{"id":"CVE-2026-65352","kind":"vulnerability","aliases":["CVE-2026-65352"],"related":[],"title":"An information disclosure issue was addressed with improved state management","description":"About the security content of iOS 26.6.1 and iPadOS 26.6.1 - Apple Support\n\n# About the security content of iOS 26.6.1 and iPadOS 26.6.1\n\nThis update delivers security fixes that were first made available in the iOS 27 and iPadOS 27 betas. This document describes the security content of iOS 26.6.1 and iPadOS 26.6.1.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## iOS 26.6.1 and iPadOS 26.6.1\n\nReleased August 17, 2026\n\n### Audio\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to leak sensitive user information\n\nDescription: A logic issue was addressed with improved checks.\n\nCVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik Tsytsarkin\n\nEntry updated September 14, 2026\n\n### Authentication Services\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A website may be able to determine a user's IP address with Private Relay turned on\n\nDescription: An information disclosure issue was addressed with improved state management.\n\nCVE-2026-65355: Xint Code\n\nEntry added September 14, 2026\n\n### ImageIO\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing an image may lead to a denial-of-service\n\nDescription: The issue was addressed with improved checks.\n\nCVE-2026-65347: Geonha Lee (@leegn4a)\n\n### ImageIO\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing an image may lead to arbitrary code execution\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-65346: Meta Red Team X - Nik Tsytsarkin\n\n### IOGPUFamily\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64788: an anonymous researcher, f00l (@PPPF00L) and 3ndy1(@_3ndy1) and Minghao Lin@Y1nkoc and 云散花折, Arjanit Isufi\n\nEntry updated September 14, 2026\n\n### IOMobileFrameBuffer\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds access issue was addressed with improved bounds checking.\n\nCVE-2026-64736: Ruslan Dautov, hxr1\n\nEntry added September 14, 2026\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A remote attacker may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-65343: Drinor Selmanaj (Sentry), Surya Narayan Kushwaha\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\nCVE-2026-65349: an anonymous researcher\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-65330: Ashish Kunwar, Mikhail Lozhnikov of Positive Technologies, Bhaswanth Chigurupati, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nCVE-2026-28935: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nEntry updated September 14, 2026\n\n### Telephony\n\nAvailable for: iPhone 11 and later\n\nImpact: An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic\n\nDescription: An authentication issue was addressed with improved state management.\n\nCVE-2026-65329: Bedran Karakoc, Tobias Funke, Jacopo Clark, Katharina Kohls of Ruhr University Bochum\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: An out-of-bounds access issue was addressed with improved bounds checking.\n\nWebKit Bugzilla: 317632\n\nCVE-2026-64784: Janggoon Lee of Out of Bounds, OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: The issue was addressed with improved memory handling.\n\nWebKit Bugzilla: 313452\n\nCVE-2026-43795: wwwlk\n\nWebKit Bugzilla: 318348\n\nCVE-2026-65338: OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: The issue was addressed with improved memory handling.\n\nWebKit Bugzilla: 318405\n\nCVE-2026-65341: Henock Habte\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A memory corruption vulnerability was addressed with improved locking.\n\nWebKit Bugzilla: 321480\n\nCVE-2026-64782: Charles Kern, Seonwook Kim, Shubham Chaskar, lattice, Josef Korbel\n\nEntry updated September 14, 2026\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: The issue was addressed with improved input validation.