{"id":"CVE-2026-65329","kind":"vulnerability","aliases":["CVE-2026-65329"],"related":[],"title":"An authentication issue was addressed with improved state management","description":"About the security content of iOS 26.6.1 and iPadOS 26.6.1 - Apple Support\n\n# About the security content of iOS 26.6.1 and iPadOS 26.6.1\n\nThis update delivers security fixes that were first made available in the iOS 27 and iPadOS 27 betas. This document describes the security content of iOS 26.6.1 and iPadOS 26.6.1.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## iOS 26.6.1 and iPadOS 26.6.1\n\nReleased August 17, 2026\n\n### Audio\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to leak sensitive user information\n\nDescription: A logic issue was addressed with improved checks.\n\nCVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik Tsytsarkin\n\nEntry updated September 14, 2026\n\n### Authentication Services\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A website may be able to determine a user's IP address with Private Relay turned on\n\nDescription: An information disclosure issue was addressed with improved state management.\n\nCVE-2026-65355: Xint Code\n\nEntry added September 14, 2026\n\n### ImageIO\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing an image may lead to a denial-of-service\n\nDescription: The issue was addressed with improved checks.\n\nCVE-2026-65347: Geonha Lee (@leegn4a)\n\n### ImageIO\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing an image may lead to arbitrary code execution\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-65346: Meta Red Team X - Nik Tsytsarkin\n\n### IOGPUFamily\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64788: an anonymous researcher, f00l (@PPPF00L) and 3ndy1(@_3ndy1) and Minghao Lin@Y1nkoc and 云散花折, Arjanit Isufi\n\nEntry updated September 14, 2026\n\n### IOMobileFrameBuffer\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds access issue was addressed with improved bounds checking.\n\nCVE-2026-64736: Ruslan Dautov, hxr1\n\nEntry added September 14, 2026\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A remote attacker may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-65343: Drinor Selmanaj (Sentry), Surya Narayan Kushwaha\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\nCVE-2026-65349: an anonymous researcher\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-65330: Ashish Kunwar, Mikhail Lozhnikov of Positive Technologies, Bhaswanth Chigurupati, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nCVE-2026-28935: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nEntry updated September 14, 2026\n\n### Telephony\n\nAvailable for: iPhone 11 and later\n\nImpact: An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic\n\nDescription: An authentication issue was addressed with improved state management.\n\nCVE-2026-65329: Bedran Karakoc, Tobias Funke, Jacopo Clark, Katharina Kohls of Ruhr University Bochum\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: An out-of-bounds access issue was addressed with improved bounds checking.\n\nWebKit Bugzilla: 317632\n\nCVE-2026-64784: Janggoon Lee of Out of Bounds, OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: The issue was addressed with improved memory handling.\n\nWebKit Bugzilla: 313452\n\nCVE-2026-43795: wwwlk\n\nWebKit Bugzilla: 318348\n\nCVE-2026-65338: OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: The issue was addressed with improved memory handling.\n\nWebKit Bugzilla: 318405\n\nCVE-2026-65341: Henock Habte\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A memory corruption vulnerability was addressed with improved locking.\n\nWebKit Bugzilla: 321480\n\nCVE-2026-64782: Charles Kern, Seonwook Kim, Shubham Chaskar, lattice, Josef Korbel\n\nEntry updated September 14, 2026\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: The issue was addressed with improved input validation.