Vulnerability-Lookup

WID-SEC-W-2026-0852

Vulnerability from csaf_certbund - Published: 2026-03-24 23:00 - Updated: 2026-05-11 22:00

Summary

Apple iOS: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Das Apple iOS (vormals iPhone OS) ist das Betriebssystem für das von Apple entwickelte Smartphone iPhone, iPad und iPod Touch. Das Apple iPadOS ist das Betriebssystem für das von Apple entwickelte iPad.

Angriff: Ein Angreifer kann mehrere Schwachstellen in Apple iOS und Apple iPadOS ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, und um einen Cross-Site Scripting Angriff durchzuführen.

Betroffene Betriebssysteme: - Sonstiges

CVE-2025-14524

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2025-43376

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2025-43534

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2025-64505

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-20637

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-20643

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-20657

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-20664

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-20665

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-20668

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-20687

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-20688

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-20690

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-20691

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-20692

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-20698

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-28822

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-28833

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-28852

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-28856

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-28857

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-28858

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-28859

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-28860

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-28861

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-28863

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-28864

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-28865

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-28866

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-28867

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-28868

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-28870

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-28871

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-28874

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-28875

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-28876

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-28877

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-28878

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-28879

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-28880

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-28882

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-28886

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-28894

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

CVE-2026-28895

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Apple iPadOS <26.4 Apple / iPadOS		<26.4
Apple iOS <18.7.7 Apple / iOS		<18.7.7
Apple iPadOS <18.7.7 Apple / iPadOS		<18.7.7
Apple iOS <26.4 Apple / iOS		<26.4

References

4 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://support.apple.com/en-us/126792	external
https://support.apple.com/en-us/126793	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Das Apple iOS (vormals iPhone OS) ist das Betriebssystem f\u00fcr das von Apple entwickelte Smartphone iPhone, iPad und iPod Touch.\r\nDas Apple iPadOS ist das Betriebssystem f\u00fcr das von Apple entwickelte iPad.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Apple iOS und Apple iPadOS ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuf\u00fchren, um Informationen offenzulegen, und um einen Cross-Site Scripting Angriff durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-0852 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0852.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-0852 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0852"
      },
      {
        "category": "external",
        "summary": "About the security content of iOS 26.4 and iPadOS 26.4 vom 2026-03-24",
        "url": "https://support.apple.com/en-us/126792"
      },
      {
        "category": "external",
        "summary": "About the security content of iOS 18.7.7 and iPadOS 18.7.7 vom 2026-03-24",
        "url": "https://support.apple.com/en-us/126793"
      }
    ],
    "source_lang": "en-US",
    "title": "Apple iOS: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-05-11T22:00:00.000+00:00",
      "generator": {
        "date": "2026-05-12T09:25:55.502+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2026-0852",
      "initial_release_date": "2026-03-24T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-03-24T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-05-11T22:00:00.000+00:00",
          "number": "2",
          "summary": "CVE-2026-28860 erg\u00e4nzt"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c26.4",
                "product": {
                  "name": "Apple iOS \u003c26.4",
                  "product_id": "T052127"
                }
              },
              {
                "category": "product_version",
                "name": "26.4",
                "product": {
                  "name": "Apple iOS 26.4",
                  "product_id": "T052127-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:apple:iphone_os:26.4"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c18.7.7",
                "product": {
                  "name": "Apple iOS \u003c18.7.7",
                  "product_id": "T052128"
                }
              },
              {
                "category": "product_version",
                "name": "18.7.7",
                "product": {
                  "name": "Apple iOS 18.7.7",
                  "product_id": "T052128-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:apple:iphone_os:18.7.7"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "iOS"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c18.7.7",
                "product": {
                  "name": "Apple iPadOS \u003c18.7.7",
                  "product_id": "T052129"
                }
              },
              {
                "category": "product_version",
                "name": "18.7.7",
                "product": {
                  "name": "Apple iPadOS 18.7.7",
                  "product_id": "T052129-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:apple:ipados:18.7.7"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c26.4",
                "product": {
                  "name": "Apple iPadOS \u003c26.4",
                  "product_id": "T052130"
                }
              },
              {
                "category": "product_version",
                "name": "26.4",
                "product": {
                  "name": "Apple iPadOS 26.4",
                  "product_id": "T052130-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:apple:ipados:26.4"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "iPadOS"
          }
        ],
        "category": "vendor",
        "name": "Apple"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-14524",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2025-14524"
    },
    {
      "cve": "CVE-2025-43376",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2025-43376"
    },
    {
      "cve": "CVE-2025-43534",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2025-43534"
    },
    {
      "cve": "CVE-2025-64505",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2025-64505"
    },
    {
      "cve": "CVE-2026-20637",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-20637"
    },
    {
      "cve": "CVE-2026-20643",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-20643"
    },
    {
      "cve": "CVE-2026-20657",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-20657"
    },
    {
      "cve": "CVE-2026-20664",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-20664"
    },
    {
      "cve": "CVE-2026-20665",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-20665"
    },
    {
      "cve": "CVE-2026-20668",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-20668"
    },
    {
      "cve": "CVE-2026-20687",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-20687"
    },
    {
      "cve": "CVE-2026-20688",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-20688"
    },
    {
      "cve": "CVE-2026-20690",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-20690"
    },
    {
      "cve": "CVE-2026-20691",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-20691"
    },
    {
      "cve": "CVE-2026-20692",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-20692"
    },
    {
      "cve": "CVE-2026-20698",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-20698"
    },
    {
      "cve": "CVE-2026-28822",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-28822"
    },
    {
      "cve": "CVE-2026-28833",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-28833"
    },
    {
      "cve": "CVE-2026-28852",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-28852"
    },
    {
      "cve": "CVE-2026-28856",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-28856"
    },
    {
      "cve": "CVE-2026-28857",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-28857"
    },
    {
      "cve": "CVE-2026-28858",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-28858"
    },
    {
      "cve": "CVE-2026-28859",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-28859"
    },
    {
      "cve": "CVE-2026-28860",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-28860"
    },
    {
      "cve": "CVE-2026-28861",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-28861"
    },
    {
      "cve": "CVE-2026-28863",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-28863"
    },
    {
      "cve": "CVE-2026-28864",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-28864"
    },
    {
      "cve": "CVE-2026-28865",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-28865"
    },
    {
      "cve": "CVE-2026-28866",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-28866"
    },
    {
      "cve": "CVE-2026-28867",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-28867"
    },
    {
      "cve": "CVE-2026-28868",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-28868"
    },
    {
      "cve": "CVE-2026-28870",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-28870"
    },
    {
      "cve": "CVE-2026-28871",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-28871"
    },
    {
      "cve": "CVE-2026-28874",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-28874"
    },
    {
      "cve": "CVE-2026-28875",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-28875"
    },
    {
      "cve": "CVE-2026-28876",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-28876"
    },
    {
      "cve": "CVE-2026-28877",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-28877"
    },
    {
      "cve": "CVE-2026-28878",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-28878"
    },
    {
      "cve": "CVE-2026-28879",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-28879"
    },
    {
      "cve": "CVE-2026-28880",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-28880"
    },
    {
      "cve": "CVE-2026-28882",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-28882"
    },
    {
      "cve": "CVE-2026-28886",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-28886"
    },
    {
      "cve": "CVE-2026-28894",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-28894"
    },
    {
      "cve": "CVE-2026-28895",
      "product_status": {
        "known_affected": [
          "T052130",
          "T052128",
          "T052129",
          "T052127"
        ]
      },
      "release_date": "2026-03-24T23:00:00.000+00:00",
      "title": "CVE-2026-28895"
    }
  ]
}