\n\nWebKit Bugzilla: 321484\n\nCVE-2026-64781: Thomas Guillem\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nWebKit Bugzilla: 321517\n\nCVE-2026-65351: Niels Hofmans\n\nWebKit Bugzilla: 316996\n\nCVE-2026-65340: Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Josef Korbel (Citadelo)\n\nWebKit Bugzilla: 317142\n\nCVE-2026-65337: OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317349\n\nCVE-2026-65336: Josef Korbel\n\nWebKit Bugzilla: 316723\n\nCVE-2026-65335: OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317603\n\nCVE-2026-65333: OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317450\n\nCVE-2026-65332: Kun Peeks (@SwayZGl1tZyyy), OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317611\n\nCVE-2026-65331: OpenAI Codex Security - Amy Burnett\n\nEntry updated September 14, 2026\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process crash\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 316347\n\nCVE-2026-64715: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nWebKit Bugzilla: 316918\n\nCVE-2026-64780: OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A memory corruption issue was addressed with improved state management.\n\nWebKit Bugzilla: 316791\n\nCVE-2026-65334: OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nWebKit Bugzilla: 317317\n\nCVE-2026-43794: Dung Do (@_piers2) of Calif.io\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process termination\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 313703\n\nCVE-2026-64787: 杉山 壮太, Shubham Chaskar\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A website may be able to determine a user's IP address with Private Relay turned on\n\nDescription: An information di","summary":"Apple's iOS 26.6.1 and iPadOS 26.6.1 security notes list dozens of CVEs across Audio, ImageIO, Kernel, WebKit, Telephony and other components. Several entries say an attacker may run code or crash the device through crafted images or web content, and the advisory names CVE-2026-65352 only as the page identifier.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"apple ipados","fixed":["26.6.1"],"affected":"< 26.6.1","ecosystem":"vendor"},{"name":"apple iphone os","fixed":["26.6.1"],"affected":"< 26.6.1","ecosystem":"vendor"},{"name":"apple macos","fixed":["26.6.2"],"affected":"< 26.6.2","ecosystem":"vendor"},{"name":"apple visionos","fixed":["26.6.1"],"affected":"< 26.6.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apple","ios","ipad","ipados","iphone","vendor","vendor-advisory"],"not_affected_if":["already-on-later-version"],"how_to_check":"- Open Settings > General > About on the iPhone or iPad and read the iOS or iPadOS version\n- Compare against `26.6.1` or later from Apple's advisory","fix":null,"status":"open","published_at":"2026-09-14T00:00:00+00:00","first_seen_at":"2026-11-12T20:57:53+00:00","triaged_at":"2026-11-12T21:04:14+00:00","updated_at":"2026-11-12T21:11:28+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-12T21:04:14Z","model":"claude-haiku-5-5","output":{"fix":"- iPhone and iPad: `26.6.1` or later, per Apple's security content page","reach":"internet","title":"Apple iOS 26.6.1: many fixes, including code execution via image processing","impact":"high","summary":"Apple's iOS 26.6.1 and iPadOS 26.6.1 security notes list dozens of CVEs across Audio, ImageIO, Kernel, WebKit, Telephony and other components. Several entries say an attacker may run code or crash the device through crafted images or web content, and the advisory names CVE-2026-65352 only as the page identifier.","audience":"everyone","category":"vendor","nicknames":[],"who_cares":["ios","ipados","iphone","ipad"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs code on the device through crafted images or web content","analyst_note":"The sources list many CVEs, but this entry's own CVE-2026-65352 is not described; confirm which entry, if any, maps to it at https://support.apple.com/en-us/148282","how_to_check":"- Open Settings > General > About on the iPhone or iPad and read the iOS or iPadOS version\n- Compare against `26.6.1` or later