\n\nWebKit Bugzilla: 321484\n\nCVE-2026-64781: Thomas Guillem\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nWebKit Bugzilla: 321517\n\nCVE-2026-65351: Niels Hofmans\n\nWebKit Bugzilla: 316996\n\nCVE-2026-65340: Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Josef Korbel (Citadelo)\n\nWebKit Bugzilla: 317142\n\nCVE-2026-65337: OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317349\n\nCVE-2026-65336: Josef Korbel\n\nWebKit Bugzilla: 316723\n\nCVE-2026-65335: OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317603\n\nCVE-2026-65333: OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317450\n\nCVE-2026-65332: Kun Peeks (@SwayZGl1tZyyy), OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317611\n\nCVE-2026-65331: OpenAI Codex Security - Amy Burnett\n\nEntry updated September 14, 2026\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process crash\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 316347\n\nCVE-2026-64715: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nWebKit Bugzilla: 316918\n\nCVE-2026-64780: OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A memory corruption issue was addressed with improved state management.\n\nWebKit Bugzilla: 316791\n\nCVE-2026-65334: OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nWebKit Bugzilla: 317317\n\nCVE-2026-43794: Dung Do (@_piers2) of Calif.io\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process termination\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 313703\n\nCVE-2026-64787: 杉山 壮太, Shubham Chaskar\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A website may be able to determine a user's IP address with Private Relay turned on\n\nDescription: An information di","summary":"Apple's iOS 26.6.1 and iPadOS 26.6.1 advisory lists CVE-2026-65329 under Telephony, affecting iPhone 11 and later. The advisory says an attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"apple ipados","fixed":["26.6.1"],"affected":"< 26.6.1","ecosystem":"vendor"},{"name":"apple iphone os","fixed":["26.6.1"],"affected":"< 26.6.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apple","ios","ipad","ipados","iphone","vendor","vendor-advisory"],"not_affected_if":["no-ipsec-in-use","updated-to-26.6.1"],"how_to_check":"- Check the iOS version under Settings > General > About; the advisory covers iOS 26.6.1 and iPadOS 26.6.1 and later builds","fix":"- iOS and iPadOS `26.6.1` per Apple's advisory; the sources do not give a separate fixed version for this CVE","status":"open","published_at":"2026-08-17T22:17:23+00:00","first_seen_at":"2026-11-12T20:57:53+00:00","triaged_at":"2026-11-12T21:04:08+00:00","updated_at":"2026-11-12T21:11:28+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-11-12T21:04:08Z","model":"claude-haiku-5-5","output":{"fix":"- iOS and iPadOS `26.6.1` per Apple's advisory; the sources do not give a separate fixed version for this CVE","reach":"network","title":"iPhone and iPad: IPSec authentication flaw lets a network attacker intercept traffic","impact":"medium","summary":"Apple's iOS 26.6.1 and iPadOS 26.6.1 advisory lists CVE-2026-65329 under Telephony, affecting iPhone 11 and later. The advisory says an attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic.","audience":"everyone","category":"vendor","nicknames":[],"who_cares":["iphone","ipad","ios","ipadOS"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Network traffic can be intercepted by an attacker on the path.","analyst_note":"","how_to_check":"- Check the iOS version under Settings > General > About; the advisory covers iOS 26.6.1 and iPadOS 26.6.1 and later builds\n- unknown for any other check, as the sources do not say","plain_action":"Update your iPhone to iOS 26.6.1 or later: Settings > General > Software Update.","product_name":"","needs_analyst":false,"not_affected_if":["updated-to-26.6.1","no-ipsec-in-use"],"who_is_affected":"The advisory lists iPhone 11 and later for this Telephony issue, and the attacker must sit in a privileged network position such as a compromised or hostile network path. The sources do not say whether IPSec is enabled by default, so whether a given device uses