CVE-2025-14524 (GCVE-0-2025-14524)

Vulnerability from cvelistv5 – Published: 2026-01-08 10:07 – Updated: 2026-04-02 13:20

Title

bearer token leak on cross-protocol redirect

Summary

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-522 Insufficiently Protected Credentials

Assigner

curl

References

4 references

URL	Tags
https://curl.se/docs/CVE-2025-14524.json
https://curl.se/docs/CVE-2025-14524.html
https://hackerone.com/reports/3459417
http://www.openwall.com/lists/oss-security/2026/01/07/4

Impacted products

1 product

Vendor	Product	Version
curl	curl	Affected: 8.17.0 , ≤ 8.17.0 (semver) Affected: 8.16.0 , ≤ 8.16.0 (semver) Affected: 8.15.0 , ≤ 8.15.0 (semver) Affected: 8.14.1 , ≤ 8.14.1 (semver) Affected: 8.14.0 , ≤ 8.14.0 (semver) Affected: 8.13.0 , ≤ 8.13.0 (semver) Affected: 8.12.1 , ≤ 8.12.1 (semver) Affected: 8.12.0 , ≤ 8.12.0 (semver) Affected: 8.11.1 , ≤ 8.11.1 (semver) Affected: 8.11.0 , ≤ 8.11.0 (semver) Affected: 8.10.1 , ≤ 8.10.1 (semver) Affected: 8.10.0 , ≤ 8.10.0 (semver) Affected: 8.9.1 , ≤ 8.9.1 (semver) Affected: 8.9.0 , ≤ 8.9.0 (semver) Affected: 8.8.0 , ≤ 8.8.0 (semver) Affected: 8.7.1 , ≤ 8.7.1 (semver) Affected: 8.7.0 , ≤ 8.7.0 (semver) Affected: 8.6.0 , ≤ 8.6.0 (semver) Affected: 8.5.0 , ≤ 8.5.0 (semver) Affected: 8.4.0 , ≤ 8.4.0 (semver) Affected: 8.3.0 , ≤ 8.3.0 (semver) Affected: 8.2.1 , ≤ 8.2.1 (semver) Affected: 8.2.0 , ≤ 8.2.0 (semver) Affected: 8.1.2 , ≤ 8.1.2 (semver) Affected: 8.1.1 , ≤ 8.1.1 (semver) Affected: 8.1.0 , ≤ 8.1.0 (semver) Affected: 8.0.1 , ≤ 8.0.1 (semver) Affected: 8.0.0 , ≤ 8.0.0 (semver) Affected: 7.88.1 , ≤ 7.88.1 (semver) Affected: 7.88.0 , ≤ 7.88.0 (semver) Affected: 7.87.0 , ≤ 7.87.0 (semver) Affected: 7.86.0 , ≤ 7.86.0 (semver) Affected: 7.85.0 , ≤ 7.85.0 (semver) Affected: 7.84.0 , ≤ 7.84.0 (semver) Affected: 7.83.1 , ≤ 7.83.1 (semver) Affected: 7.83.0 , ≤ 7.83.0 (semver) Affected: 7.82.0 , ≤ 7.82.0 (semver) Affected: 7.81.0 , ≤ 7.81.0 (semver) Affected: 7.80.0 , ≤ 7.80.0 (semver) Affected: 7.79.1 , ≤ 7.79.1 (semver) Affected: 7.79.0 , ≤ 7.79.0 (semver) Affected: 7.78.0 , ≤ 7.78.0 (semver) Affected: 7.77.0 , ≤ 7.77.0 (semver) Affected: 7.76.1 , ≤ 7.76.1 (semver) Affected: 7.76.0 , ≤ 7.76.0 (semver) Affected: 7.75.0 , ≤ 7.75.0 (semver) Affected: 