from Apple's advisory","plain_action":"Update your iPhone or iPad to iOS 26.6.1 or iPadOS 26.6.1 via Settings > General > Software Update.","product_name":"","needs_analyst":true,"not_affected_if":["already-on-later-version"],"who_is_affected":"unknown","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.001234,"input_tokens":9529,"output_tokens":563,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A,80B,270C,359C,430C,497C,567C,661C '-64736':662C '-64788':568C '-65339':271C '-65346':498C '-65347':431C '-65352':13A,16A,81B '-65355':360C '11':212C,225C,292C,305C,372C,385C,439C,452C,509C,522C,594C,607C,675C,688C '12.9':217C,297C,377C,444C,514C,599C,680C '14':285C,366C,588C,669C '17':206C '1st':227C,307C,387C,454C,524C,609C,690C '2026':207C,286C,367C,589C,670C '26.6.1':38B,41B,93C,96C,105C,108C,135C,138C,200C,203C '27':122C,125C '3ndy1':575C,576C '3rd':219C,233C,299C,313C,379C,393C,446C,460C,516C,530C,601C,615C,682C,696C '5th':245C,325C,405C,472C,542C,627C,708C '8th':238C,318C,398C,465C,535C,620C,701C 'abl':254C,334C,636C,718C 'access':652C 'across':48B 'add':364C,667C 'address':6A,265C,341C,353C,425C,491C,561C,655C 'advisori':34B,77B 'air':232C,312C,392C,459C,529C,614C,695C 'anonym':570C 'app':251C,633C 'appl':26B,35B,97C,140C,147C,173C,177C,195C 'apple':17A,19A,22A,24A 'arbitrari':483C 'arjanit':583C 'attack':61B,715C 'audio':49B,208C 'august':205C 'authent':287C 'avail':118C,166C,209C,289C,369C,436C,506C,591C,672C 'beta':126C 'bound':651C,658C 'calap':273C 'caus':638C,720C 'check':268C,428C,659C 'code':64B,362C,484C 'compon':56B 'confirm':153C 'content':74B,90C,102C,132C,551C 'corrupt':556C,643C 'craft':70B,549C 'crash':66B 'custom':145C 'cve':11A,14A,79B,184C,269C,358C,429C,496C,566C,660C 'cve-id':183C 'cves':47B 'dautov':664C 'dbg.re':275C 'deliv':111C 'denial':418C 'denial-of-servic':417C 'describ':129C 'descript':260C,347C,421C,486C,557C,646C 'determin':336C 'devic':68B 'disclos':150C 'disclosur':3A,350C 'discuss':151C 'document':128C,179C 'doesn':148C 'dozen':45B 'entri':58B,282C,363C,585C,666C 'execut':485C 'f00l':572C 'first':116C 'fix':113C 'generat':220C,228C,234C,239C,246C,300C,308C,314C,319C,326C,380C,388C,394C,399C,406C,447C,455C,461C,466C,473C,517C,525C,531C,536C,543C,602C,610C,616C,621C,628C,683C,691C,697C,702C,709C 'geonha':432C 'handl':565C 'hxr1':665C 'id':185C 'identifi':86B 'imag':71B,412C,479C 'imageio':50B,368C,435C 'impact':249C,329C,409C,476C,546C,631C,712C 'improv':8A,267C,355C,427C,493C,563C,657C 'inch':218C,226C,298C,306C,378C,386C,445C,453C,515C,523C,600C,608C,681C,689C 'inform':2A,190C,259C,349C 'input':494C 'integ':488C 'investig':158C 'io':27B,37B,92C,104C,121C,134C,199C 'iogpufamili':505C 'iomobileframebuff':590C 'ip':340C 'ipad':28B,215C,223C,231C,237C,243C,295C,303C,311C,317C,323C,375C,383C,391C,397C,403C,442C,450C,458C,464C,470C,512C,520C,528C,534C,540C,597C,605C,613C,619C,625C,678C,686C,694C,700C,706C 'ipado':29B,40B,95C,107C,124C,137C,202C 'ipados':18A 'iphon':30B,211C,291C,371C,438C,508C,593C,674C 'iphone':20A 'issu':4A,155C,263C,351C,423C,559C,653C 'isufi':584C 'kernel':51B,644C,671C 'later':214C,222C,230C,236C,241C,248C,294C,302C,310C,316C,321C,328C,374C,382C,390C,396C,401C,408C,441C,449C,457C,463C,468C,475C,511C,519C,527C,533C,538C,545C,596C,604C,612C,618C,623C,630C,677C,685C,693C,699C,704C,711C 'lead':414C,481C,553C 'leak':256C 'lee':433C 'leegn4a':434C 'lin':579C 'list':44B,170C 'logic':262C 'macos':23A 'made':117C 'malici':548C 'manag':10A,357C 'may':62B,252C,332C,413C,480C,552C,634C,716C 'memori':555C,564C,645C 'meta':276C,499C 'minghao':578C 'mini':244C,324C,404C,471C,541C,626C,707C 'mustafa':272C 'name':78B 'nik':280C,503C 'note':43B 'occur':160C 'ordinal0':274C 'os':21A 'out-of-bound':648C 'overflow':489C 'page':85B,176C,198C 'patch':162C 'possibl':187C 'pppf00l':573C 'privat':343C 'pro':216C,224C,296C,304C,376C,384C,443C,451C,513C,521C,598C,606C,679C,687C 'process':410C,477C,547C 'product':196C 'protect':146C 'recent':167C 'red':277C,500C 'refer':180C 'relay':344C 'releas':164C,168C,175C,204C 