IPSec is unknown. Devices already on iOS 26.6.1 or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.001263,"input_tokens":9421,"output_tokens":642,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A,40B,253C,342C,413C,480C,550C,644C '-64736':645C '-64788':551C '-65329':12A,15A,41B '-65339':254C '-65346':481C '-65347':414C '-65355':343C '11':46B,195C,208C,275C,288C,355C,368C,422C,435C,492C,505C,577C,590C,658C,671C '12.9':200C,280C,360C,427C,497C,582C,663C '14':268C,349C,571C,652C '17':189C '1st':210C,290C,370C,437C,507C,592C,673C '2026':190C,269C,350C,572C,653C '26.6.1':33B,36B,76C,79C,88C,91C,118C,121C,183C,186C '27':105C,108C '3ndy1':558C,559C '3rd':202C,216C,282C,296C,362C,376C,429C,443C,499C,513C,584C,598C,665C,679C '5th':228C,308C,388C,455C,525C,610C,691C '8th':221C,301C,381C,448C,518C,603C,684C 'abl':61B,237C,317C,619C,701C 'access':635C 'add':347C,650C 'address':5A,248C,324C,336C,408C,474C,544C,638C 'advisori':29B,37B,50B 'affect':44B 'air':215C,295C,375C,442C,512C,597C,678C 'anonym':553C 'app':234C,616C 'appl':21B,30B,80C,123C,130C,156C,160C,178C 'apple':16A,18A 'arbitrari':466C 'arjanit':566C 'attack':53B,698C 'audio':191C 'august':188C 'authent':2A,65B,270C 'avail':101C,149C,192C,272C,352C,419C,489C,574C,655C 'beta':109C 'bound':634C,641C 'bypass':63B 'calap':256C 'caus':621C,703C 'check':251C,411C,642C 'code':345C,467C 'confirm':136C 'content':73C,85C,115C,534C 'corrupt':539C,626C 'craft':532C 'custom':128C 'cve':10A,13A,39B,167C,252C,341C,412C,479C,549C,643C 'cve-id':166C 'dautov':647C 'dbg.re':258C 'deliv':94C 'denial':401C 'denial-of-servic':400C 'describ':112C 'descript':243C,330C,404C,469C,540C,629C 'determin':319C 'disclos':133C 'disclosur':333C 'discuss':134C 'document':111C,162C 'doesn':131C 'entri':265C,346C,568C,649C 'execut':468C 'f00l':555C 'first':99C 'fix':96C 'generat':203C,211C,217C,222C,229C,283C,291C,297C,302C,309C,363C,371C,377C,382C,389C,430C,438C,444C,449C,456C,500C,508C,514C,519C,526C,585C,593C,599C,604C,611C,666C,674C,680C,685C,692C 'geonha':415C 'handl':548C 'hxr1':648C 'id':168C 'imag':395C,462C 'imageio':351C,418C 'impact':232C,312C,392C,459C,529C,614C,695C 'improv':7A,250C,338C,410C,476C,546C,640C 'inch':201C,209C,281C,289C,361C,369C,428C,436C,498C,506C,583C,591C,664C,672C 'inform':173C,242C,332C 'input':477C 'integ':471C 'intercept':67B 'investig':141C 'io':22B,32B,75C,87C,104C,117C,182C 'iogpufamili':488C 'iomobileframebuff':573C 'ip':323C 'ipad':23B,198C,206C,214C,220C,226C,278C,286C,294C,300C,306C,358C,366C,374C,380C,386C,425C,433C,441C,447C,453C,495C,503C,511C,517C,523C,580C,588C,596C,602C,608C,661C,669C,677C,683C,689C 'ipado':24B,35B,78C,90C,107C,120C,185C 'ipados':17A 'iphon':25B,45B,194C,274C,354C,421C,491C,576C,657C 'iphone':19A 'ipsec':64B 'issu':3A,138C,246C,334C,406C,542C,636C 'isufi':567C 'kernel':627C,654C 'later':48B,197C,205C,213C,219C,224C,231C,277C,285C,293C,299C,304C,311C,357C,365C,373C,379C,384C,391C,424C,432C,440C,446C,451C,458C,494C,502C,510C,516C,521C,528C,579C,587C,595C,601C,606C,613C,660C,668C,676C,682C,687C,694C 'lead':397C,464C,536C 'leak':239C 'lee':416C 'leegn4a':417C 'lin':562C 'list':38B,153C 'logic':245C 'made':100C 'malici':531C 'manag':9A,340C 'may':59B,235C,315C,396C,463C,535C,617C,699C 'memori':538C,547C,628C 'meta':259C,482C 'minghao':561C 'mini':227C,307C,387C,454C,524C,609C,690C 'mustafa':255C 'network':57B,68B 'nik':263C,486C 'occur':143C 'ordinal0':257C 'os':20A 'out-of-bound':631C 'overflow':472C 'page':159C,181C 'patch':145C 'posit':58B 'possibl':170C 'pppf00l':556C 'privat':326C 'privileg':56B 'pro':199C,207C,279C,287C,359C,367C,426C,434C,496C,504C,581C,589C,662C,670C 'process':393C,460C,530C 'product':179C 'protect':129C 'recent':150C 'red':260C,483C 'refer':163C 'relay':327C 'releas':147C,151C,158C,187C 'remot':697C 'research':554C 'ruslan':646C 'say':51B 'secur':72C,84C,95C,114C,124C,137C,157C,161C,175C,180C 'see':176C 'sensit':240C 'septemb':267C,348C,570C,651C 'servic':271C,403C 'state':8A,339C 'support':81C 'system':623C,705C 'team':261C,484C 'telephoni':43B 'termin':624C,706C 