7.74.0 , ≤ 7.74.0 (semver) Affected: 7.73.0 , ≤ 7.73.0 (semver) Affected: 7.72.0 , ≤ 7.72.0 (semver) Affected: 7.71.1 , ≤ 7.71.1 (semver) Affected: 7.71.0 , ≤ 7.71.0 (semver) Affected: 7.70.0 , ≤ 7.70.0 (semver) Affected: 7.69.1 , ≤ 7.69.1 (semver) Affected: 7.69.0 , ≤ 7.69.0 (semver) Affected: 7.68.0 , ≤ 7.68.0 (semver) Affected: 7.67.0 , ≤ 7.67.0 (semver) Affected: 7.66.0 , ≤ 7.66.0 (semver) Affected: 7.65.3 , ≤ 7.65.3 (semver) Affected: 7.65.2 , ≤ 7.65.2 (semver) Affected: 7.65.1 , ≤ 7.65.1 (semver) Affected: 7.65.0 , ≤ 7.65.0 (semver) Affected: 7.64.1 , ≤ 7.64.1 (semver) Affected: 7.64.0 , ≤ 7.64.0 (semver) Affected: 7.63.0 , ≤ 7.63.0 (semver) Affected: 7.62.0 , ≤ 7.62.0 (semver) Affected: 7.61.1 , ≤ 7.61.1 (semver) Affected: 7.61.0 , ≤ 7.61.0 (semver) Affected: 7.60.0 , ≤ 7.60.0 (semver) Affected: 7.59.0 , ≤ 7.59.0 (semver) Affected: 7.58.0 , ≤ 7.58.0 (semver) Affected: 7.57.0 , ≤ 7.57.0 (semver) Affected: 7.56.1 , ≤ 7.56.1 (semver) Affected: 7.56.0 , ≤ 7.56.0 (semver) Affected: 7.55.1 , ≤ 7.55.1 (semver) Affected: 7.55.0 , ≤ 7.55.0 (semver) Affected: 7.54.1 , ≤ 7.54.1 (semver) Affected: 7.54.0 , ≤ 7.54.0 (semver) Affected: 7.53.1 , ≤ 7.53.1 (semver) Affected: 7.53.0 , ≤ 7.53.0 (semver) Affected: 7.52.1 , ≤ 7.52.1 (semver) Affected: 7.52.0 , ≤ 7.52.0 (semver) Affected: 7.51.0 , ≤ 7.51.0 (semver) Affected: 7.50.3 , ≤ 7.50.3 (semver) Affected: 7.50.2 , ≤ 7.50.2 (semver) Affected: 7.50.1 , ≤ 7.50.1 (semver) Affected: 7.50.0 , ≤ 7.50.0 (semver) Affected: 7.49.1 , ≤ 7.49.1 (semver) Affected: 7.49.0 , ≤ 7.49.0 (semver) Affected: 7.48.0 , ≤ 7.48.0 (semver) Affected: 7.47.1 , ≤ 7.47.1 (semver) Affected: 7.47.0 , ≤ 7.47.0 (semver) Affected: 7.46.0 , ≤ 7.46.0 (semver) Affected: 7.45.0 , ≤ 7.45.0 (semver) Affected: 7.44.0 , ≤ 7.44.0 (semver) Affected: 7.43.0 , ≤ 7.43.0 (semver) Affected: 7.42.1 , ≤ 7.42.1 (semver) Affected: 7.42.0 , ≤ 7.42.0 (semver) Affected: 7.41.0 , ≤ 7.41.0 (semver) Affected: 7.40.0 , ≤ 7.40.0 (semver) Affected: 7.39.0 , ≤ 7.39.0 (semver) Affected: 7.38.0 , ≤ 7.38.0 (semver) Affected: 7.37.1 , ≤ 7.37.1 (semver) Affected: 7.37.0 , ≤ 7.37.0 (semver) Affected: 7.36.0 , ≤ 7.36.0 (semver) Affected: 7.35.0 , ≤ 7.35.0 (semver) Affected: 7.34.0 , ≤ 7.34.0 (semver) Affected: 7.33.0 , ≤ 7.33.0 (semver)

