
{
"published_at": "2026-03-24",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 126794",
"url": "https://support.apple.com/en-us/126794"
},
{
"published_at": "2026-03-24",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 126798",
"url": "https://support.apple.com/en-us/126798"
},
{
"published_at": "2026-03-24",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 126800",
"url": "https://support.apple.com/en-us/126800"
},
{
"published_at": "2026-03-24",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 126796",
"url": "https://support.apple.com/en-us/126796"
},
{
"published_at": "2026-03-24",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 126792",
"url": "https://support.apple.com/en-us/126792"
},
{
"published_at": "2026-03-24",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 126795",
"url": "https://support.apple.com/en-us/126795"
},
{
"published_at": "2026-03-24",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 126799",
"url": "https://support.apple.com/en-us/126799"
},
{
"published_at": "2026-03-24",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 126797",
"url": "https://support.apple.com/en-us/126797"
},
{
"published_at": "2026-03-24",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 126801",
"url": "https://support.apple.com/en-us/126801"
}
]
}
FKIE_CVE-2026-20643
Vulnerability from fkie_nvd - Published: 2026-03-17 23:16 - Updated: 2026-06-17 10:17
Severity
Summary
A cross-origin issue in the Navigation API was addressed with improved input validation. This issue is fixed in Background Security Improvements for iOS, iPadOS, and macOS, Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may bypass Same Origin Policy.
References
| URL | Tags | ||
|---|---|---|---|
| product-security@apple.com | https://support.apple.com/en-us/126604 | Release Notes, Vendor Advisory | |
| product-security@apple.com | https://support.apple.com/en-us/126792 | ||
| product-security@apple.com | https://support.apple.com/en-us/126793 | ||
| product-security@apple.com | https://support.apple.com/en-us/126794 | ||
| product-security@apple.com | https://support.apple.com/en-us/126799 | ||
| product-security@apple.com | https://support.apple.com/en-us/126800 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://seclists.org/fulldisclosure/2026/Mar/10 |
{
"affected": [
{
"affectedData": [
{
"product": "Safari",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "18.7.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "26.3.1 (a)",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "26.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.3.1 (a)",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "26.3.2 (a)",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "26.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "visionOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"source": "product-security@apple.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A9117B15-6B46-4C64-BC4A-DDF9D9FBBEB5",
"versionEndExcluding": "26.3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
"matchCriteriaId": "60C61D06-6323-4C2E-96BC-F05F0C459568",
"versionEndExcluding": "26.3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "68370079-081F-40B1-A93F-F2B042B813E4",
"versionEndExcluding": "26.3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A cross-origin issue in the Navigation API was addressed with improved input validation. This issue is fixed in Background Security Improvements for iOS, iPadOS, and macOS, Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may bypass Same Origin Policy."
},
{
"lang": "es",
"value": "Se abord\u00f3 un problema de origen cruzado en la API de Navegaci\u00f3n con una validaci\u00f3n de entrada mejorada. Este problema se solucion\u00f3 en las Mejoras de Seguridad en Segundo Plano para iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1 y macOS 26.3.2. El procesamiento de contenido web creado con fines maliciosos podr\u00eda eludir la Pol\u00edtica del Mismo Origen."
}
],
"id": "CVE-2026-20643",
"lastModified": "2026-06-17T10:17:35.967",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.5,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-20643",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-18T13:14:53.546083Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-03-17T23:16:17.193",
"references": [
{
"source": "product-security@apple.com",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://support.apple.com/en-us/126604"
},
{
"source": "product-security@apple.com",
"url": "https://support.apple.com/en-us/126792"
},
{
"source": "product-security@apple.com",
"url": "https://support.apple.com/en-us/126793"
},
{
"source": "product-security@apple.com",
"url": "https://support.apple.com/en-us/126794"
},
{
"source": "product-security@apple.com",
"url": "https://support.apple.com/en-us/126799"
},
{
"source": "product-security@apple.com",
"url": "https://support.apple.com/en-us/126800"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://seclists.org/fulldisclosure/2026/Mar/10"
}
],
"sourceIdentifier": "product-security@apple.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
},
{
"lang": "en",
"value": "CWE-346"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
GCVE-1988-2026-0258
Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-09 10:08
VLAI
EPSS
VEX
Title
APPLE-SA-03-17-2026-1 Background Security Improvements for iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1, and macOS 26.3.2
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-03-17-2026-1 Background Security Improvements for iOS 26.3.1,
iPadOS 26.3.1, macOS 26.3.1, and macOS 26.3.2
Background Security Improvements for iOS 26.3.1, iPadOS 26.3.1, macOS
26.3.1, and macOS 26.3.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/126604.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
iOS 26.3.1 (a), iPadOS 26.3.1 (a), macOS 26.3.1 (a), macOS 26.3.2 (a)
WebKit
Available for: iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1, macOS 26.3.2
Impact: Processing maliciously crafted web content may bypass Same
Origin Policy
Description: A cross-origin issue in the Navigation API was addressed
with improved input validation.
WebKit Bugzilla: 306050
CVE-2026-20643: Thomas Espach
All information is also posted on the Apple Security Releases
web site: https://support.apple.com/100100.
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmm54C8ACgkQ4Ifiq8DH
7PUGUw//S0SC2lJmp6tTNVubRojkwa1ppYTX/UXyJimhlpefU0mkxE4dRlqKzQP7
WA4VRAbKwCZMSoIMrsh+xAkk5noy70jKthNGRpWTi+YIVmxzxChmjbAjrueugiwJ
CZWUyhshmbbFVIMB5agDx6OIvNm4J+eazERM8FHuqKFBkb2V4gcEuzsGd0LQa3BO
EN0UYoU5vBDK7OaEYy7yYYTAcjQgLBW2A799ospesduvz9LY3R6ewenowAQAoxjF
oxz426lRYkuOQ/cFNn1ejrBYBPadgDN4MkIiBmayU0fRqJHMBUZwjde4osJnHKz0
OKbVAlklfLExqtD3W5McOsNUbdncgLz/AL/gSE+Mi2SfK3gyE0ER5KF4ZaSfIBzM
OeZm7jqkr+NORFf3BgoYmbzA4+J5UJ/FVN4aLoKQCLCYS8zq+lG1QNLSBkd3RWHW
V3ieTzyI40SIVH/nFtPwxpcus0ckfrJkDqcEEpfFVadaenuw4QF6mW5ctdAOu1Zf
DvluADw/kXnNRI4ENFMz5qctTQbCOCodmaA0jO46UekXFMpe/emOteA3yTMsIZXq
C4WDFQDwaPqB6SRZoUw2l87bE3liHoS1mKKtb+YcPP0/MJLlU5N4YMLLHhaiz3DJ
AV0gg/q7dGv0l2TJocWybRReTRhXuwVBaCCt9RKjjyUdD79vw0w=
=dtpg
-----END PGP SIGNATURE-----
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuln.freearchive.org/archive/full-disclos… | technical-description |
| https://seclists.org/fulldisclosure/2026/Mar/10 | technical-description |
| https://nmap.org/mailman/listinfo/fulldisclosure | |
| https://seclists.org/fulldisclosure/ | |
| https://support.apple.com/100100 | |
| https://support.apple.com/126604 | |
| https://www.apple.com/support/security/pgp/ |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apple | APPLE-SA-03-17-2026-1 Background Security |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0258 (this record)
- related CVE-2026-20643
{
"containers": {
"cna": {
"affected": [
{
"product": "APPLE-SA-03-17-2026-1 Background Security",
"vendor": "Apple",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-03-17-2026-1 Background Security Improvements for iOS 26.3.1,\niPadOS 26.3.1, macOS 26.3.1, and macOS 26.3.2\n\nBackground Security Improvements for iOS 26.3.1, iPadOS 26.3.1, macOS\n26.3.1, and macOS 26.3.2 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/126604.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\niOS 26.3.1 (a), iPadOS 26.3.1 (a), macOS 26.3.1 (a), macOS 26.3.2 (a)\n\nWebKit\nAvailable for: iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1, macOS 26.3.2\nImpact: Processing maliciously crafted web content may bypass Same\nOrigin Policy\nDescription: A cross-origin issue in the Navigation API was addressed\nwith improved input validation.\nWebKit Bugzilla: 306050\nCVE-2026-20643: Thomas Espach\n\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmm54C8ACgkQ4Ifiq8DH\n7PUGUw//S0SC2lJmp6tTNVubRojkwa1ppYTX/UXyJimhlpefU0mkxE4dRlqKzQP7\nWA4VRAbKwCZMSoIMrsh+xAkk5noy70jKthNGRpWTi+YIVmxzxChmjbAjrueugiwJ\nCZWUyhshmbbFVIMB5agDx6OIvNm4J+eazERM8FHuqKFBkb2V4gcEuzsGd0LQa3BO\nEN0UYoU5vBDK7OaEYy7yYYTAcjQgLBW2A799ospesduvz9LY3R6ewenowAQAoxjF\noxz426lRYkuOQ/cFNn1ejrBYBPadgDN4MkIiBmayU0fRqJHMBUZwjde4osJnHKz0\nOKbVAlklfLExqtD3W5McOsNUbdncgLz/AL/gSE+Mi2SfK3gyE0ER5KF4ZaSfIBzM\nOeZm7jqkr+NORFf3BgoYmbzA4+J5UJ/FVN4aLoKQCLCYS8zq+lG1QNLSBkd3RWHW\nV3ieTzyI40SIVH/nFtPwxpcus0ckfrJkDqcEEpfFVadaenuw4QF6mW5ctdAOu1Zf\nDvluADw/kXnNRI4ENFMz5qctTQbCOCodmaA0jO46UekXFMpe/emOteA3yTMsIZXq\nC4WDFQDwaPqB6SRZoUw2l87bE3liHoS1mKKtb+YcPP0/MJLlU5N4YMLLHhaiz3DJ\nAV0gg/q7dGv0l2TJocWybRReTRhXuwVBaCCt9RKjjyUdD79vw0w=\n=dtpg\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T10:08:54Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/10"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Mar/10"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/126604"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Mar/10"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-03-17-2026-1 Background Security Improvements for iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1, and macOS 26.3.2",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-20643",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0258",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/10",
"automated": true,
"contentSha256": "a407069f3e2e365a22b8811ffc6d3daeab4f5d3e25753f3c52142f7928e2a097",
"evidenceScore": 6,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/10",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-03-17T23:43:52Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0258"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T08:13:42Z",
"dateUpdated": "2026-09-09T10:08:54Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0258"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0261
Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-09 10:08
VLAI
EPSS
VEX
Title
APPLE-SA-03-24-2026-1 iOS 26.4 and iPadOS 26.4
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-03-24-2026-1 iOS 26.4 and iPadOS 26.4
iOS 26.4 and iPadOS 26.4 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/126792.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
802.1X
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An attacker in a privileged network position may be able to
intercept network traffic
Description: An authentication issue was addressed with improved state
management.