'traffic':69B 'tsytsarkin':264C,487C 'turn':328C 'unexpect':622C,704C 'updat':93C,125C,266C,569C 'user':241C,321C 'valid':478C 'vendor':26B,28B 'vendor-advisori':27B 'vulner':164C 'web':533C 'websit':314C 'x':262C,485C 'xint':344C 'y1nkoc':563C '云散花折':565C","nicknames":[],"mitigations":[],"who_affected":"The advisory lists iPhone 11 and later for this Telephony issue, and the attacker must sit in a privileged network position such as a compromised or hostile network path. The sources do not say whether IPSec is enabled by default, so whether a given device uses IPSec is unknown. Devices already on iOS 26.6.1 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update your iPhone to iOS 26.6.1 or later: Settings > General > Software Update.","pkeys":["appleipados","appleiphoneos","ipados","iphoneos"],"ptokens":["apple","ipados","iphone","os"],"labels":["apple","ios","ipad","ipados","iphone","medium","vendor","vendoradvisory"],"campaign_type":null,"search_a":"'-2026':11A,14A '-65329':12A,15A 'address':5A 'apple':16A,18A 'authent':2A 'cve':10A,13A 'improv':7A 'ipados':17A 'iphone':19A 'issu':3A 'manag':9A 'os':20A 'state':8A","search_b":"'-2026':40B '-65329':41B '11':46B '26.6.1':33B,36B 'abl':61B 'advisori':29B,37B,50B 'affect':44B 'appl':21B,30B 'attack':53B 'authent':65B 'bypass':63B 'cve':39B 'intercept':67B 'io':22B,32B 'ipad':23B 'ipado':24B,35B 'iphon':25B,45B 'ipsec':64B 'later':48B 'list':38B 'may':59B 'network':57B,68B 'posit':58B 'privileg':56B 'say':51B 'telephoni':43B 'traffic':69B 'vendor':26B,28B 'vendor-advisori':27B","search_c":"'-2026':253C,342C,413C,480C,550C,644C '-64736':645C '-64788':551C '-65339':254C '-65346':481C '-65347':414C '-65355':343C '11':195C,208C,275C,288C,355C,368C,422C,435C,492C,505C,577C,590C,658C,671C '12.9':200C,280C,360C,427C,497C,582C,663C '14':268C,349C,571C,652C '17':189C '1st':210C,290C,370C,437C,507C,592C,673C '2026':190C,269C,350C,572C,653C '26.6.1':76C,79C,88C,91C,118C,121C,183C,186C '27':105C,108C '3ndy1':558C,559C '3rd':202C,216C,282C,296C,362C,376C,429C,443C,499C,513C,584C,598C,665C,679C '5th':228C,308C,388C,455C,525C,610C,691C '8th':221C,301C,381C,448C,518C,603C,684C 'abl':237C,317C,619C,701C 'access':635C 'add':347C,650C 'address':248C,324C,336C,408C,474C,544C,638C 'air':215C,295C,375C,442C,512C,597C,678C 'anonym':553C 'app':234C,616C 'appl':80C,123C,130C,156C,160C,178C 'arbitrari':466C 'arjanit':566C 'attack':698C 'audio':191C 'august':188C 'authent':270C 'avail':101C,149C,192C,272C,352C,419C,489C,574C,655C 'beta':109C 'bound':634C,641C 'calap':256C 'caus':621C,703C 'check':251C,411C,642C 'code':345C,467C 'confirm':136C 'content':73C,85C,115C,534C 'corrupt':539C,626C 'craft':532C 'custom':128C 'cve':167C,252C,341C,412C,479C,549C,643C 'cve-id':166C 'dautov':647C 'dbg.re':258C 'deliv':94C 'denial':401C 'denial-of-servic':400C 'describ':112C 'descript':243C,330C,404C,469C,540C,629C 'determin':319C 'disclos':133C 'disclosur':333C 'discuss':134C 'document':111C,162C 'doesn':131C 'entri':265C,346C,568C,649C 'execut':468C 'f00l':555C 'first':99C 'fix':96C 'generat':203C,211C,217C,222C,229C,283C,291C,297C,302C,309C,363C,371C,377C,382C,389C,430C,438C,444C,449C,456C,500C,508C,514C,519C,526C,585C,593C,599C,604C,611C,666C,674C,680C,685C,692C 'geonha':415C 'handl':548C 'hxr1':648C 'id':168C 'imag':395C,462C 'imageio':351C,418C 'impact':232C,312C,392C,459C,529C,614C,695C 'improv':250C,338C,410C,476C,546C,640C 'inch':201C,209C,281C,289C,361C,369C,428C,436C,498C,506C,583C,591C,664C,672C 'inform':173C,242C,332C 'input':477C 'integ':471C 'investig':141C 'io':75C,87C,104C,117C,182C 'iogpufamili':488C 'iomobileframebuff':573C 'ip':323C 'ipad':198C,206C,214C,220C,226C,278C,286C,294C,300C,306C,358C,366C,374C,380C,386C,425C,433C,441C,447C,453C,495C,503C,511C,517C,523C,580C,588C,596C,602C,608C,661C,669C,677C,683C,689C 'ipado':78C,90C,107C,120C,185C 'iphon':194C,274C,354C,421C,491C,576C,657C 'issu':138C,246C,334C,406C,542C,636C 'isufi':567C 'kernel':627C,654C 