Credits

anonymous237 on hackerone Daniel Stenberg

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-08T11:06:18.117Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/01/07/4"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-14524",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-09T19:24:54.231955Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-02T13:20:16.344Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThanOrEqual": "8.17.0",
              "status": "affected",
              "version": "8.17.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.16.0",
              "status": "affected",
              "version": "8.16.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.15.0",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.14.1",
              "status": "affected",
              "version": "8.14.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.14.0",
              "status": "affected",
              "version": "8.14.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.13.0",
              "status": "affected",
              "version": "8.13.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.12.1",
              "status": "affected",
              "version": "8.12.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.12.0",
              "status": "affected",
              "version": "8.12.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.11.1",
              "status": "affected",
              "version": "8.11.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.11.0",
              "status": "affected",
              "version": "8.11.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.10.1",
              "status": "affected",
              "version": "8.10.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.10.0",
              "status": "affected",
              "version": "8.10.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.9.1",
              "status": "affected",
              "version": "8.9.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.9.0",
              "status": "affected",
              "version": "8.9.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.8.0",
              "status": "affected",
              "version": "8.8.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.7.1",
              "status": "affected",
              "version": "8.7.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.7.0",
              "status": "affected",
              "version": "8.7.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.6.0",
              "status": "affected",
              "version": "8.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.0",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.4.0",
              "status": "affected",
              "version": "8.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.3.0",
              "status": "affected",
              "version": "8.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.2.1",
              "status": "affected",
              "version": "8.2.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.2.0",
              "status": "affected",
              "version": "8.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.1.2",
              "status": "affected",
              "version": "8.1.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.1.1",
              "status": "affected",
              "version": "8.1.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.1.0",
              "status": "affected",
              "version": "8.1.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.0.1",
              "status": "affected",
              "version": "8.0.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.0.0",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.88.1",
              "status": "affected",
              "version": "7.88.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.88.0",
              "status": "affected",
              "version": "7.88.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.87.0",
              "status": "affected",
              "version": "7.87.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.86.0",
              "status": "affected",
              "version": "7.86.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.85.0",
              "status": "affected",
              "version": "7.85.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.84.0",
              "status": "affected",
              "version": "7.84.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.83.1",
              "status": "affected",
              "version": "7.83.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.83.0",
              "status": "affected",
              "version": "7.83.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.82.0",
              "status": "affected",
              "version": "7.82.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.81.0",
              "status": "affected",
              "version": "7.81.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.80.0",
              "status": "affected",
              "version": "7.80.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.79.1",
              "status": "affected",
              "version": "7.79.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.79.0",
              "status": "affected",
              "version": "7.79.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.78.0",
              "status": "affected",
              "version": "7.78.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.77.0",
              "status": "affected",
              "version": "7.77.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.76.1",
              "status": "affected",
              "version": "7.76.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.76.0",
              "status": "affected",
              "version": "7.76.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.75.0",
              "status": "affected",
              "version": "7.75.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.74.0",
              "status": "affected",
              "version": "7.74.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.73.0",
              "status": "affected",
              "version": "7.73.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.72.0",
              "status": "affected",
              "version": "7.72.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.71.1",
              "status": "affected",
              "version": "7.71.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.71.0",
              "status": "affected",
              "version": "7.71.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.70.0",
              "status": "affected",
              "version": "7.70.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.69.1",
              "status": "affected",
              "version": "7.69.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.69.0",
              "status": "affected",
              "version": "7.69.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.68.0",
              "status": "affected",
              "version": "7.68.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.67.0",
              "status": "affected",
              "version": "7.67.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.66.0",
              "status": "affected",
              "version": "7.66.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.65.3",
              "status": "affected",
              "version": "7.65.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.65.2",
              "status": "affected",
              "version": "7.65.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.65.1",
              "status": "affected",
              "version": "7.65.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.65.0",
              "status": "affected",
              "version": "7.65.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.64.1",
              "status": "affected",
              "version": "7.64.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.64.0",
              "status": "affected",
              "version": "7.64.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.63.0",
              "status": "affected",
              "version": "7.63.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.62.0",
              "status": "affected",
              "version": "7.62.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.61.1",
              "status": "affected",
              "version": "7.61.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.61.0",
              "status": "affected",
              "version": "7.61.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.60.0",
              "status": "affected",
              "version": "7.60.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.59.0",
              "status": "affected",
              "version": "7.59.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.58.0",
              "status": "affected",
              "version": "7.58.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.57.0",
              "status": "affected",
              "version": "7.57.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.56.1",
              "status": "affected",
              "version": "7.56.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.56.0",
              "status": "affected",
              "version": "7.56.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.55.1",
              "status": "affected",
              "version": "7.55.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.55.0",
              "status": "affected",
              "version": "7.55.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.54.1",
              "status": "affected",
              "version": "7.54.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.54.0",
              "status": "affected",
              "version": "7.54.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.53.1",
              "status": "affected",
              "version": "7.53.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.53.0",
              "status": "affected",
              "version": "7.53.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.52.1",
              "status": "affected",
              "version": "7.52.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.52.0",
              "status": "affected",
              "version": "7.52.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.51.0",
              "status": "affected",
              "version": "7.51.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.50.3",
              "status": "affected",
              "version": "7.50.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.50.2",
              "status": "affected",
              "version": "7.50.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.50.1",
              "status": "affected",
              "version": "7.50.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.50.0",
              "status": "affected",
              "version": "7.50.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.49.1",
              "status": "affected",
              "version": "7.49.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.49.0",
              "status": "affected",
              "version": "7.49.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.48.0",
              "status": "affected",
              "version": "7.48.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.47.1",
              "status": "affected",
              "version": "7.47.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.47.0",
              "status": "affected",
              "version": "7.47.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.46.0",
              "status": "affected",
              "version": "7.46.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.45.0",
              "status": "affected",
              "version": "7.45.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.44.0",
              "status": "affected",
              "version": "7.44.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.43.0",
              "status": "affected",
              "version": "7.43.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.42.1",
              "status": "affected",
              "version": "7.42.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.42.0",
              "status": "affected",
              "version": "7.42.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.41.0",
              "status": "affected",
              "version": "7.41.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.40.0",
              "status": "affected",
              "version": "7.40.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.39.0",
              "status": "affected",
              "version": "7.39.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.38.0",
              "status": "affected",
              "version": "7.38.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.37.1",
              "status": "affected",
              "version": "7.37.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.37.0",
              "status": "affected",
              "version": "7.37.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.36.0",
              "status": "affected",
              "version": "7.36.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.35.0",
              "status": "affected",
              "version": "7.35.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.34.0",
              "status": "affected",
              "version": "7.34.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.33.0",
              "status": "affected",
              "version": "7.33.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "anonymous237 on hackerone"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Daniel Stenberg"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-522 Insufficiently Protected Credentials",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-08T10:07:25.655Z",
        "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "shortName": "curl"
      },
      "references": [
        {
          "name": "json",
          "url": "https://curl.se/docs/CVE-2025-14524.json"
        },
        {
          "name": "www",
          "url": "https://curl.se/docs/CVE-2025-14524.html"
        },
        {
          "name": "issue",
          "url": "https://hackerone.com/reports/3459417"
        }
      ],
      "title": "bearer token leak on cross-protocol redirect"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
    "assignerShortName": "curl",
    "cveId": "CVE-2025-14524",
    "datePublished": "2026-01-08T10:07:25.655Z",
    "dateReserved": "2025-12-11T08:04:14.328Z",
    "dateUpdated": "2026-04-02T13:20:16.344Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-43376 (GCVE-0-2025-43376)