'remot':714C 'research':571C 'run':63B 'ruslan':663C 'say':59B 'secur':42B,89C,101C,112C,131C,141C,154C,174C,178C,192C,197C 'see':193C 'sensit':257C 'septemb':284C,365C,587C,668C 'servic':288C,420C 'sever':57B 'state':9A,356C 'support':98C 'system':640C,722C 'team':278C,501C 'telephoni':53B 'termin':641C,723C 'tsytsarkin':281C,504C 'turn':345C 'unexpect':639C,721C 'updat':110C,142C,283C,586C 'user':258C,338C 'valid':495C 'vendor':31B,33B 'vendor-advisori':32B 'visionos':25A 'vulner':181C 'web':73B,550C 'webkit':52B 'websit':331C 'x':279C,502C 'xint':361C 'y1nkoc':580C '云散花折':582C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":"Update your iPhone or iPad to iOS 26.6.1 or iPadOS 26.6.1 via Settings > General > Software Update.","pkeys":["appleipados","appleiphoneos","applemacos","applevisionos","ipados","iphoneos","macos","visionos"],"ptokens":["apple","ipados","iphone","macos","os","visionos"],"labels":["apple","ios","ipad","ipados","iphone","medium","vendor","vendoradvisory"],"campaign_type":null,"search_a":"'-2026':12A,15A '-65352':13A,16A 'address':6A 'apple':17A,19A,22A,24A 'cve':11A,14A 'disclosur':3A 'improv':8A 'inform':2A 'ipados':18A 'iphone':20A 'issu':4A 'macos':23A 'manag':10A 'os':21A 'state':9A 'visionos':25A","search_b":"'-2026':80B '-65352':81B '26.6.1':38B,41B 'across':48B 'advisori':34B,77B 'appl':26B,35B 'attack':61B 'audio':49B 'code':64B 'compon':56B 'content':74B 'craft':70B 'crash':66B 'cve':79B 'cves':47B 'devic':68B 'dozen':45B 'entri':58B 'identifi':86B 'imag':71B 'imageio':50B 'io':27B,37B 'ipad':28B 'ipado':29B,40B 'iphon':30B 'kernel':51B 'list':44B 'may':62B 'name':78B 'note':43B 'page':85B 'run':63B 'say':59B 'secur':42B 'sever':57B 'telephoni':53B 'vendor':31B,33B 'vendor-advisori':32B 'web':73B 'webkit':52B","search_c":"'-2026':270C,359C,430C,497C,567C,661C '-64736':662C '-64788':568C '-65339':271C '-65346':498C '-65347':431C '-65355':360C '11':212C,225C,292C,305C,372C,385C,439C,452C,509C,522C,594C,607C,675C,688C '12.9':217C,297C,377C,444C,514C,599C,680C '14':285C,366C,588C,669C '17':206C '1st':227C,307C,387C,454C,524C,609C,690C '2026':207C,286C,367C,589C,670C '26.6.1':93C,96C,105C,108C,135C,138C,200C,203C '27':122C,125C '3ndy1':575C,576C '3rd':219C,233C,299C,313C,379C,393C,446C,460C,516C,530C,601C,615C,682C,696C '5th':245C,325C,405C,472C,542C,627C,708C '8th':238C,318C,398C,465C,535C,620C,701C 'abl':254C,334C,636C,718C 'access':652C 'add':364C,667C 'address':265C,341C,353C,425C,491C,561C,655C 'air':232C,312C,392C,459C,529C,614C,695C 'anonym':570C 'app':251C,633C 'appl':97C,140C,147C,173C,177C,195C 'arbitrari':483C 'arjanit':583C 'attack':715C 'audio':208C 'august':205C 'authent':287C 'avail':118C,166C,209C,289C,369C,436C,506C,591C,672C 'beta':126C 'bound':651C,658C 'calap':273C 'caus':638C,720C 'check':268C,428C,659C 'code':362C,484C 'confirm':153C 'content':90C,102C,132C,551C 'corrupt':556C,643C 'craft':549C 'custom':145C 'cve':184C,269C,358C,429C,496C,566C,660C 'cve-id':183C 'dautov':664C 'dbg.re':275C 'deliv':111C 'denial':418C 'denial-of-servic':417C 'describ':129C 'descript':260C,347C,421C,486C,557C,646C 'determin':336C 'disclos':150C 'disclosur':350C 'discuss':151C 'document':128C,179C 'doesn':148C 'entri':282C,363C,585C,666C 'execut':485C 'f00l':572C 'first':116C 'fix':113C 'generat':220C,228C,234C,239C,246C,300C,308C,314C,319C,326C,380C,388C,394C,399C,406C,447C,455C,461C,466C,473C,517C,525C,531C,536C,543C,602C,610C,616C,621C,628C,683C,691C,697C,702C,709C 'geonha':432C 'handl':565C 'hxr1':665C 'id':185C 'imag':412C,479C 'imageio':368C,435C 'impact':249C,329C,409C,476C,546C,631C,712C 'improv':267C,355C,427C,493C,563C,657C 'inch':218C,226C,298C,306C,378C,386C,445C,453C,515C,523C,600C,608C,681C,689C 'inform':190C,259C,349C 'input':494C 'integ':488C 'investig':158C 'io':92C,104C,121C,134C,199C 'iogpufamili':505C 'iomobileframebuff':590C 'ip':340C 'ipad':215C,223C,231C,237C,243C,295C,303C,311C,317C,323C,375C,383C,391C,397C,403C,442C,450C,458C,464C,470C,512C,520C,528C,534C,540C,597C,605C,613C,619C,625C,678C,686C,694C,700C,706C 