'later':197C,205C,213C,219C,224C,231C,277C,285C,293C,299C,304C,311C,357C,365C,373C,379C,384C,391C,424C,432C,440C,446C,451C,458C,494C,502C,510C,516C,521C,528C,579C,587C,595C,601C,606C,613C,660C,668C,676C,682C,687C,694C 'lead':397C,464C,536C 'leak':239C 'lee':416C 'leegn4a':417C 'lin':562C 'list':153C 'logic':245C 'made':100C 'malici':531C 'manag':340C 'may':235C,315C,396C,463C,535C,617C,699C 'memori':538C,547C,628C 'meta':259C,482C 'minghao':561C 'mini':227C,307C,387C,454C,524C,609C,690C 'mustafa':255C 'nik':263C,486C 'occur':143C 'ordinal0':257C 'out-of-bound':631C 'overflow':472C 'page':159C,181C 'patch':145C 'possibl':170C 'pppf00l':556C 'privat':326C 'pro':199C,207C,279C,287C,359C,367C,426C,434C,496C,504C,581C,589C,662C,670C 'process':393C,460C,530C 'product':179C 'protect':129C 'recent':150C 'red':260C,483C 'refer':163C 'relay':327C 'releas':147C,151C,158C,187C 'remot':697C 'research':554C 'ruslan':646C 'secur':72C,84C,95C,114C,124C,137C,157C,161C,175C,180C 'see':176C 'sensit':240C 'septemb':267C,348C,570C,651C 'servic':271C,403C 'state':339C 'support':81C 'system':623C,705C 'team':261C,484C 'termin':624C,706C 'tsytsarkin':264C,487C 'turn':328C 'unexpect':622C,704C 'updat':93C,125C,266C,569C 'user':241C,321C 'valid':478C 'vulner':164C 'web':533C 'websit':314C 'x':262C,485C 'xint':344C 'y1nkoc':563C '云散花折':565C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-08-17T22:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"lab","external_id":"https://support.apple.com/en-us/148282#CVE-2026-65329","url":"https://support.apple.com/en-us/148282","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-12T20:57:53+00:00","fetched_at":"2026-11-12T20:57:53+00:00","note":"Apple: About the security content of iOS 26.6.1 and iPadOS 26.6.1 - Apple Support"},{"source":"nvd","external_id":"CVE-2026-65329","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65329","severity":null,"published_at":"2026-08-17T22:17:23+00:00","modified_at":"2026-10-23T16:10:00+00:00","first_seen_at":"2026-11-12T21:11:28+00:00","fetched_at":"2026-11-12T21:11:28+00:00","note":null}],"documents":[{"id":14250,"url":"https://support.apple.com/en-us/148282","title":"Apple: About the security content of iOS 26.6.1 and iPadOS 26.6.1 - Apple Support","kind":"vendor","source":"nvd","publisher":"vendor","text":"About the security content of iOS 26.6.1 and iPadOS 26.6.1 - Apple Support\n\n# About the security content of iOS 26.6.1 and iPadOS 26.6.1\n\nThis update delivers security fixes that were first made available in the iOS 27 and iPadOS 27 betas. This document describes the security content of iOS 26.6.1 and iPadOS 26.6.1.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## iOS 26.6.1 and iPadOS 26.6.1\n\nReleased August 17, 2026\n\n### Audio\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to leak sensitive user information\n\nDescription: A logic issue was addressed with improved checks.\n\nCVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik Tsytsarkin\n\nEntry updated September 14, 2026\n\n### Authentication Services\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A website may be able to determine a user's IP address with Private Relay turned on\n\nDescription: An information disclosure issue was addressed with improved state management.\n\nCVE-2026-65355: Xint Code\n\nEntry added September 14, 2026\n\n### ImageIO\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing an image may lead to a denial-of-service\n\nDescription: The issue was addressed with improved checks.\n\nCVE-2026-65347: Geonha Lee (@leegn4a)\n\n### ImageIO\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing an image may lead to arbitrary code execution\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-65346: Meta Red Team X - Nik Tsytsarkin\n\n### IOGPUFamily\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64788: an anonymous researcher, f00l (@PPPF00L) and 3ndy1(@_3ndy1) and Minghao Lin@Y1nkoc and 云散花折, Arjanit Isufi\n\nEntry updated September 14, 2026\n\n### IOMobileFrameBuffer\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds access issue was addressed with improved bounds checking.