CVE-2026-28865: Héloïse Gollier and Mathy Vanhoef (KU Leuven)
Accounts
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to access sensitive user data
Description: An authorization issue was addressed with improved state
management.
CVE-2026-28877: Rosyna Keller of Totally Not Malicious Software
App Protection
Available for: iPhone 11 and later
Impact: An attacker with physical access to an iOS device with Stolen
Device Protection enabled may be able to access biometrics-gated
Protected Apps with the passcode
Description: The issue was addressed with improved checks.
CVE-2026-28895: Zack Tickman
Audio
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing maliciously crafted web content may lead to an
unexpected process crash
Description: A use-after-free issue was addressed with improved memory
management.
CVE-2026-28879: Justin Cohen of Google
Audio
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An attacker may be able to cause unexpected app termination
Description: A type confusion issue was addressed with improved memory
handling.
CVE-2026-28822: Jex Amro
Baseband
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: A remote attacker may cause an unexpected app termination
Description: The issue was addressed with improved checks.
CVE-2026-28874: Hazem Issa, Tuan D. Hoang, and Yongdae Kim @ SysSec,
KAIST
Baseband
Available for: iPhone 16e
Impact: A remote attacker may be able to cause a denial-of-service
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-28875: Tuan D. Hoang and Yongdae Kim @ KAIST SysSec Lab
Calling Framework
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: A remote attacker may be able to cause a denial-of-service
Description: A denial-of-service issue was addressed with improved input
validation.
CVE-2026-28894: an anonymous researcher
Clipboard
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved validation of
symlinks.
CVE-2026-28866: Cristian Dinca (icmd.tech)
CoreMedia
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing an audio stream in a maliciously crafted media file
may terminate the process
Description: An out-of-bounds access issue was addressed with improved
bounds checking.
CVE-2026-20690: Hossein Lotfi (@hosselot) of Trend Micro Zero Day
Initiative
CoreUtils
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: A user in a privileged network position may be able to cause a
denial-of-service
Description: A null pointer dereference was addressed with improved
input validation.
CVE-2026-28886: Etienne Charron (Renault) and Victoria Martini (Renault)
Crash Reporter
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to enumerate a user's installed apps
Description: A privacy issue was addressed by removing sensitive data.
CVE-2026-28878: Zhongcheng Li from IES Red Team
curl
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An issue existed in curl which may result in unintentionally
sending sensitive information via an incorrect connection
Description: This is a vulnerability in open source code and Apple
Software is among the affected projects. The CVE-ID was assigned by a
third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2025-14524
DeviceLink
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to access sensitive user data
Description: A parsing issue in the handling of directory paths was
addressed with improved path validation.
CVE-2026-28876: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
GeoServices
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to access sensitive user data
Description: An information leakage was addressed with additional
validation.
CVE-2026-28870: XiguaSec
iCloud
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to enumerate a user's installed apps
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-28880: Zhongcheng Li from IES Red Team
CVE-2026-28833: Zhongcheng Li from IES Red Team
ImageIO
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: This is a vulnerability in open source code and Apple
Software is among the affected projects. The CVE-ID was assigned by a
third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2025-64505
Kernel
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to disclose kernel memory
Description: A logging issue was addressed with improved data redaction.
CVE-2026-28868: 이동하 (Lee Dong Ha of BoB 0xB6)
Kernel
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to leak sensitive kernel state
Description: This issue was addressed with improved authentication.
CVE-2026-28867: Jian Lee (@speedyfriend433)
Kernel
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-20698: DARKNAVY (@DarkNavyOrg)
Kernel
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to cause unexpected system termination or
write kernel memory
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-20687: Johnny Franks (@zeroxjf)
libxpc
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to enumerate a user's installed apps
Description: This issue was addressed with improved checks.
CVE-2026-28882: Ilias Morad (A2nkF) of Voynich Group, Duy Trần
(@khanhduytran0), @hugeBlack
Mail
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: "Hide IP Address" and "Block All Remote Content" may not apply
to all mail content
Description: A privacy issue was addressed with improved handling of
user preferences.
CVE-2026-20692: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
Printing
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to break out of its sandbox
Description: A path handling issue was addressed with improved
validation.
CVE-2026-20688: wdszzml and Atuin Automated Vulnerability Discovery
Engine
Sandbox Profiles
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to fingerprint the user
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-28863: Gongyu Ma (@Mezone0)
Security
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: A local attacker may gain access to user's Keychain items
Description: This issue was addressed with improved permissions
checking.
CVE-2026-28864: Alex Radocea
Siri
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, a
Severity
No CVSS data available.