'ipado':95C,107C,124C,137C,202C 'iphon':211C,291C,371C,438C,508C,593C,674C 'issu':155C,263C,351C,423C,559C,653C 'isufi':584C 'kernel':644C,671C 'later':214C,222C,230C,236C,241C,248C,294C,302C,310C,316C,321C,328C,374C,382C,390C,396C,401C,408C,441C,449C,457C,463C,468C,475C,511C,519C,527C,533C,538C,545C,596C,604C,612C,618C,623C,630C,677C,685C,693C,699C,704C,711C 'lead':414C,481C,553C 'leak':256C 'lee':433C 'leegn4a':434C 'lin':579C 'list':170C 'logic':262C 'made':117C 'malici':548C 'manag':357C 'may':252C,332C,413C,480C,552C,634C,716C 'memori':555C,564C,645C 'meta':276C,499C 'minghao':578C 'mini':244C,324C,404C,471C,541C,626C,707C 'mustafa':272C 'nik':280C,503C 'occur':160C 'ordinal0':274C 'out-of-bound':648C 'overflow':489C 'page':176C,198C 'patch':162C 'possibl':187C 'pppf00l':573C 'privat':343C 'pro':216C,224C,296C,304C,376C,384C,443C,451C,513C,521C,598C,606C,679C,687C 'process':410C,477C,547C 'product':196C 'protect':146C 'recent':167C 'red':277C,500C 'refer':180C 'relay':344C 'releas':164C,168C,175C,204C 'remot':714C 'research':571C 'ruslan':663C 'secur':89C,101C,112C,131C,141C,154C,174C,178C,192C,197C 'see':193C 'sensit':257C 'septemb':284C,365C,587C,668C 'servic':288C,420C 'state':356C 'support':98C 'system':640C,722C 'team':278C,501C 'termin':641C,723C 'tsytsarkin':281C,504C 'turn':345C 'unexpect':639C,721C 'updat':110C,142C,283C,586C 'user':258C,338C 'valid':495C 'vulner':181C 'web':550C 'websit':331C 'x':279C,502C 'xint':361C 'y1nkoc':580C '云散花折':582C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-14T00:00:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"lab","external_id":"https://support.apple.com/en-us/148282#CVE-2026-65352","url":"https://support.apple.com/en-us/148282","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-12T20:57:53+00:00","fetched_at":"2026-11-12T20:57:53+00:00","note":"Apple: About the security content of iOS 26.6.1 and iPadOS 26.6.1 - Apple Support"},{"source":"lab","external_id":"https://support.apple.com/en-us/148281#CVE-2026-65352","url":"https://support.apple.com/en-us/148281","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-12T20:58:01+00:00","fetched_at":"2026-11-12T20:58:01+00:00","note":"Apple: About the security content of macOS Tahoe 26.6.2 - Apple Support"},{"source":"lab","external_id":"https://support.apple.com/en-us/148353#CVE-2026-65352","url":"https://support.apple.com/en-us/148353","severity":null,"published_at":"2026-09-14T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-11-12T20:58:01+00:00","fetched_at":"2026-11-12T20:58:01+00:00","note":"Apple: About the security content of visionOS 26.6.1 - Apple Support"},{"source":"nvd","external_id":"CVE-2026-65352","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65352","severity":null,"published_at":"2026-09-14T21:17:20+00:00","modified_at":"2026-09-15T19:29:35+00:00","first_seen_at":"2026-11-12T21:11:28+00:00","fetched_at":"2026-11-12T21:11:28+00:00","note":null}],"documents":[{"id":14249,"url":"https://support.apple.com/en-us/148281","title":"Apple: About the security content of macOS Tahoe 26.6.2 - Apple Support","kind":"vendor","source":"nvd","publisher":"vendor","text":"About the security content of macOS Tahoe 26.6.2 - Apple Support\n\n# About the security content of macOS Tahoe 26.6.2\n\nThis update delivers security fixes that were first made available in the macOS Golden Gate 27 beta. This document describes the security content of macOS Tahoe 26.6.2.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## macOS Tahoe 26.6.2\n\nReleased August 17, 2026\n\n### Audio\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to leak sensitive user information\n\nDescription: A logic issue was addressed with improved checks.\n\nCVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik Tsytsarkin\n\nEntry updated September 14, 2026\n\n### Authentication Services\n\nAvailable for: macOS Tahoe\n\nImpact: A website may be able to determine a user's IP address with Private Relay turned on\n\nDescription: An information disclosure issue was addressed with improved state management.