Vulnerability from cvelistv5 – Published: 2025-11-04 01:16 – Updated: 2026-04-02 18:14

Summary

A logic issue was addressed with improved state management. This issue is fixed in Safari 26, iOS 18.7.7 and iPadOS 18.7.7, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. A remote attacker may be able to view leaked DNS queries with Private Relay turned on.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

A remote attacker may be able to view leaked DNS queries with Private Relay turned on
CWE-noinfo Not enough information

Assigner

apple

References

7 references

URL	Tags
https://support.apple.com/en-us/125108
https://support.apple.com/en-us/125110
https://support.apple.com/en-us/125113
https://support.apple.com/en-us/125114
https://support.apple.com/en-us/125115
https://support.apple.com/en-us/125116
https://support.apple.com/en-us/126793

Impacted products

6 products

Vendor	Product	Version
Apple	Safari	Affected: 0 , < 26 (custom)
Apple	iOS and iPadOS	Affected: 0 , < 18.7.7 (custom) Affected: 0 , < 26 (custom)
Apple	macOS	Affected: 0 , < 26 (custom)
Apple	tvOS	Affected: 0 , < 26 (custom)
Apple	visionOS	Affected: 0 , < 26 (custom)
Apple	watchOS	Affected: 0 , < 26 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-43376",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-10T20:46:51.589683Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-10T20:46:54.199Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18.7.7",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "26",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "tvOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A logic issue was addressed with improved state management. This issue is fixed in Safari 26, iOS 18.7.7 and iPadOS 18.7.7, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. A remote attacker may be able to view leaked DNS queries with Private Relay turned on."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "A remote attacker may be able to view leaked DNS queries with Private Relay turned on",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:14:59.217Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/125108"
        },
        {
          "url": "https://support.apple.com/en-us/125110"
        },
        {
          "url": "https://support.apple.com/en-us/125113"
        },
        {
          "url": "https://support.apple.com/en-us/125114"
        },
        {
          "url": "https://support.apple.com/en-us/125115"
        },
        {
          "url": "https://support.apple.com/en-us/125116"
        },
        {
          "url": "https://support.apple.com/en-us/126793"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2025-43376",
    "datePublished": "2025-11-04T01:16:17.454Z",
    "dateReserved": "2025-04-16T15:24:37.115Z",
    "dateUpdated": "2026-04-02T18:14:59.217Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-43534 (GCVE-0-2025-43534)

Vulnerability from cvelistv5 – Published: 2026-03-25 00:35 – Updated: 2026-04-02 18:26

Summary

A path handling issue was addressed with improved validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.2 and iPadOS 26.2. A user with physical access to an iOS device may be able to bypass Activation Lock.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

A user with physical access to an iOS device may be able to bypass Activation Lock
CWE-284 - Improper Access Control

Assigner

apple

References

2 references

URL	Tags
https://support.apple.com/en-us/125884
https://support.apple.com/en-us/126793