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuln.freearchive.org/archive/full-disclos… | technical-description |
| https://seclists.org/fulldisclosure/2026/Mar/16 | technical-description |
| https://nmap.org/mailman/listinfo/fulldisclosure | |
| https://seclists.org/fulldisclosure/ | |
| https://support.apple.com/100100 | |
| https://support.apple.com/126792 | |
| https://www.apple.com/itunes/ | |
| https://www.apple.com/support/security/pgp/ |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apple | APPLE-SA-03-24-2026-1 iOS |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0261 (this record)
- related CVE-2025-14524
- related CVE-2025-64505
- related CVE-2026-20643
- related CVE-2026-20664
- related CVE-2026-20665
- related CVE-2026-20687
- related CVE-2026-20688
- related CVE-2026-20690
- related CVE-2026-20691
- related CVE-2026-20692
- related CVE-2026-20698
- related CVE-2026-28822
- related CVE-2026-28833
- related CVE-2026-28852
- related CVE-2026-28856
- related CVE-2026-28857
- related CVE-2026-28858
- related CVE-2026-28859
- related CVE-2026-28861
- related CVE-2026-28863
- related CVE-2026-28864
- related CVE-2026-28865
- related CVE-2026-28866
- related CVE-2026-28867
- related CVE-2026-28868
- related CVE-2026-28870
- related CVE-2026-28871
- related CVE-2026-28874
- related CVE-2026-28875
- related CVE-2026-28876
- related CVE-2026-28877
- related CVE-2026-28878
- related CVE-2026-28879
- related CVE-2026-28880
- related CVE-2026-28882
- related CVE-2026-28886
- related CVE-2026-28894
- related CVE-2026-28895
{
"containers": {
"cna": {
"affected": [
{
"product": "APPLE-SA-03-24-2026-1 iOS",
"vendor": "Apple",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-03-24-2026-1 iOS 26.4 and iPadOS 26.4\n\niOS 26.4 and iPadOS 26.4 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/126792.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\n802.1X\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An attacker in a privileged network position may be able to\nintercept network traffic\nDescription: An authentication issue was addressed with improved state\nmanagement.\nCVE-2026-28865: H\u00e9lo\u00efse Gollier and Mathy Vanhoef (KU Leuven)\n\nAccounts\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-28877: Rosyna Keller of Totally Not Malicious Software\n\nApp Protection\nAvailable for: iPhone 11 and later\nImpact: An attacker with physical access to an iOS device with Stolen\nDevice Protection enabled may be able to access biometrics-gated\nProtected Apps with the passcode\nDescription: The issue was addressed with improved checks.\nCVE-2026-28895: Zack Tickman\n\nAudio\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nCVE-2026-28879: Justin Cohen of Google\n\nAudio\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An attacker may be able to cause unexpected app termination\nDescription: A type confusion issue was addressed with improved memory\nhandling.\nCVE-2026-28822: Jex Amro\n\nBaseband\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A remote attacker may cause an unexpected app termination\nDescription: The issue was addressed with improved checks.\nCVE-2026-28874: Hazem Issa, Tuan D. Hoang, and Yongdae Kim @ SysSec,\nKAIST\n\nBaseband\nAvailable for: iPhone 16e\nImpact: A remote attacker may be able to cause a denial-of-service\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28875: Tuan D. Hoang and Yongdae Kim @ KAIST SysSec Lab\n\nCalling Framework\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A remote attacker may be able to cause a denial-of-service\nDescription: A denial-of-service issue was addressed with improved input\nvalidation.\nCVE-2026-28894: an anonymous researcher\n\nClipboard\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved validation of\nsymlinks.\nCVE-2026-28866: Cristian Dinca (icmd.tech)\n\nCoreMedia\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-20690: Hossein Lotfi (@hosselot) of Trend Micro Zero Day\nInitiative\n\nCoreUtils\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A user in a privileged network position may be able to cause a\ndenial-of-service\nDescription: A null pointer dereference was addressed with improved\ninput validation.\nCVE-2026-28886: Etienne Charron (Renault) and Victoria Martini (Renault)\n\nCrash Reporter\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to enumerate a user\u0027s installed apps\nDescription: A privacy issue was addressed by removing sensitive data.\nCVE-2026-28878: Zhongcheng Li from IES Red Team\n\ncurl\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An issue existed in curl which may result in unintentionally\nsending sensitive information via an incorrect connection\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2025-14524\n\nDeviceLink\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to access sensitive user data\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-28876: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nGeoServices\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to access sensitive user data\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-28870: XiguaSec\n\niCloud\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to enumerate a user\u0027s installed apps\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28880: Zhongcheng Li from IES Red Team\nCVE-2026-28833: Zhongcheng Li from IES Red Team\n\nImageIO\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2025-64505\n\nKernel\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to disclose kernel memory\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28868: \uc774\ub3d9\ud558 (Lee Dong Ha of BoB 0xB6)\n\nKernel\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to leak sensitive kernel state\nDescription: This issue was addressed with improved authentication.\nCVE-2026-28867: Jian Lee (@speedyfriend433)\n\nKernel\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-20698: DARKNAVY (@DarkNavyOrg)\n\nKernel\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-20687: Johnny Franks (@zeroxjf)\n\nlibxpc\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to enumerate a user\u0027s installed apps\nDescription: This issue was addressed with improved checks.\nCVE-2026-28882: Ilias Morad (A2nkF) of Voynich Group, Duy Tr\u1ea7n\n(@khanhduytran0), @hugeBlack\n\nMail\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: \"Hide IP Address\" and \"Block All Remote Content\" may not apply\nto all mail content\nDescription: A privacy issue was addressed with improved handling of\nuser preferences.\nCVE-2026-20692: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nPrinting\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to break out of its sandbox\nDescription: A path handling issue was addressed with improved\nvalidation.\nCVE-2026-20688: wdszzml and Atuin Automated Vulnerability Discovery\nEngine\n\nSandbox Profiles\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to fingerprint the user\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28863: Gongyu Ma (@Mezone0)\n\nSecurity\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A local attacker may gain access to user\u0027s Keychain items\nDescription: This issue was addressed with improved permissions\nchecking.\nCVE-2026-28864: Alex Radocea\n\nSiri\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, a"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T10:08:26Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/16"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Mar/16"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/126792"
},
{
"url": "https://www.apple.com/itunes/"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Mar/16"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-03-24-2026-1 iOS 26.4 and iPadOS 26.4",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2025-14524",
"type": "related"
},
{
"destId": "CVE-2025-64505",
"type": "related"
},
{
"destId": "CVE-2026-20643",
"type": "related"
},
{
"destId": "CVE-2026-20664",
"type": "related"
},
{
"destId": "CVE-2026-20665",
"type": "related"
},
{
"destId": "CVE-2026-20687",
"type": "related"
},
{
"destId": "CVE-2026-20688",
"type": "related"
},
{
"destId": "CVE-2026-20690",
"type": "related"
},
{
"destId": "CVE-2026-20691",
"type": "related"
},
{
"destId": "CVE-2026-20692",
"type": "related"
},
{
"destId": "CVE-2026-20698",
"type": "related"
},
{
"destId": "CVE-2026-28822",
"type": "related"
},
{
"destId": "CVE-2026-28833",
"type": "related"
},
{
"destId": "CVE-2026-28852",
"type": "related"
},
{
"destId": "CVE-2026-28856",
"type": "related"
},
{
"destId": "CVE-2026-28857",
"type": "related"
},
{
"destId": "CVE-2026-28858",
"type": "related"
},
{
"destId": "CVE-2026-28859",
"type": "related"
},
{
"destId": "CVE-2026-28861",
"type": "related"
},
{
"destId": "CVE-2026-28863",
"type": "related"
},
{
"destId": "CVE-2026-28864",
"type": "related"
},
{
"destId": "CVE-2026-28865",
"type": "related"
},
{
"destId": "CVE-2026-28866",
"type": "related"
},
{
"destId": "CVE-2026-28867",
"type": "related"
},
{
"destId": "CVE-2026-28868",
"type": "related"
},
{
"destId": "CVE-2026-28870",
"type": "related"
},
{
"destId": "CVE-2026-28871",
"type": "related"
},
{
"destId": "CVE-2026-28874",
"type": "related"
},
{
"destId": "CVE-2026-28875",
"type": "related"
},
{
"destId": "CVE-2026-28876",
"type": "related"
},
{
"destId": "CVE-2026-28877",
"type": "related"
},
{
"destId": "CVE-2026-28878",
"type": "related"
},
{
"destId": "CVE-2026-28879",
"type": "related"
},
{
"destId": "CVE-2026-28880",
"type": "related"
},
{
"destId": "CVE-2026-28882",
"type": "related"
},
{
"destId": "CVE-2026-28886",
"type": "related"
},
{
"destId": "CVE-2026-28894",
"type": "related"
},
{
"destId": "CVE-2026-28895",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0261",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/16",
"automated": true,
"contentSha256": "5204d651f4d908c4aa97b259f1fdea8f816c8b6481369f7cef3ed97e53ec75a5",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/16",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-03-25T00:00:35Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0261"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T08:13:42Z",
"dateUpdated": "2026-09-09T10:08:26Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0261"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0262
Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-09 10:08
VLAI
EPSS
VEX
Title
APPLE-SA-03-24-2026-2 iOS 18.7.7 and iPadOS 18.7.7
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-03-24-2026-2 iOS 18.7.7 and iPadOS 18.7.7
iOS 18.7.7 and iPadOS 18.7.7 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/126793.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
802.1X
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: An attacker in a privileged network position may be able to
intercept network traffic
Description: An authentication issue was addressed with improved state
management.
CVE-2026-28865: Héloïse Gollier and Mathy Vanhoef (KU Leuven)
AppleKeyStore
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-20637: Johnny Franks (zeroxjf), an anonymous researcher
Audio
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: Processing maliciously crafted web content may lead to an
unexpected process crash
Description: A use-after-free issue was addressed with improved memory
management.
CVE-2026-28879: Justin Cohen of Google
Clipboard
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved validation of
symlinks.
CVE-2026-28866: Cristian Dinca (icmd.tech)
CoreMedia
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: Processing an audio stream in a maliciously crafted media file
may terminate the process
Description: An out-of-bounds access issue was addressed with improved
bounds checking.
CVE-2026-20690: Hossein Lotfi (@hosselot) of Trend Micro Zero Day
Initiative
CoreUtils
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: A user in a privileged network position may be able to cause a
denial-of-service
Description: A null pointer dereference was addressed with improved
input validation.
CVE-2026-28886: Etienne Charron (Renault) and Victoria Martini (Renault)
Crash Reporter
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: An app may be able to enumerate a user's installed apps
Description: A privacy issue was addressed by removing sensitive data.