\n\nCVE-2026-64736: Ruslan Dautov, hxr1\n\nEntry added September 14, 2026\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A remote attacker may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-65343: Drinor Selmanaj (Sentry), Surya Narayan Kushwaha\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\nCVE-2026-65349: an anonymous researcher\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-65330: Ashish Kunwar, Mikhail Lozhnikov of Positive Technologies, Bhaswanth Chigurupati, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nCVE-2026-28935: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nEntry updated September 14, 2026\n\n### Telephony\n\nAvailable for: iPhone 11 and later\n\nImpact: An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic\n\nDescription: An authentication issue was addressed with improved state management.\n\nCVE-2026-65329: Bedran Karakoc, Tobias Funke, Jacopo Clark, Katharina Kohls of Ruhr University Bochum\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: An out-of-bounds access issue was addressed with improved bounds checking.\n\nWebKit Bugzilla: 317632\n\nCVE-2026-64784: Janggoon Lee of Out of Bounds, OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: The issue was addressed with improved memory handling.\n\nWebKit Bugzilla: 313452\n\nCVE-2026-43795: wwwlk\n\nWebKit Bugzilla: 318348\n\nCVE-2026-65338: OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: The issue was addressed with improved memory handling.\n\nWebKit Bugzilla: 318405\n\nCVE-2026-65341: Henock Habte\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A memory corruption vulnerability was addressed with improved locking.\n\nWebKit Bugzilla: 321480\n\nCVE-2026-64782: Charles Kern, Seonwook Kim, Shubham Chaskar, lattice, Josef Korbel\n\nEntry updated September 14, 2026\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: The issue was addressed with improved input validation.\n\nWebKit Bugzilla: 321484\n\nCVE-2026-64781: Thomas Guillem\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nWebKit Bugzilla: 321517\n\nCVE-2026-65351: Niels Hofmans\n\nWebKit Bugzilla: 316996\n\nCVE-2026-65340: Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Josef Korbel (Citadelo)\n\nWebKit Bugzilla: 317142\n\nCVE-2026-65337: OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317349\n\nCVE-2026-65336: Josef Korbel\n\nWebKit Bugzilla: 316723\n\nCVE-2026-65335: OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317603\n\nCVE-2026-65333: OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317450\n\nCVE-2026-65332: Kun Peeks (@SwayZGl1tZyyy), OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317611\n\nCVE-2026-65331: OpenAI Codex Security - Amy Burnett\n\nEntry updated September 14, 2026\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process crash\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 316347\n\nCVE-2026-64715: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nWebKit Bugzilla: 316918\n\nCVE-2026-64780: OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A memory corruption issue was addressed with improved state management.\n\nWebKit Bugzilla: 316791\n\nCVE-2026-65334: OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nWebKit Bugzilla: 317317\n\nCVE-2026-43794: Dung Do (@_piers2) of Calif.io\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process termination\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 313703\n\nCVE-2026-64787: 杉山 壮太, Shubham Chaskar\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A website may be able to determine a user's IP address with Private Relay turned on\n\nDescription: An information disclosure issue was addressed with improved state management.\n\nWebKit Bugzilla: 321065\n\nCVE-2026-65352: Talal Haj Bakry and Tommy Mysk of Mysk Inc. @mysk_co\n\n### WebKit History\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Visiting a maliciously crafted website may leak sensitive data\n\nDescription: The issue was addressed with improved checks.