Impacted products

1 product

Vendor	Product	Version
Apple	iOS and iPadOS	Affected: 0 , < 18.7.7 (custom) Affected: 0 , < 26.2 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "PHYSICAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.8,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-43534",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-25T15:47:40.434004Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-25T18:07:16.676Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18.7.7",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "26.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A path handling issue was addressed with improved validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.2 and iPadOS 26.2. A user with physical access to an iOS device may be able to bypass Activation Lock."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "A user with physical access to an iOS device may be able to bypass Activation Lock",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:26:24.135Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/125884"
        },
        {
          "url": "https://support.apple.com/en-us/126793"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2025-43534",
    "datePublished": "2026-03-25T00:35:35.815Z",
    "dateReserved": "2025-04-16T15:27:21.198Z",
    "dateUpdated": "2026-04-02T18:26:24.135Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-64505 (GCVE-0-2025-64505)

Vulnerability from cvelistv5 – Published: 2025-11-24 23:38 – Updated: 2025-11-25 18:55

Title

LIBPNG is vulnerable to a heap buffer overflow in `png_do_quantize` via malformed palette index

Summary

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of-bounds memory access. This issue has been patched in version 1.6.51.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-125 - Out-of-bounds Read

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/pnggroup/libpng/security/advis…	x_refsource_CONFIRM
https://github.com/pnggroup/libpng/pull/748	x_refsource_MISC
https://github.com/pnggroup/libpng/commit/6a528eb…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
pnggroup	libpng	Affected: < 1.6.51

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-64505",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-25T18:55:44.084881Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-25T18:55:50.619Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "libpng",
          "vendor": "pnggroup",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.6.51"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng\u0027s png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of-bounds memory access. This issue has been patched in version 1.6.51."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-24T23:38:40.405Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pnggroup/libpng/security/advisories/GHSA-4952-h5wq-4m42",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-4952-h5wq-4m42"
        },
        {
          "name": "https://github.com/pnggroup/libpng/pull/748",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pnggroup/libpng/pull/748"
        },
        {
          "name": "https://github.com/pnggroup/libpng/commit/6a528eb5fd0dd7f6de1c39d30de0e41473431c37",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pnggroup/libpng/commit/6a528eb5fd0dd7f6de1c39d30de0e41473431c37"
        }
      ],
      "source": {
        "advisory": "GHSA-4952-h5wq-4m42",
        "discovery": "UNKNOWN"
      },
      "title": "LIBPNG is vulnerable to a heap buffer overflow in `png_do_quantize` via malformed palette index"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-64505",
    "datePublished": "2025-11-24T23:38:40.405Z",
    "dateReserved": "2025-11-05T19:12:25.104Z",
    "dateUpdated": "2025-11-25T18:55:50.619Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-20637 (GCVE-0-2026-20637)

Vulnerability from cvelistv5 – Published: 2026-03-25 00:32 – Updated: 2026-04-02 18:16

Summary

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. An app may be able to cause unexpected system termination.

Severity

6.2 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

An app may be able to cause unexpected system termination
CWE-416 - Use After Free

Assigner

apple

References

8 references

URL	Tags
https://support.apple.com/en-us/126346
https://support.apple.com/en-us/126348
https://support.apple.com/en-us/126351
https://support.apple.com/en-us/126352
https://support.apple.com/en-us/126353
https://support.apple.com/en-us/126793
https://support.apple.com/en-us/126795
https://support.apple.com/en-us/126796

Impacted products

5 products

Vendor	Product	Version
Apple	iOS and iPadOS	Affected: 0 , < 18.7.7 (custom) Affected: 0 , < 26.3 (custom)
Apple	macOS	Affected: 0 , < 14.8.5 (custom) Affected: 0 , < 15.7.5 (custom) Affected: 0 , < 26.3 (custom)
Apple	tvOS	Affected: 0 , < 26.3 (custom)
Apple	visionOS	Affected: 0 , < 26.3 (custom)
Apple	watchOS	Affected: 0 , < 26.3 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.2,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-20637",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-25T15:48:17.344532Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-25T15:48:41.578Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18.7.7",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "26.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "14.8.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.7.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "26.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "tvOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. An app may be able to cause unexpected system termination."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "An app may be able to cause unexpected system termination",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:16:34.748Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/126346"
        },
        {
          "url": "https://support.apple.com/en-us/126348"
        },
        {
          "url": "https://support.apple.com/en-us/126351"
        },
        {
          "url": "https://support.apple.com/en-us/126352"
        },
        {
          "url": "https://support.apple.com/en-us/126353"
        },
        {
          "url": "https://support.apple.com/en-us/126793"
        },
        {
          "url": "https://support.apple.com/en-us/126795"
        },
        {
          "url": "https://support.apple.com/en-us/126796"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2026-20637",
    "datePublished": "2026-03-25T00:32:10.184Z",
    "dateReserved": "2025-11-11T14:43:07.861Z",
    "dateUpdated": "2026-04-02T18:16:34.748Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-20643 (GCVE-0-2026-20643)

Vulnerability from cvelistv5 – Published: 2026-03-17 22:29 – Updated: 2026-04-02 18:19

Summary

A cross-origin issue in the Navigation API was addressed with improved input validation. This issue is fixed in Background Security Improvements for iOS, iPadOS, and macOS, Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may bypass Same Origin Policy.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Processing maliciously crafted web content may bypass Same Origin Policy
CWE-20 - Improper Input Validation
CWE-346 - Origin Validation Error