CVE-2026-28878: Zhongcheng Li from IES Red Team
curl
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: An issue existed in curl which may result in unintentionally
sending sensitive information via an incorrect connection
Description: This is a vulnerability in open source code and Apple
Software is among the affected projects. The CVE-ID was assigned by a
third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2025-14524
DeviceLink
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: An app may be able to access sensitive user data
Description: A parsing issue in the handling of directory paths was
addressed with improved path validation.
CVE-2026-28876: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
Focus
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: An app may be able to access sensitive user data
Description: A logging issue was addressed with improved data redaction.
CVE-2026-20668: Kirin (@Pwnrin)
iCloud
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: An app may be able to enumerate a user's installed apps
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-28880: Zhongcheng Li from IES Red Team
ImageIO
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: This is a vulnerability in open source code and Apple
Software is among the affected projects. The CVE-ID was assigned by a
third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2025-64505
iTunes Store
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: A user with physical access to an iOS device may be able to
bypass Activation Lock
Description: A path handling issue was addressed with improved
validation.
CVE-2025-43534: iG0x72 and JJ of XiguaSec, Lehan Dilusha Jayasinghe
Kernel
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: An app may be able to disclose kernel memory
Description: A logging issue was addressed with improved data redaction.
CVE-2026-28868: 이동하 (Lee Dong Ha of BoB 0xB6)
Kernel
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: An app may be able to leak sensitive kernel state
Description: This issue was addressed with improved authentication.
CVE-2026-28867: Jian Lee (@speedyfriend433)
Kernel
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: An app may be able to cause unexpected system termination or
write kernel memory
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-20687: Johnny Franks (@zeroxjf)
mDNSResponder
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: An app may be able to leak sensitive kernel state
Description: This issue was addressed with improved authentication.
CVE-2026-28867: Jian Lee (@speedyfriend433)
Security
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: A local attacker may gain access to user's Keychain items
Description: This issue was addressed with improved permissions
checking.
CVE-2026-28864: Alex Radocea
UIFoundation
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: An app may be able to cause a denial-of-service
Description: A stack overflow was addressed with improved input
validation.
CVE-2026-28852: Caspian Tarafdar
Vision
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: Parsing a maliciously crafted file may lead to an unexpected app
termination
Description: The issue was addressed with improved memory handling.
CVE-2026-20657: Andrew Becker
WebKit
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: Processing maliciously crafted web content may prevent Content
Security Policy from being enforced
Description: This issue was addressed through improved state management.
WebKit Bugzilla: 304951
CVE-2026-20665: webb
WebKit
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: Processing maliciously crafted web content may bypass Same
Origin Policy
Description: A cross-origin issue in the Navigation API was addressed
with improved input validation.
WebKit Bugzilla: 306050
CVE-2026-20643: Thomas Espach
WebKit
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: A remote attacker may be able to view leaked DNS queries with
Private Relay turned on
Description: A logic issue was addressed with improved state management.
WebKit Bugzilla: 295943
CVE-2025-43376: Mike Cardwell of grepular.com, Bob Lord
WebKit
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: A malicious website may be able to access script message
handlers intended for other origins
Description: A logic issue was addressed with improved state management.
WebKit Bugzilla: 307014
CVE-2026-28861: Hongze Wu and Shuaike Dong from Ant Group Infrastructure
Security Team
WebKit
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: Visiting a maliciously crafted website may lead to a cross-site
scripting attack
Description: A logic issue was addressed with improved checks.
WebKit Bugzilla: 305859
CVE-2026-28871: @hamayanhamayan
Additional recognition
Safari
We would like to acknowledge @RenwaX23 for their assistance.
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "iOS 18.7.7 and iPadOS 18.7.7".
All information is also posted on the Apple Security Releases
web site: https://support.apple.com/100100.
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmnDIq0ACgkQ4Ifiq8DH
7PUFaw/9G3jAXEudRiecXeZp9k/N+UQjmqDFpRyTWcWna8xafXl+XdMP0oLha0P6
ENk+zYbval1EO32jsxGjD04APryEkIBIMeQzeNTdlFTH6jUhPT1gFc1n6kXIMviZ
+dw31YSO6iz4gbYe3rMGqeDinE7IoPxFVky+6t70YseqE9HBq6Hn2ABpVlfoSwpm
qicn+A6GrN7vAfHlnPXnehaJjOaVRJY55w5F4ISwqa/RcPlbdYtakXpon0be2Aun
uq6Syarq69l3T4rCqfzhZMoq8QsnqT5V6aYewMHuojsg2etPHc/NPM5PjgaM4CB0
vy6eHLMXXvhofNdNIBw54glm6JZf9+ARrTDuHdsu3tLMteJeHdyLcFsANTztYeyQ
tmBJgDWGZipwXC+ju5n8SF1f+i5oU1cMSRtu19EyeeWK2HZOCq603w+uk99SOZqK
EZuc0/dmH4BYt0CvZ7P0wYh5oiIkAkRLznQE86a/+7K7PyKBgE6ezxRuq3tN9ExI
n09WVCXCW47n1dUEs9FfGNRO0Cb6YIQ2hX4zQQJWEfQcKwYzr66mSEQvzTglDJPk
yUF9Y5FbcJ/h7IWWGQr1PfnFTpbCMv9Pym1SRe0NrhoNWGxEP9ewHBkPRc3Gc1aB
sNwyHy+M4iMaF1AFHHu4OjRf8vG7NLJdPx26RhIeL8ihIUcfF9U=
=JY61
-----END PGP SIGNATURE-----
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuln.freearchive.org/archive/full-disclos… | technical-description |
| https://seclists.org/fulldisclosure/2026/Mar/17 | technical-description |
| https://nmap.org/mailman/listinfo/fulldisclosure | |
| https://seclists.org/fulldisclosure/ | |
| https://support.apple.com/100100 | |
| https://support.apple.com/126793 | |
| https://www.apple.com/itunes/ | |
| https://www.apple.com/support/security/pgp/ |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apple | APPLE-SA-03-24-2026-2 iOS |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0262 (this record)
- related CVE-2025-14524
- related CVE-2025-43376
- related CVE-2025-43534
- related CVE-2025-64505
- related CVE-2026-20637
- related CVE-2026-20643
- related CVE-2026-20657
- related CVE-2026-20665
- related CVE-2026-20668
- related CVE-2026-20687
- related CVE-2026-20690
- related CVE-2026-28852
- related CVE-2026-28861
- related CVE-2026-28864
- related CVE-2026-28865
- related CVE-2026-28866
- related CVE-2026-28867
- related CVE-2026-28868
- related CVE-2026-28871
- related CVE-2026-28876
- related CVE-2026-28878
- related CVE-2026-28879
- related CVE-2026-28880
- related CVE-2026-28886
{
"containers": {
"cna": {
"affected": [
{
"product": "APPLE-SA-03-24-2026-2 iOS",
"vendor": "Apple",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-03-24-2026-2 iOS 18.7.7 and iPadOS 18.7.7\n\niOS 18.7.7 and iPadOS 18.7.7 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/126793.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\n802.1X\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An attacker in a privileged network position may be able to\nintercept network traffic\nDescription: An authentication issue was addressed with improved state\nmanagement.\nCVE-2026-28865: H\u00e9lo\u00efse Gollier and Mathy Vanhoef (KU Leuven)\n\nAppleKeyStore\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-20637: Johnny Franks (zeroxjf), an anonymous researcher\n\nAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nCVE-2026-28879: Justin Cohen of Google\n\nClipboard\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved validation of\nsymlinks.\nCVE-2026-28866: Cristian Dinca (icmd.tech)\n\nCoreMedia\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-20690: Hossein Lotfi (@hosselot) of Trend Micro Zero Day\nInitiative\n\nCoreUtils\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A user in a privileged network position may be able to cause a\ndenial-of-service\nDescription: A null pointer dereference was addressed with improved\ninput validation.\nCVE-2026-28886: Etienne Charron (Renault) and Victoria Martini (Renault)\n\nCrash Reporter\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to enumerate a user\u0027s installed apps\nDescription: A privacy issue was addressed by removing sensitive data.\nCVE-2026-28878: Zhongcheng Li from IES Red Team\n\ncurl\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An issue existed in curl which may result in unintentionally\nsending sensitive information via an incorrect connection\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2025-14524\n\nDeviceLink\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access sensitive user data\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-28876: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nFocus\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access sensitive user data\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-20668: Kirin (@Pwnrin)\n\niCloud\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to enumerate a user\u0027s installed apps\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28880: Zhongcheng Li from IES Red Team\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2025-64505\n\niTunes Store\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A user with physical access to an iOS device may be able to\nbypass Activation Lock\nDescription: A path handling issue was addressed with improved\nvalidation.