Apple Fixes 28 Security Vulnerabilities Across macOS, iOS, and iPadOS

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Spread the love

Apple has released security updates for macOS, iOS, and iPadOS, addressing 28 vulnerabilities that could expose users to data leakage, application crashes, kernel memory access, and arbitrary code execution.

The updates were released on August 17, 2026, and include macOS Tahoe 26.6.2, iOS 26.6.1, iPadOS 26.6.1, iOS 18.7.10, and iPadOS 18.7.10. The company said the patches include fixes that were previously delivered through iOS, iPadOS, and macOS beta releases.

Apple follows a policy of withholding technical details about security flaws until it completes an investigation and security updates are broadly available.

Several flaws affect components that process media, web content, and graphics. Apple fixed an integer overflow in ImageIO that could allow a specially crafted image to trigger arbitrary code execution. A separate ImageIO issue could cause a denial-of-service condition when a vulnerable device processes a malicious image.

Apple Fixes 28 Security Vulnerabilities

The updates also address multiple issues in IOGPUFamily, an Apple graphics framework. Apple warned that malicious web content could cause memory corruption.

At the same time, other flaws could enable remote attackers to terminate a system unexpectedly or allow a local application to read kernel memory. Such bugs are significant because the kernel runs with high privileges and controls core operating-system functions.

An additional kernel-level issue in the older iOS 18.7.10 and iPadOS 18.7.10 releases could allow a malicious application to execute arbitrary code with kernel privileges via a buffer overflow. Apple resolved the flaw through improved size validation.

Apple patched an Audio logic issue that could allow an application to leak sensitive user information. The company addressed the problem by adding improved checks. This vulnerability affects both macOS Tahoe 26.6.2 and the newer iOS and iPadOS releases.

The mobile updates also include an Accessibility fix for devices running iOS 18.7.10 and iPadOS 18.7.10. Apple said an attacker with physical access could potentially access sensitive data during iPhone Mirroring. This feature links an iPhone with a Mac. The issue was fixed through improved state management.

CVE Component Affected release(s) Impact Vulnerability type / remediation
CVE-2026-65339 Audio iOS/iPadOS 26.6.1; macOS Tahoe 26.6.2 An app may leak sensitive user information Logic issue; improved checks
CVE-2026-65347 ImageIO iOS/iPadOS; macOS Processing an image may cause DoS Improved checks
CVE-2026-65346 ImageIO iOS/iPadOS; macOS Processing an image may enable arbitrary code execution Integer overflow; improved input validation
CVE-2026-64788 IOGPUFamily iOS/iPadOS; macOS Crafted web content may cause memory corruption Improved memory handling
CVE-2026-65343 Kernel iOS/iPadOS; macOS Remote attacker may terminate the system Use-after-free; improved memory management
CVE-2026-65349 Kernel iOS/iPadOS; macOS App may terminate the system or read kernel memory Out-of-bounds read; improved input validation
CVE-2026-65330 Kernel iOS/iPadOS; macOS App may terminate the system or corrupt kernel memory Improved memory handling
CVE-2026-65329 Telephony iOS 26.6.1 only; iPhone 11 and later Privileged network attacker may bypass IPSec authentication and intercept traffic Authentication issue; improved state management
CVE-2026-64784 WebKit iOS/iPadOS; macOS Crafted web content may crash Safari Out-of-bounds access; improved bounds checking
CVE-2026-43795 WebKit iOS/iPadOS; macOS Crafted web content may crash Safari Improved memory handling
CVE-2026-65338 WebKit iOS/iPadOS; macOS Crafted web content may crash Safari Improved memory handling
CVE-2026-65341 WebKit iOS/iPadOS; macOS Crafted web content may cause memory corruption Improved memory handling
CVE-2026-64782 WebKit iOS/iPadOS; macOS Crafted web content may crash Safari Memory-corruption flaw; improved locking
CVE-2026-64781 WebKit iOS/iPadOS; macOS Crafted web content may crash Safari Improved input validation
CVE-2026-65351 WebKit iOS/iPadOS; macOS Crafted web content may crash Safari Improved state management
CVE-2026-65340 WebKit iOS/iPadOS; macOS Crafted web content may crash Safari Improved state management
CVE-2026-65337 WebKit iOS/iPadOS; macOS Crafted web content may crash Safari Improved state management
CVE-2026-65336 WebKit iOS/iPadOS; macOS Crafted web content may crash Safari Improved state management
CVE-2026-65335 WebKit iOS/iPadOS; macOS Crafted web content may crash Safari Improved state management
CVE-2026-65333 WebKit iOS/iPadOS; macOS Crafted web content may crash Safari Improved state management
CVE-2026-65332 WebKit iOS/iPadOS; macOS Crafted web content may crash Safari Improved state management
CVE-2026-65331 WebKit iOS/iPadOS; macOS Crafted web content may crash Safari Improved state management
CVE-2026-64715 WebKit iOS/iPadOS; macOS Crafted web content may cause an unexpected process crash Use-after-free; improved memory management
CVE-2026-64780 WebKit iOS/iPadOS; macOS Crafted web content may crash Safari Improved checks
CVE-2026-65334 WebKit iOS/iPadOS; macOS Crafted web content may crash Safari Memory-corruption flaw; improved state management
CVE-2026-43794 WebKit iOS/iPadOS; macOS Crafted web content may cause memory corruption Memory-corruption flaw; improved memory handling
CVE-2026-64787 WebKit iOS/iPadOS; macOS Crafted web content may terminate a process Use-after-free; improved memory management
CVE-2026-64778 WebKit History iOS/iPadOS; macOS Visiting a crafted website may leak sensitive data Improved checks
CVE-2026-64779 WebKit Storage iOS/iPadOS; macOS Crafted web content may crash Safari Memory-corruption flaw; improved locking

Apple also corrected an IPSec authentication issue in iOS 26.6.1 and iPadOS 26.6.1. A threat actor in a privileged network position could bypass IPSec authentication and intercept network traffic, posing a risk to users on hostile or compromised networks.

iOS 26.6.1 and iPadOS 26.6.1 are available for iPhone 11 and later, supported iPad Pro models, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later.

The iOS 18.7.10 and iPadOS 18.7.10 updates protect older iPhone XS, iPhone XS Max, iPhone XR, and iPad 7th-generation devices. Users should install the updates promptly. Apple notes that iPhone, iPad, Apple TV, Apple Watch, and Vision Pro software cannot be downgraded after an update is installed.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.