\n\nCVE-2026-65355: Xint Code\n\nEntry added September 14, 2026\n\n### ImageIO\n\nAvailable for: macOS Tahoe\n\nImpact: Processing an image may lead to a denial-of-service\n\nDescription: The issue was addressed with improved checks.\n\nCVE-2026-65347: Geonha Lee (@leegn4a)\n\n### ImageIO\n\nAvailable for: macOS Tahoe\n\nImpact: Processing an image may lead to arbitrary code execution\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-65346: Meta Red Team X - Nik Tsytsarkin\n\n### IOGPUFamily\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64788: an anonymous researcher, f00l (@PPPF00L) and 3ndy1(@_3ndy1) and Minghao Lin@Y1nkoc and 云散花折, Arjanit Isufi\n\nEntry updated September 14, 2026\n\n### IOMobileFrameBuffer\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds access issue was addressed with improved bounds checking.\n\nCVE-2026-64736: Ruslan Dautov, hxr1\n\nEntry added September 14, 2026\n\n### Kernel\n\nImpact: A remote attacker may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-65343: Drinor Selmanaj (Sentry), Surya Narayan Kushwaha\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\nCVE-2026-65349: an anonymous researcher\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-65330: Ashish Kunwar, Mikhail Lozhnikov of Positive Technologies, Bhaswanth Chigurupati, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nCVE-2026-28935: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nEntry updated September 14, 2026\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: An out-of-bounds access issue was addressed with improved bounds checking.\n\nWebKit Bugzilla: 317632\n\nCVE-2026-64784: Janggoon Lee of Out of Bounds, OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: The issue was addressed with improved memory handling.\n\nWebKit Bugzilla: 313452\n\nCVE-2026-43795: wwwlk\n\nWebKit Bugzilla: 318348\n\nCVE-2026-65338: OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nWebKit Bugzilla: 318405\n\nCVE-2026-65341: Henock Habte\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A memory corruption vulnerability was addressed with improved locking.\n\nWebKit Bugzilla: 321480\n\nCVE-2026-64782: Charles Kern, Shubham Chaskar, Seonwook Kim, lattice, Josef Korbel\n\nEntry updated September 14, 2026\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nWebKit Bugzilla: 321484\n\nCVE-2026-64781: Thomas Guillem\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nWebKit Bugzilla: 321517\n\nCVE-2026-65351: Niels Hofmans\n\nWebKit Bugzilla: 316996\n\nCVE-2026-65340: Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Josef Korbel (Citadelo)\n\nWebKit Bugzilla: 317142\n\nCVE-2026-65337: OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317349\n\nCVE-2026-65336: Josef Korbel\n\nWebKit Bugzilla: 316723\n\nCVE-2026-65335: OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317603\n\nCVE-2026-65333: OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317450\n\nCVE-2026-65332: Kun Peeks (@SwayZGl1tZyyy), OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317611\n\nCVE-2026-65331: OpenAI Codex Security - Amy Burnett\n\nEntry updated September 14, 2026\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process crash\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 316347\n\nCVE-2026-64715: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nWebKit Bugzilla: 316918\n\nCVE-2026-64780: OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nWebKit Bugzilla: 316791\n\nCVE-2026-65334: OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nWebKit Bugzilla: 317317\n\nCVE-2026-43794: Dung Do (@_piers2) of Calif.io\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process termination\n\nWebKit Bugzilla: 313703\n\nCVE-2026-64787: 杉山 壮太, Shubham Chaskar\n\n### WebKit\n\nImpact: A website may be able to determine a user's IP address with Private Relay turned on\n\nWebKit Bugzilla: 321065\n\nCVE-2026-65352: Talal Haj Bakry and Tommy Mysk of Mysk Inc. @mysk_co\n\nEntry added September 14, 2026\n\n### WebKit History\n\nImpact: Visiting a maliciously crafted website may leak sensitive data\n\nWebKit Bugzilla: 322124\n\nCVE-2026-64778: Mohit Negi\n\n### WebKit Storage\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A memory corruption vulnerability was addressed with improved locking.