\nCVE-2025-43534: iG0x72 and JJ of XiguaSec, Lehan Dilusha Jayasinghe\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to disclose kernel memory\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28868: \uc774\ub3d9\ud558 (Lee Dong Ha of BoB 0xB6)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to leak sensitive kernel state\nDescription: This issue was addressed with improved authentication.\nCVE-2026-28867: Jian Lee (@speedyfriend433)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-20687: Johnny Franks (@zeroxjf)\n\nmDNSResponder\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to leak sensitive kernel state\nDescription: This issue was addressed with improved authentication.\nCVE-2026-28867: Jian Lee (@speedyfriend433)\n\nSecurity\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A local attacker may gain access to user\u0027s Keychain items\nDescription: This issue was addressed with improved permissions\nchecking.\nCVE-2026-28864: Alex Radocea\n\nUIFoundation\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause a denial-of-service\nDescription: A stack overflow was addressed with improved input\nvalidation.\nCVE-2026-28852: Caspian Tarafdar\n\nVision\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Parsing a maliciously crafted file may lead to an unexpected app\ntermination\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-20657: Andrew Becker\n\nWebKit\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing maliciously crafted web content may prevent Content\nSecurity Policy from being enforced\nDescription: This issue was addressed through improved state management.\nWebKit Bugzilla: 304951\nCVE-2026-20665: webb\n\nWebKit\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing maliciously crafted web content may bypass Same\nOrigin Policy\nDescription: A cross-origin issue in the Navigation API was addressed\nwith improved input validation.\nWebKit Bugzilla: 306050\nCVE-2026-20643: Thomas Espach\n\nWebKit\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote attacker may be able to view leaked DNS queries with\nPrivate Relay turned on\nDescription: A logic issue was addressed with improved state management.\nWebKit Bugzilla: 295943\nCVE-2025-43376: Mike Cardwell of grepular.com, Bob Lord\n\nWebKit\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A malicious website may be able to access script message\nhandlers intended for other origins\nDescription: A logic issue was addressed with improved state management.\nWebKit Bugzilla: 307014\nCVE-2026-28861: Hongze Wu and Shuaike Dong from Ant Group Infrastructure\nSecurity Team\n\nWebKit\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Visiting a maliciously crafted website may lead to a cross-site\nscripting attack\nDescription: A logic issue was addressed with improved checks.\nWebKit Bugzilla: 305859\nCVE-2026-28871: @hamayanhamayan\n\nAdditional recognition\n\nSafari\nWe would like to acknowledge @RenwaX23 for their assistance.\n\nThis update is available through iTunes and Software Update on your\niOS device, and will not appear in your computer\u0027s Software Update\napplication, or in the Apple Downloads site. Make sure you have an\nInternet connection and have installed the latest version of iTunes\nfrom https://www.apple.com/itunes/\n\niTunes and Software Update on the device will automatically check\nApple\u0027s update server on its weekly schedule. When an update is\ndetected, it is downloaded and the option to be installed is\npresented to the user when the iOS device is docked. We recommend\napplying the update immediately if possible. Selecting Don\u0027t Install\nwill present the option the next time you connect your iOS device.\n\nThe automatic update process may take up to a week depending on the\nday that iTunes or the device checks for updates. You may manually\nobtain the update via the Check for Updates button within iTunes, or\nthe Software Update on your device.\n\nTo check that the iPhone, iPod touch, or iPad has been updated:\n\n* Navigate to Settings\n* Select General\n* Select About. The version after applying this update\nwill be \"iOS 18.7.7 and iPadOS 18.7.7\".\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmnDIq0ACgkQ4Ifiq8DH\n7PUFaw/9G3jAXEudRiecXeZp9k/N+UQjmqDFpRyTWcWna8xafXl+XdMP0oLha0P6\nENk+zYbval1EO32jsxGjD04APryEkIBIMeQzeNTdlFTH6jUhPT1gFc1n6kXIMviZ\n+dw31YSO6iz4gbYe3rMGqeDinE7IoPxFVky+6t70YseqE9HBq6Hn2ABpVlfoSwpm\nqicn+A6GrN7vAfHlnPXnehaJjOaVRJY55w5F4ISwqa/RcPlbdYtakXpon0be2Aun\nuq6Syarq69l3T4rCqfzhZMoq8QsnqT5V6aYewMHuojsg2etPHc/NPM5PjgaM4CB0\nvy6eHLMXXvhofNdNIBw54glm6JZf9+ARrTDuHdsu3tLMteJeHdyLcFsANTztYeyQ\ntmBJgDWGZipwXC+ju5n8SF1f+i5oU1cMSRtu19EyeeWK2HZOCq603w+uk99SOZqK\nEZuc0/dmH4BYt0CvZ7P0wYh5oiIkAkRLznQE86a/+7K7PyKBgE6ezxRuq3tN9ExI\nn09WVCXCW47n1dUEs9FfGNRO0Cb6YIQ2hX4zQQJWEfQcKwYzr66mSEQvzTglDJPk\nyUF9Y5FbcJ/h7IWWGQr1PfnFTpbCMv9Pym1SRe0NrhoNWGxEP9ewHBkPRc3Gc1aB\nsNwyHy+M4iMaF1AFHHu4OjRf8vG7NLJdPx26RhIeL8ihIUcfF9U=\n=JY61\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T10:08:25Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/17"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Mar/17"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/126793"
},
{
"url": "https://www.apple.com/itunes/"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Mar/17"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-03-24-2026-2 iOS 18.7.7 and iPadOS 18.7.7",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2025-14524",
"type": "related"
},
{
"destId": "CVE-2025-43376",
"type": "related"
},
{
"destId": "CVE-2025-43534",
"type": "related"
},
{
"destId": "CVE-2025-64505",
"type": "related"
},
{
"destId": "CVE-2026-20637",
"type": "related"
},
{
"destId": "CVE-2026-20643",
"type": "related"
},
{
"destId": "CVE-2026-20657",
"type": "related"
},
{
"destId": "CVE-2026-20665",
"type": "related"
},
{
"destId": "CVE-2026-20668",
"type": "related"
},
{
"destId": "CVE-2026-20687",
"type": "related"
},
{
"destId": "CVE-2026-20690",
"type": "related"
},
{
"destId": "CVE-2026-28852",
"type": "related"
},
{
"destId": "CVE-2026-28861",
"type": "related"
},
{
"destId": "CVE-2026-28864",
"type": "related"
},
{
"destId": "CVE-2026-28865",
"type": "related"
},
{
"destId": "CVE-2026-28866",
"type": "related"
},
{
"destId": "CVE-2026-28867",
"type": "related"
},
{
"destId": "CVE-2026-28868",
"type": "related"
},
{
"destId": "CVE-2026-28871",
"type": "related"
},
{
"destId": "CVE-2026-28876",
"type": "related"
},
{
"destId": "CVE-2026-28878",
"type": "related"
},
{
"destId": "CVE-2026-28879",
"type": "related"
},
{
"destId": "CVE-2026-28880",
"type": "related"
},
{
"destId": "CVE-2026-28886",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0262",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/17",
"automated": true,
"contentSha256": "90119543045bfefb1591d9baed175decdfa659d2dfb92443eff5c4d1b6670c03",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/17",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-03-25T00:01:12Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0262"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T08:13:42Z",
"dateUpdated": "2026-09-09T10:08:25Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0262"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0263
Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-09 10:08
VLAI
EPSS
VEX
Title
APPLE-SA-03-24-2026-3 macOS Tahoe 26.4
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-03-24-2026-3 macOS Tahoe 26.4
macOS Tahoe 26.4 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/126794.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
802.1X
Available for: macOS Tahoe
Impact: An attacker in a privileged network position may be able to
intercept network traffic
Description: An authentication issue was addressed with improved state
management.
CVE-2026-28865: Héloïse Gollier and Mathy Vanhoef (KU Leuven)
Accounts
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: An authorization issue was addressed with improved state
management.
CVE-2026-28877: Rosyna Keller of Totally Not Malicious Software
Admin Framework
Available for: macOS Tahoe
Impact: An app with root privileges may be able to delete protected
system files
Description: A path handling issue was addressed with improved
validation.
CVE-2026-28823: Ryan Dowd (@_rdowd)
apache
Available for: macOS Tahoe
Impact: Multiple issues in Apache
Description: This is a vulnerability in open source code and Apple
Software is among the affected projects. The CVE-ID was assigned by a
third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2025-55753
CVE-2025-58098
CVE-2025-59775
CVE-2025-65082
CVE-2025-66200
AppleMobileFileIntegrity
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: An authorization issue was addressed with improved state
management.
CVE-2026-28824: Mickey Jin (@patch1t)
AppleMobileFileIntegrity
Available for: macOS Tahoe
Impact: An app may be able to access user-sensitive data
Description: A downgrade issue affecting Intel-based Mac computers was
addressed with additional code-signing restrictions.