\n\nWebKit Bugzilla: 322124\n\nCVE-2026-64778: Mohit Negi\n\n### WebKit Storage\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A memory corruption vulnerability was addressed with improved locking.\n\nWebKit Bugzilla: 321485\n\nCVE-2026-64779: Shubham Chaskar, Tommy DeVoss from Braze Security Team (@thedawgyg)\n\n### WebRTC\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-65391: Myungyong Lee\n\nEntry added September 14, 2026\n\n### WebRTC\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-65390: Kwak Kiyong (@Pwnkai23), Song Nuri\n\nEntry added September 14, 2026\n\n## Additional recognition\n\n### Compression\n\nWe would like to acknowledge Tommy DeVoss from Braze Security Team (@thedawgyg) for their assistance.\n\n### libcryptex\n\nWe would like to acknowledge Ashish Kunwar for their assistance.\n\n### WebKit\n\nWe would like to acknowledge Henock Habte for their assistance.\n\n Published Date: September 14, 2026","published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":14250,"url":"https://support.apple.com/en-us/148282","title":"Apple: About the security content of iOS 26.6.1 and iPadOS 26.6.1 - Apple Support","kind":"vendor","source":"nvd","publisher":"vendor","text":"About the security content of iOS 26.6.1 and iPadOS 26.6.1 - Apple Support\n\n# About the security content of iOS 26.6.1 and iPadOS 26.6.1\n\nThis update delivers security fixes that were first made available in the iOS 27 and iPadOS 27 betas. This document describes the security content of iOS 26.6.1 and iPadOS 26.6.1.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## iOS 26.6.1 and iPadOS 26.6.1\n\nReleased August 17, 2026\n\n### Audio\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to leak sensitive user information\n\nDescription: A logic issue was addressed with improved checks.\n\nCVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik Tsytsarkin\n\nEntry updated September 14, 2026\n\n### Authentication Services\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A website may be able to determine a user's IP address with Private Relay turned on\n\nDescription: An information disclosure issue was addressed with improved state management.\n\nCVE-2026-65355: Xint Code\n\nEntry added September 14, 2026\n\n### ImageIO\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing an image may lead to a denial-of-service\n\nDescription: The issue was addressed with improved checks.\n\nCVE-2026-65347: Geonha Lee (@leegn4a)\n\n### ImageIO\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing an image may lead to arbitrary code execution\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-65346: Meta Red Team X - Nik Tsytsarkin\n\n### IOGPUFamily\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64788: an anonymous researcher, f00l (@PPPF00L) and 3ndy1(@_3ndy1) and Minghao Lin@Y1nkoc and 云散花折, Arjanit Isufi\n\nEntry updated September 14, 2026\n\n### IOMobileFrameBuffer\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds access issue was addressed with improved bounds checking.\n\nCVE-2026-64736: Ruslan Dautov, hxr1\n\nEntry added September 14, 2026\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A remote attacker may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-65343: Drinor Selmanaj (Sentry), Surya Narayan Kushwaha\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\nCVE-2026-65349: an anonymous researcher\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-65330: Ashish Kunwar, Mikhail Lozhnikov of Positive Technologies, Bhaswanth Chigurupati, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nCVE-2026-28935: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nEntry updated September 14, 2026\n\n### Telephony\n\nAvailable for: iPhone 11 and later\n\nImpact: An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic\n\nDescription: An authentication issue was addressed with improved state management.\n\nCVE-2026-65329: Bedran Karakoc, Tobias Funke, Jacopo Clark, Katharina Kohls of Ruhr University Bochum\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: An out-of-bounds access issue was addressed with improved bounds checking.