Assigner

apple

References

7 references

URL	Tags
https://support.apple.com/en-us/126604
https://support.apple.com/en-us/126792
https://support.apple.com/en-us/126793
https://support.apple.com/en-us/126794
https://support.apple.com/en-us/126799
https://support.apple.com/en-us/126800
http://seclists.org/fulldisclosure/2026/Mar/10

Impacted products

4 products

Vendor	Product	Version
Apple	Safari	Affected: 0 , < 26.4 (custom)
Apple	iOS and iPadOS	Affected: 0 , < 18.7.7 (custom) Affected: 0 , < 26.3.1 (a) (custom) Affected: 0 , < 26.4 (custom)
Apple	macOS	Affected: 0 , < 26.3.1 (a) (custom) Affected: 0 , < 26.3.2 (a) (custom) Affected: 0 , < 26.4 (custom)
Apple	visionOS	Affected: 0 , < 26.4 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-20643",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-18T13:14:53.546083Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-20",
                "description": "CWE-20 Improper Input Validation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          },
          {
            "descriptions": [
              {
                "cweId": "CWE-346",
                "description": "CWE-346 Origin Validation Error",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-18T13:14:56.139Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-03-19T16:18:46.731Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2026/Mar/10"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18.7.7",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "26.3.1 (a)",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.3.1 (a)",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "26.3.2 (a)",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A cross-origin issue in the Navigation API was addressed with improved input validation. This issue is fixed in Background Security Improvements for iOS, iPadOS, and macOS, Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may bypass Same Origin Policy."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing maliciously crafted web content may bypass Same Origin Policy",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:19:47.831Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/126604"
        },
        {
          "url": "https://support.apple.com/en-us/126792"
        },
        {
          "url": "https://support.apple.com/en-us/126793"
        },
        {
          "url": "https://support.apple.com/en-us/126794"
        },
        {
          "url": "https://support.apple.com/en-us/126799"
        },
        {
          "url": "https://support.apple.com/en-us/126800"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2026-20643",
    "datePublished": "2026-03-17T22:29:48.227Z",
    "dateReserved": "2025-11-11T14:43:07.862Z",
    "dateUpdated": "2026-04-02T18:19:47.831Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-20657 (GCVE-0-2026-20657)

Vulnerability from cvelistv5 – Published: 2026-03-25 00:31 – Updated: 2026-05-11 20:07

Summary

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, visionOS 26.4. Parsing a maliciously crafted file may lead to an unexpected app termination.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Parsing a maliciously crafted file may lead to an unexpected app termination
CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-125 - Out-of-bounds Read
CWE-787 - Out-of-bounds Write

Assigner

apple

References

6 references

URL	Tags
https://support.apple.com/en-us/126792
https://support.apple.com/en-us/126793
https://support.apple.com/en-us/126794
https://support.apple.com/en-us/126795
https://support.apple.com/en-us/126796
https://support.apple.com/en-us/126799

Impacted products

3 products

Vendor	Product	Version
Apple	iOS and iPadOS	Affected: 0 , < 18.7.7 (custom) Affected: 0 , < 26.4 (custom)
Apple	macOS	Affected: 0 , < 14.8.5 (custom) Affected: 0 , < 15.7.5 (custom) Affected: 0 , < 26.4 (custom)
Apple	visionOS	Affected: 0 , < 26.4 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-20657",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-26T13:50:36.656387Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          },
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          },
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-26T13:50:39.549Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18.7.7",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "14.8.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.7.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, visionOS 26.4. Parsing a maliciously crafted file may lead to an unexpected app termination."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Parsing a maliciously crafted file may lead to an unexpected app termination",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:07:58.857Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/126792"
        },
        {
          "url": "https://support.apple.com/en-us/126793"
        },
        {
          "url": "https://support.apple.com/en-us/126794"
        },
        {
          "url": "https://support.apple.com/en-us/126795"
        },
        {
          "url": "https://support.apple.com/en-us/126796"
        },
        {
          "url": "https://support.apple.com/en-us/126799"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2026-20657",
    "datePublished": "2026-03-25T00:31:59.386Z",
    "dateReserved": "2025-11-11T14:43:07.865Z",
    "dateUpdated": "2026-05-11T20:07:58.857Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-20664 (GCVE-0-2026-20664)

Vulnerability from cvelistv5 – Published: 2026-03-25 00:32 – Updated: 2026-04-02 18:25

Summary

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may lead to an unexpected process crash.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Processing maliciously crafted web content may lead to an unexpected process crash
CWE-787 - Out-of-bounds Write

Assigner

apple

References

4 references

URL	Tags
https://support.apple.com/en-us/126792
https://support.apple.com/en-us/126794
https://support.apple.com/en-us/126799
https://support.apple.com/en-us/126800

Impacted products

4 products

Vendor	Product	Version
Apple	Safari	Affected: 0 , < 26.4 (custom)
Apple	iOS and iPadOS	Affected: 0 , < 26.4 (custom)
Apple	macOS	Affected: 0 , < 26.4 (custom)
Apple	visionOS	Affected: 0 , < 26.4 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-20664",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-25T15:20:44.896487Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-25T15:25:39.361Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may lead to an unexpected process crash."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing maliciously crafted web content may lead to an unexpected process crash",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:25:52.860Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/126792"
        },
        {
          "url": "https://support.apple.com/en-us/126794"
        },
        {
          "url": "https://support.apple.com/en-us/126799"
        },
        {
          "url": "https://support.apple.com/en-us/126800"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2026-20664",
    "datePublished": "2026-03-25T00:32:56.673Z",
    "dateReserved": "2025-11-11T14:43:07.865Z",
    "dateUpdated": "2026-04-02T18:25:52.860Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-20665 (GCVE-0-2026-20665)