CVE-2026-20699: Mickey Jin (@patch1t)
AppleScript
Available for: macOS Tahoe
Impact: An app may bypass Gatekeeper checks
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-20684: Koh M. Nakagawa (@tsunek0h) of FFRI Security, Inc.
Archive Utility
Available for: macOS Tahoe
Impact: An app may be able to access user-sensitive data
Description: This issue was addressed with improved handling of
symlinks.
CVE-2026-20633: Mickey Jin (@patch1t)
Audio
Available for: macOS Tahoe
Impact: Processing maliciously crafted web content may lead to an
unexpected process crash
Description: A use-after-free issue was addressed with improved memory
management.
CVE-2026-28879: Justin Cohen of Google
Audio
Available for: macOS Tahoe
Impact: An attacker may be able to cause unexpected app termination
Description: A type confusion issue was addressed with improved memory
handling.
CVE-2026-28822: Jex Amro
Calling Framework
Available for: macOS Tahoe
Impact: A remote attacker may be able to cause a denial-of-service
Description: A denial-of-service issue was addressed with improved input
validation.
CVE-2026-28894: an anonymous researcher
Clipboard
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved validation of
symlinks.
CVE-2026-28866: Cristian Dinca (icmd.tech)
CoreMedia
Available for: macOS Tahoe
Impact: Processing an audio stream in a maliciously crafted media file
may terminate the process
Description: An out-of-bounds access issue was addressed with improved
bounds checking.
CVE-2026-20690: Hossein Lotfi (@hosselot) of Trend Micro Zero Day
Initiative
CoreServices
Available for: macOS Tahoe
Impact: An app may be able to gain elevated privileges
Description: A validation issue existed in the entitlement verification.
This issue was addressed with improved validation of the process
entitlement.
CVE-2026-28821: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab
CoreServices
Available for: macOS Tahoe
Impact: An app may be able to break out of its sandbox
Description: A permissions issue was addressed with additional sandbox
restrictions.
CVE-2026-28838: an anonymous researcher
CoreUtils
Available for: macOS Tahoe
Impact: A user in a privileged network position may be able to cause a
denial-of-service
Description: A null pointer dereference was addressed with improved
input validation.
CVE-2026-28886: Etienne Charron (Renault) and Victoria Martini (Renault)
Crash Reporter
Available for: macOS Tahoe
Impact: An app may be able to enumerate a user's installed apps
Description: A privacy issue was addressed by removing sensitive data.
CVE-2026-28878: Zhongcheng Li from IES Red Team
CUPS
Available for: macOS Tahoe
Impact: An app may be able to gain root privileges
Description: A race condition was addressed with improved state
handling.
CVE-2026-28888: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
CUPS
Available for: macOS Tahoe
Impact: A document may be written to a temporary file when using print
preview
Description: A privacy issue was addressed with improved handling of
temporary files.
CVE-2026-28893: Asaf Cohen
curl
Available for: macOS Tahoe
Impact: An issue existed in curl which may result in unintentionally
sending sensitive information via an incorrect connection
Description: This is a vulnerability in open source code and Apple
Software is among the affected projects. The CVE-ID was assigned by a
third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2025-14524
DeviceLink
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: A parsing issue in the handling of directory paths was
addressed with improved path validation.
CVE-2026-28876: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
Diagnostics
Available for: macOS Tahoe
Impact: An app may be able to modify protected parts of the file system
Description: A permissions issue was addressed by removing the
vulnerable code.
CVE-2026-28892: 风沐云烟 (@binary_fmyy) and Minghao Lin (@Y1nKoc)
File System
Available for: macOS Tahoe
Impact: An app may be able to disclose kernel memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-28832: DARKNAVY (@DarkNavyOrg)
GeoServices
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: An information leakage was addressed with additional
validation.
CVE-2026-28870: XiguaSec
GPU Drivers
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: A race condition was addressed with improved state
handling.
CVE-2026-28834: an anonymous researcher
iCloud
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: A privacy issue was addressed by moving sensitive data.
CVE-2026-28881: Ye Zhang of Baidu Security, Ryan Dowd (@_rdowd), Csaba
Fitzl (@theevilbit) of Iru
iCloud
Available for: macOS Tahoe
Impact: An app may be able to enumerate a user's installed apps
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-28880: Zhongcheng Li from IES Red Team
CVE-2026-28833: Zhongcheng Li from IES Red Team
ImageIO
Available for: macOS Tahoe
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: This is a vulnerability in open source code and Apple
Software is among the affected projects. The CVE-ID was assigned by a
third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2025-64505
IOGraphics
Available for: macOS Tahoe
Impact: A buffer overflow may result in memory corruption and unexpected
app termination
Description: The issue was addressed with improved bounds checks.
CVE-2026-28842: Joseph Ravichandran (@0xjprx) of MIT CSAIL
IOGraphics
Available for: macOS Tahoe
Impact: A buffer overflow may result in memory corruption and unexpected
app termination
Description: A buffer overflow was addressed with improved size
validation.
CVE-2026-28841: Joseph Ravichandran (@0xjprx) of MIT CSAIL
Kernel
Available for: macOS Tahoe
Impact: An app may be able to disclose kernel memory
Description: A logging issue was addressed with improved data redaction.
CVE-2026-28868: 이동하 (Lee Dong Ha of BoB 0xB6)
Kernel
Available for: macOS Tahoe
Impact: An app may be able to leak sensitive kernel state
Description: This issue was addressed with improved authentication.
CVE-2026-28867: Jian Lee (@speedyfriend433)
Kernel
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-20698: DARKNAVY (@DarkNavyOrg)
Kernel
Available for: macOS Tahoe
Impact: An app may be able to determine kernel memory layout
Description: An information disclosure issue was addressed with improved
memory management.
CVE-2026-20695: 이동하 (Lee Dong Ha of BoB 0xB6) working with TrendAI Zero
Day Initiative, hari shanmugam
Kernel
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination or
write kernel memory
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-20687: Johnny Franks (@zeroxjf)
LaunchServices
Available for: macOS Tahoe
Impact: An app may be able to access protected user data
Description: An authorization issue was addressed with improved state
management.
CVE-2026-28845: Yuebin Sun (@yuebinsun2020), an anonymous researcher,
Nathaniel Oh (@calysteon), Kirin (@Pwnrin), Wojciech Regula of SecuRing
(wojciechregula.blog), Joshua Jewett (@JoshJewett33), an anonymous
researcher
libxpc
Available for: macOS Tahoe
Impact: An app may be able to enumerate a user's installed apps
Description: This issue was addressed with improved checks.
CVE-2026-28882: Ilias Morad (A2nkF) of Voynich Group, Duy Trần
(@khanhduytran0), @hugeBlack
libxpc
Available for: macOS Tahoe
Impact: An app may be able to access protected user data
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-20607: an anonymous researcher
Mail
Available for: macOS Tahoe
Impact: "Hide IP Address" and "Block All Remote Content" may not apply
to all mail content
Description: A privacy issue was addressed with improved handling of
user preferences.
CVE-2026-20692: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
MigrationKit
Available for: macOS Tahoe
Impact: An app may be able to access user-sensitive data
Description: This issue was addressed with improved handling of
symlinks.
CVE-2026-20694: Rodolphe Brunetti (@eisw0lf) of Lupus Nova
Music
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: A parsing issue in the handling of directory paths was
addressed with improved path validation.
CVE-2026-20632: Rodolphe Brunetti (@eisw0lf) of Lupus Nova
NetAuth
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: The issue was addressed with improved checks.
CVE-2026-28839: Mickey Jin (@patch1t)
NetAuth
Available for: macOS Tahoe
Impact: An app may be able to connect to a network share without user
consent
Description: An access issue was addressed with additional sandbox
restrictions.
CVE-2026-20701: Matej Moravec (@MacejkoMoravec)
NetAuth
Available for: macOS Tahoe
Impact: An app may be able to break out of its sandbox
Description: A race condition was addressed with additional validation.
CVE-2026-28891: an anonymous researcher
NetFSFramework
Available for: macOS Tahoe
Impact: An app may be able to break out of its sandbox
Description: A parsing issue in the handling of directory paths was
addressed with improved path validation.
CVE-2026-28827: Csaba Fitzl (@theevilbit) of Iru, an anonymous
researcher
Notes
Available for: macOS Tahoe
Impact: An app may be able to delete files for which it does not have
permission
Description: A path handling issue was addressed with improved
validation.
CVE-2026-28816: Dawuge of Shuffl
Severity
No CVSS data available.