\n\nWebKit Bugzilla: 317632\n\nCVE-2026-64784: Janggoon Lee of Out of Bounds, OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: The issue was addressed with improved memory handling.\n\nWebKit Bugzilla: 313452\n\nCVE-2026-43795: wwwlk\n\nWebKit Bugzilla: 318348\n\nCVE-2026-65338: OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: The issue was addressed with improved memory handling.\n\nWebKit Bugzilla: 318405\n\nCVE-2026-65341: Henock Habte\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A memory corruption vulnerability was addressed with improved locking.\n\nWebKit Bugzilla: 321480\n\nCVE-2026-64782: Charles Kern, Seonwook Kim, Shubham Chaskar, lattice, Josef Korbel\n\nEntry updated September 14, 2026\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: The issue was addressed with improved input validation.\n\nWebKit Bugzilla: 321484\n\nCVE-2026-64781: Thomas Guillem\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nWebKit Bugzilla: 321517\n\nCVE-2026-65351: Niels Hofmans\n\nWebKit Bugzilla: 316996\n\nCVE-2026-65340: Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Josef Korbel (Citadelo)\n\nWebKit Bugzilla: 317142\n\nCVE-2026-65337: OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317349\n\nCVE-2026-65336: Josef Korbel\n\nWebKit Bugzilla: 316723\n\nCVE-2026-65335: OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317603\n\nCVE-2026-65333: OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317450\n\nCVE-2026-65332: Kun Peeks (@SwayZGl1tZyyy), OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317611\n\nCVE-2026-65331: OpenAI Codex Security - Amy Burnett\n\nEntry updated September 14, 2026\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process crash\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 316347\n\nCVE-2026-64715: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nWebKit Bugzilla: 316918\n\nCVE-2026-64780: OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A memory corruption issue was addressed with improved state management.\n\nWebKit Bugzilla: 316791\n\nCVE-2026-65334: OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nWebKit Bugzilla: 317317\n\nCVE-2026-43794: Dung Do (@_piers2) of Calif.io\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process termination\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 313703\n\nCVE-2026-64787: 杉山 壮太, Shubham Chaskar\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A website may be able to determine a user's IP address with Private Relay turned on\n\nDescription: An information disclosure issue was addressed with improved state management.\n\nWebKit Bugzilla: 321065\n\nCVE-2026-65352: Talal Haj Bakry and Tommy Mysk of Mysk Inc. @mysk_co\n\n### WebKit History\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Visiting a maliciously crafted website may leak sensitive data\n\nDescription: The issue was addressed with improved checks.\n\nWebKit Bugzilla: 322124\n\nCVE-2026-64778: Mohit Negi\n\n### WebKit Storage\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A memory corruption vulnerability was addressed with improved locking.\n\nWebKit Bugzilla: 321485\n\nCVE-2026-64779: Shubham Chaskar, Tommy DeVoss from Braze Security Team (@thedawgyg)\n\n### WebRTC\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-65391: Myungyong Lee\n\nEntry added September 14, 2026\n\n### WebRTC\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-65390: Kwak Kiyong (@Pwnkai23), Song Nuri\n\nEntry added September 14, 2026\n\n## Additional recognition\n\n### Compression\n\nWe would like to acknowledge Tommy DeVoss from Braze Security Team (@thedawgyg) for their assistance.\n\n### libcryptex\n\nWe would like to acknowledge Ashish Kunwar for their assistance.\n\n### WebKit\n\nWe would like to acknowledge Henock Habte for their assistance.\n\n Published Date: September 14, 2026","published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: support.apple.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}