Vulnerability from cvelistv5 – Published: 2026-03-25 00:32 – Updated: 2026-04-02 18:24

Summary

This issue was addressed through improved state management. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Processing maliciously crafted web content may prevent Content Security Policy from being enforced
CWE-693 - Protection Mechanism Failure

Assigner

apple

References

7 references

URL	Tags
https://support.apple.com/en-us/126792
https://support.apple.com/en-us/126793
https://support.apple.com/en-us/126794
https://support.apple.com/en-us/126797
https://support.apple.com/en-us/126798
https://support.apple.com/en-us/126799
https://support.apple.com/en-us/126800

Impacted products

6 products

Vendor	Product	Version
Apple	Safari	Affected: 0 , < 26.4 (custom)
Apple	iOS and iPadOS	Affected: 0 , < 18.7.7 (custom) Affected: 0 , < 26.4 (custom)
Apple	macOS	Affected: 0 , < 26.4 (custom)
Apple	tvOS	Affected: 0 , < 26.4 (custom)
Apple	visionOS	Affected: 0 , < 26.4 (custom)
Apple	watchOS	Affected: 0 , < 26.4 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-20665",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-25T19:30:29.669623Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-693",
                "description": "CWE-693 Protection Mechanism Failure",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-25T19:31:29.619Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18.7.7",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "tvOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This issue was addressed through improved state management. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. Processing maliciously crafted web content may prevent Content Security Policy from being enforced."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing maliciously crafted web content may prevent Content Security Policy from being enforced",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:24:11.936Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/126792"
        },
        {
          "url": "https://support.apple.com/en-us/126793"
        },
        {
          "url": "https://support.apple.com/en-us/126794"
        },
        {
          "url": "https://support.apple.com/en-us/126797"
        },
        {
          "url": "https://support.apple.com/en-us/126798"
        },
        {
          "url": "https://support.apple.com/en-us/126799"
        },
        {
          "url": "https://support.apple.com/en-us/126800"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2026-20665",
    "datePublished": "2026-03-25T00:32:50.032Z",
    "dateReserved": "2025-11-11T14:43:07.866Z",
    "dateUpdated": "2026-04-02T18:24:11.936Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-20668 (GCVE-0-2026-20668)

Vulnerability from cvelistv5 – Published: 2026-03-25 00:35 – Updated: 2026-04-02 18:26

Summary

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.3, visionOS 26.3. An app may be able to access sensitive user data.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

An app may be able to access sensitive user data
CWE-532 - Insertion of Sensitive Information into Log File

Assigner

apple

References

6 references

URL	Tags
https://support.apple.com/en-us/126346
https://support.apple.com/en-us/126348
https://support.apple.com/en-us/126353
https://support.apple.com/en-us/126793
https://support.apple.com/en-us/126795
https://support.apple.com/en-us/126796

Impacted products

3 products

Vendor	Product	Version
Apple	iOS and iPadOS	Affected: 0 , < 18.7.7 (custom) Affected: 0 , < 26.3 (custom)
Apple	macOS	Affected: 0 , < 14.8.5 (custom) Affected: 0 , < 15.7.5 (custom) Affected: 0 , < 26.3 (custom)
Apple	visionOS	Affected: 0 , < 26.3 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-20668",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-25T15:40:28.066528Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-532",
                "description": "CWE-532 Insertion of Sensitive Information into Log File",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-25T18:07:01.327Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18.7.7",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "26.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "14.8.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.7.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "26.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.3, visionOS 26.3. An app may be able to access sensitive user data."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "An app may be able to access sensitive user data",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:26:51.214Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/126346"
        },
        {
          "url": "https://support.apple.com/en-us/126348"
        },
        {
          "url": "https://support.apple.com/en-us/126353"
        },
        {
          "url": "https://support.apple.com/en-us/126793"
        },
        {
          "url": "https://support.apple.com/en-us/126795"
        },
        {
          "url": "https://support.apple.com/en-us/126796"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2026-20668",
    "datePublished": "2026-03-25T00:35:39.282Z",
    "dateReserved": "2025-11-11T14:43:07.866Z",
    "dateUpdated": "2026-04-02T18:26:51.214Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

WID-SEC-W-2026-0852

CVE-2025-14524 (GCVE-0-2025-14524)

CVE-2025-43376 (GCVE-0-2025-43376)

CVE-2025-43534 (GCVE-0-2025-43534)

CVE-2025-64505 (GCVE-0-2025-64505)

CVE-2026-20637 (GCVE-0-2026-20637)

CVE-2026-20643 (GCVE-0-2026-20643)

CVE-2026-20657 (GCVE-0-2026-20657)

CVE-2026-20664 (GCVE-0-2026-20664)

CVE-2026-20665 (GCVE-0-2026-20665)

CVE-2026-20668 (GCVE-0-2026-20668)

Tags

Sightings

Nomenclature