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuln.freearchive.org/archive/full-disclos… | technical-description |
| https://seclists.org/fulldisclosure/2026/Mar/18 | technical-description |
| https://nmap.org/mailman/listinfo/fulldisclosure | |
| https://seclists.org/fulldisclosure/ | |
| https://support.apple.com/100100 | |
| https://support.apple.com/126794 | |
| https://support.apple.com/downloads/ | |
| https://www.apple.com/support/security/pgp/ |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apple | APPLE-SA-03-24-2026-3 macOS Tahoe |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0263 (this record)
- related CVE-2025-14524
- related CVE-2025-55753
- related CVE-2025-58098
- related CVE-2025-59775
- related CVE-2025-64505
- related CVE-2025-65082
- related CVE-2025-66200
- related CVE-2026-20607
- related CVE-2026-20631
- related CVE-2026-20632
- related CVE-2026-20633
- related CVE-2026-20643
- related CVE-2026-20664
- related CVE-2026-20665
- related CVE-2026-20684
- related CVE-2026-20687
- related CVE-2026-20688
- related CVE-2026-20690
- related CVE-2026-20691
- related CVE-2026-20692
- related CVE-2026-20693
- related CVE-2026-20694
- related CVE-2026-20695
- related CVE-2026-20697
- related CVE-2026-20698
- related CVE-2026-20699
- related CVE-2026-20701
- related CVE-2026-28816
- related CVE-2026-28817
- related CVE-2026-28818
- related CVE-2026-28820
- related CVE-2026-28821
- related CVE-2026-28822
- related CVE-2026-28823
- related CVE-2026-28824
- related CVE-2026-28825
- related CVE-2026-28826
- related CVE-2026-28827
- related CVE-2026-28828
- related CVE-2026-28829
- related CVE-2026-28831
- related CVE-2026-28832
- related CVE-2026-28833
- related CVE-2026-28834
- related CVE-2026-28835
- related CVE-2026-28837
- related CVE-2026-28838
- related CVE-2026-28839
- related CVE-2026-28841
- related CVE-2026-28842
- related CVE-2026-28844
- related CVE-2026-28845
- related CVE-2026-28852
- related CVE-2026-28857
- related CVE-2026-28859
- related CVE-2026-28861
- related CVE-2026-28862
- related CVE-2026-28864
- related CVE-2026-28865
- related CVE-2026-28866
- related CVE-2026-28867
- related CVE-2026-28868
- related CVE-2026-28870
- related CVE-2026-28871
- related CVE-2026-28876
- related CVE-2026-28877
- related CVE-2026-28878
- related CVE-2026-28879
- related CVE-2026-28880
- related CVE-2026-28881
- related CVE-2026-28882
- related CVE-2026-28886
- related CVE-2026-28888
- related CVE-2026-28891
- related CVE-2026-28892
- related CVE-2026-28893
- related CVE-2026-28894
{
"containers": {
"cna": {
"affected": [
{
"product": "APPLE-SA-03-24-2026-3 macOS Tahoe",
"vendor": "Apple",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-03-24-2026-3 macOS Tahoe 26.4\n\nmacOS Tahoe 26.4 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/126794.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\n802.1X\nAvailable for: macOS Tahoe\nImpact: An attacker in a privileged network position may be able to\nintercept network traffic\nDescription: An authentication issue was addressed with improved state\nmanagement.\nCVE-2026-28865: H\u00e9lo\u00efse Gollier and Mathy Vanhoef (KU Leuven)\n\nAccounts\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-28877: Rosyna Keller of Totally Not Malicious Software\n\nAdmin Framework\nAvailable for: macOS Tahoe\nImpact: An app with root privileges may be able to delete protected\nsystem files\nDescription: A path handling issue was addressed with improved\nvalidation.\nCVE-2026-28823: Ryan Dowd (@_rdowd)\n\napache\nAvailable for: macOS Tahoe\nImpact: Multiple issues in Apache\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2025-55753\nCVE-2025-58098\nCVE-2025-59775\nCVE-2025-65082\nCVE-2025-66200\n\nAppleMobileFileIntegrity\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-28824: Mickey Jin (@patch1t)\n\nAppleMobileFileIntegrity\nAvailable for: macOS Tahoe\nImpact: An app may be able to access user-sensitive data\nDescription: A downgrade issue affecting Intel-based Mac computers was\naddressed with additional code-signing restrictions.\nCVE-2026-20699: Mickey Jin (@patch1t)\n\nAppleScript\nAvailable for: macOS Tahoe\nImpact: An app may bypass Gatekeeper checks\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-20684: Koh M. Nakagawa (@tsunek0h) of FFRI Security, Inc.\n\nArchive Utility\nAvailable for: macOS Tahoe\nImpact: An app may be able to access user-sensitive data\nDescription: This issue was addressed with improved handling of\nsymlinks.\nCVE-2026-20633: Mickey Jin (@patch1t)\n\nAudio\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nCVE-2026-28879: Justin Cohen of Google\n\nAudio\nAvailable for: macOS Tahoe\nImpact: An attacker may be able to cause unexpected app termination\nDescription: A type confusion issue was addressed with improved memory\nhandling.\nCVE-2026-28822: Jex Amro\n\nCalling Framework\nAvailable for: macOS Tahoe\nImpact: A remote attacker may be able to cause a denial-of-service\nDescription: A denial-of-service issue was addressed with improved input\nvalidation.\nCVE-2026-28894: an anonymous researcher\n\nClipboard\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved validation of\nsymlinks.\nCVE-2026-28866: Cristian Dinca (icmd.tech)\n\nCoreMedia\nAvailable for: macOS Tahoe\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-20690: Hossein Lotfi (@hosselot) of Trend Micro Zero Day\nInitiative\n\nCoreServices\nAvailable for: macOS Tahoe\nImpact: An app may be able to gain elevated privileges\nDescription: A validation issue existed in the entitlement verification.\nThis issue was addressed with improved validation of the process\nentitlement.\nCVE-2026-28821: YingQi Shi (@Mas0nShi) of DBAppSecurity\u0027s WeBin lab\n\nCoreServices\nAvailable for: macOS Tahoe\nImpact: An app may be able to break out of its sandbox\nDescription: A permissions issue was addressed with additional sandbox\nrestrictions.\nCVE-2026-28838: an anonymous researcher\n\nCoreUtils\nAvailable for: macOS Tahoe\nImpact: A user in a privileged network position may be able to cause a\ndenial-of-service\nDescription: A null pointer dereference was addressed with improved\ninput validation.\nCVE-2026-28886: Etienne Charron (Renault) and Victoria Martini (Renault)\n\nCrash Reporter\nAvailable for: macOS Tahoe\nImpact: An app may be able to enumerate a user\u0027s installed apps\nDescription: A privacy issue was addressed by removing sensitive data.\nCVE-2026-28878: Zhongcheng Li from IES Red Team\n\nCUPS\nAvailable for: macOS Tahoe\nImpact: An app may be able to gain root privileges\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-28888: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nCUPS\nAvailable for: macOS Tahoe\nImpact: A document may be written to a temporary file when using print\npreview\nDescription: A privacy issue was addressed with improved handling of\ntemporary files.\nCVE-2026-28893: Asaf Cohen\n\ncurl\nAvailable for: macOS Tahoe\nImpact: An issue existed in curl which may result in unintentionally\nsending sensitive information via an incorrect connection\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2025-14524\n\nDeviceLink\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-28876: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nDiagnostics\nAvailable for: macOS Tahoe\nImpact: An app may be able to modify protected parts of the file system\nDescription: A permissions issue was addressed by removing the\nvulnerable code.\nCVE-2026-28892: \u98ce\u6c90\u4e91\u70df (@binary_fmyy) and Minghao Lin (@Y1nKoc)\n\nFile System\nAvailable for: macOS Tahoe\nImpact: An app may be able to disclose kernel memory\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-28832: DARKNAVY (@DarkNavyOrg)\n\nGeoServices\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-28870: XiguaSec\n\nGPU Drivers\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-28834: an anonymous researcher\n\niCloud\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: A privacy issue was addressed by moving sensitive data.\nCVE-2026-28881: Ye Zhang of Baidu Security, Ryan Dowd (@_rdowd), Csaba\nFitzl (@theevilbit) of Iru\n\niCloud\nAvailable for: macOS Tahoe\nImpact: An app may be able to enumerate a user\u0027s installed apps\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28880: Zhongcheng Li from IES Red Team\nCVE-2026-28833: Zhongcheng Li from IES Red Team\n\nImageIO\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2025-64505\n\nIOGraphics\nAvailable for: macOS Tahoe\nImpact: A buffer overflow may result in memory corruption and unexpected\napp termination\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-28842: Joseph Ravichandran (@0xjprx) of MIT CSAIL\n\nIOGraphics\nAvailable for: macOS Tahoe\nImpact: A buffer overflow may result in memory corruption and unexpected\napp termination\nDescription: A buffer overflow was addressed with improved size\nvalidation.\nCVE-2026-28841: Joseph Ravichandran (@0xjprx) of MIT CSAIL\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to disclose kernel memory\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28868: \uc774\ub3d9\ud558 (Lee Dong Ha of BoB 0xB6)\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to leak sensitive kernel state\nDescription: This issue was addressed with improved authentication.\nCVE-2026-28867: Jian Lee (@speedyfriend433)\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-20698: DARKNAVY (@DarkNavyOrg)\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to determine kernel memory layout\nDescription: An information disclosure issue was addressed with improved\nmemory management.\nCVE-2026-20695: \uc774\ub3d9\ud558 (Lee Dong Ha of BoB 0xB6) working with TrendAI Zero\nDay Initiative, hari shanmugam\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-20687: Johnny Franks (@zeroxjf)\n\nLaunchServices\nAvailable for: macOS Tahoe\nImpact: An app may be able to access protected user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-28845: Yuebin Sun (@yuebinsun2020), an anonymous researcher,\nNathaniel Oh (@calysteon), Kirin (@Pwnrin), Wojciech Regula of SecuRing\n(wojciechregula.blog), Joshua Jewett (@JoshJewett33), an anonymous\nresearcher\n\nlibxpc\nAvailable for: macOS Tahoe\nImpact: An app may be able to enumerate a user\u0027s installed apps\nDescription: This issue was addressed with improved checks.\nCVE-2026-28882: Ilias Morad (A2nkF) of Voynich Group, Duy Tr\u1ea7n\n(@khanhduytran0), @hugeBlack\n\nlibxpc\nAvailable for: macOS Tahoe\nImpact: An app may be able to access protected user data\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-20607: an anonymous researcher\n\nMail\nAvailable for: macOS Tahoe\nImpact: \"Hide IP Address\" and \"Block All Remote Content\" may not apply\nto all mail content\nDescription: A privacy issue was addressed with improved handling of\nuser preferences.\nCVE-2026-20692: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nMigrationKit\nAvailable for: macOS Tahoe\nImpact: An app may be able to access user-sensitive data\nDescription: This issue was addressed with improved handling of\nsymlinks.\nCVE-2026-20694: Rodolphe Brunetti (@eisw0lf) of Lupus Nova\n\nMusic\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-20632: Rodolphe Brunetti (@eisw0lf) of Lupus Nova\n\nNetAuth\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: The issue was addressed with improved checks.\nCVE-2026-28839: Mickey Jin (@patch1t)\n\nNetAuth\nAvailable for: macOS Tahoe\nImpact: An app may be able to connect to a network share without user\nconsent\nDescription: An access issue was addressed with additional sandbox\nrestrictions.\nCVE-2026-20701: Matej Moravec (@MacejkoMoravec)\n\nNetAuth\nAvailable for: macOS Tahoe\nImpact: An app may be able to break out of its sandbox\nDescription: A race condition was addressed with additional validation.\nCVE-2026-28891: an anonymous researcher\n\nNetFSFramework\nAvailable for: macOS Tahoe\nImpact: An app may be able to break out of its sandbox\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-28827: Csaba Fitzl (@theevilbit) of Iru, an anonymous\nresearcher\n\nNotes\nAvailable for: macOS Tahoe\nImpact: An app may be able to delete files for which it does not have\npermission\nDescription: A path handling issue was addressed with improved\nvalidation.\nCVE-2026-28816: Dawuge of Shuffl"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T10:08:24Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/18"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Mar/18"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/126794"
},
{
"url": "https://support.apple.com/downloads/"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Mar/18"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-03-24-2026-3 macOS Tahoe 26.4",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2025-14524",
"type": "related"
},
{
"destId": "CVE-2025-55753",
"type": "related"
},
{
"destId": "CVE-2025-58098",
"type": "related"
},
{
"destId": "CVE-2025-59775",
"type": "related"
},
{
"destId": "CVE-2025-64505",
"type": "related"
},
{
"destId": "CVE-2025-65082",
"type": "related"
},
{
"destId": "CVE-2025-66200",
"type": "related"
},
{
"destId": "CVE-2026-20607",
"type": "related"
},
{
"destId": "CVE-2026-20631",
"type": "related"
},
{
"destId": "CVE-2026-20632",
"type": "related"
},
{
"destId": "CVE-2026-20633",
"type": "related"
},
{
"destId": "CVE-2026-20643",
"type": "related"
},
{
"destId": "CVE-2026-20664",
"type": "related"
},
{
"destId": "CVE-2026-20665",
"type": "related"
},
{
"destId": "CVE-2026-20684",
"type": "related"
},
{
"destId": "CVE-2026-20687",
"type": "related"
},
{
"destId": "CVE-2026-20688",
"type": "related"
},
{
"destId": "CVE-2026-20690",
"type": "related"
},
{
"destId": "CVE-2026-20691",
"type": "related"
},
{
"destId": "CVE-2026-20692",
"type": "related"
},
{
"destId": "CVE-2026-20693",
"type": "related"
},
{
"destId": "CVE-2026-20694",
"type": "related"
},
{
"destId": "CVE-2026-20695",
"type": "related"
},
{
"destId": "CVE-2026-20697",
"type": "related"
},
{
"destId": "CVE-2026-20698",
"type": "related"
},
{
"destId": "CVE-2026-20699",
"type": "related"
},
{
"destId": "CVE-2026-20701",
"type": "related"
},
{
"destId": "CVE-2026-28816",
"type": "related"
},
{
"destId": "CVE-2026-28817",
"type": "related"
},
{
"destId": "CVE-2026-28818",
"type": "related"
},
{
"destId": "CVE-2026-28820",
"type": "related"
},
{
"destId": "CVE-2026-28821",
"type": "related"
},
{
"destId": "CVE-2026-28822",
"type": "related"
},
{
"destId": "CVE-2026-28823",
"type": "related"
},
{
"destId": "CVE-2026-28824",
"type": "related"
},
{
"destId": "CVE-2026-28825",
"type": "related"
},
{
"destId": "CVE-2026-28826",
"type": "related"
},
{
"destId": "CVE-2026-28827",
"type": "related"
},
{
"destId": "CVE-2026-28828",
"type": "related"
},
{
"destId": "CVE-2026-28829",
"type": "related"
},
{
"destId": "CVE-2026-28831",
"type": "related"
},
{
"destId": "CVE-2026-28832",
"type": "related"
},
{
"destId": "CVE-2026-28833",
"type": "related"
},
{
"destId": "CVE-2026-28834",
"type": "related"
},
{
"destId": "CVE-2026-28835",
"type": "related"
},
{
"destId": "CVE-2026-28837",
"type": "related"
},
{
"destId": "CVE-2026-28838",
"type": "related"
},
{
"destId": "CVE-2026-28839",
"type": "related"
},
{
"destId": "CVE-2026-28841",
"type": "related"
},
{
"destId": "CVE-2026-28842",
"type": "related"
},
{
"destId": "CVE-2026-28844",
"type": "related"
},
{
"destId": "CVE-2026-28845",
"type": "related"
},
{
"destId": "CVE-2026-28852",
"type": "related"
},
{
"destId": "CVE-2026-28857",
"type": "related"
},
{
"destId": "CVE-2026-28859",
"type": "related"
},
{
"destId": "CVE-2026-28861",
"type": "related"
},
{
"destId": "CVE-2026-28862",
"type": "related"
},
{
"destId": "CVE-2026-28864",
"type": "related"
},
{
"destId": "CVE-2026-28865",
"type": "related"
},
{
"destId": "CVE-2026-28866",
"type": "related"
},
{
"destId": "CVE-2026-28867",
"type": "related"
},
{
"destId": "CVE-2026-28868",
"type": "related"
},
{
"destId": "CVE-2026-28870",
"type": "related"
},
{
"destId": "CVE-2026-28871",
"type": "related"
},
{
"destId": "CVE-2026-28876",
"type": "related"
},
{
"destId": "CVE-2026-28877",
"type": "related"
},
{
"destId": "CVE-2026-28878",
"type": "related"
},
{
"destId": "CVE-2026-28879",
"type": "related"
},
{
"destId": "CVE-2026-28880",
"type": "related"
},
{
"destId": "CVE-2026-28881",
"type": "related"
},
{
"destId": "CVE-2026-28882",
"type": "related"
},
{
"destId": "CVE-2026-28886",
"type": "related"
},
{
"destId": "CVE-2026-28888",
"type": "related"
},
{
"destId": "CVE-2026-28891",
"type": "related"
},
{
"destId": "CVE-2026-28892",
"type": "related"
},
{
"destId": "CVE-2026-28893",
"type": "related"
},
{
"destId": "CVE-2026-28894",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0263",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/18",
"automated": true,
"contentSha256": "5ec5e92e1937263fbb1fb6cbadb95f55c866730942b6bfbda704435f0abb614e",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/18",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-03-25T00:01:47Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0263"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T08:13:42Z",
"dateUpdated": "2026-09-09T10:08:24Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0263"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…