\n\nWebKit Bugzilla: 321485\n\nCVE-2026-64779: Shubham Chaskar, Tommy DeVoss from Braze Security Team (@thedawgyg)\n\n### WebRTC\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-65391: Myungyong Lee\n\nEntry added September 14, 2026\n\n### WebRTC\n\nAvailable for: macOS Tahoe\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-65390: Kwak Kiyong (@Pwnkai23), Song Nuri\n\nEntry added September 14, 2026\n\n## Additional recognition\n\n### Compression\n\nWe would like to acknowledge Tommy DeVoss from Braze Security Team (@thedawgyg) for their assistance.\n\n### libcryptex\n\nWe would like to acknowledge Ashish Kunwar for their assistance.\n\n### WebKit\n\nWe would like to acknowledge Henock Habte for their assistance.\n\nInformation about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. Contact the vendor for additional information.\n\n Published Date: September 14, 2026","published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":138482,"url":"https://support.apple.com/en-us/148353","title":"Apple: About the security content of visionOS 26.6.1 - Apple Support","kind":"advisory","source":"lab","publisher":"vendor","text":"About the security content of visionOS 26.6.1 - Apple Support\n\n# About the security content of visionOS 26.6.1\n\nThis document describes the security content of visionOS 26.6.1.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## visionOS 26.6.1\n\nReleased August 17, 2026\n\n### Authentication Services\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: A website may be able to determine a user's IP address with Private Relay turned on\n\nDescription: An information disclosure issue was addressed with improved state management.\n\nCVE-2026-65355: Xint Code\n\n### WebKit\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: A website may be able to determine a user's IP address with Private Relay turned on\n\nDescription: An information disclosure issue was addressed with improved state management.\n\nWebKit Bugzilla: 321065\n\nCVE-2026-65352: Talal Haj Bakry and Tommy Mysk of Mysk Inc. @mysk_co\n\nInformation about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. Contact the vendor for additional information.\n\n Published Date: September 14, 2026","published_at":"2026-09-14T00:00:00+00:00","relation":"advisory","confidence":null,"note":null},{"id":14250,"url":"https://support.apple.com/en-us/148282","title":"Apple: About the security content of iOS 26.6.1 and iPadOS 26.6.1 - Apple Support","kind":"vendor","source":"nvd","publisher":"vendor","text":"About the security content of iOS 26.6.1 and iPadOS 26.6.1 - Apple Support\n\n# About the security content of iOS 26.6.1 and iPadOS 26.6.1\n\nThis update delivers security fixes that were first made available in the iOS 27 and iPadOS 27 betas. This document describes the security content of iOS 26.6.1 and iPadOS 26.6.1.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## iOS 26.6.1 and iPadOS 26.6.1\n\nReleased August 17, 2026\n\n### Audio\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to leak sensitive user information\n\nDescription: A logic issue was addressed with improved checks.\n\nCVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik Tsytsarkin\n\nEntry updated September 14, 2026\n\n### Authentication Services\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A website may be able to determine a user's IP address with Private Relay turned on\n\nDescription: An information disclosure issue was addressed with improved state management.\n\nCVE-2026-65355: Xint Code\n\nEntry added September 14, 2026\n\n### ImageIO\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing an image may lead to a denial-of-service\n\nDescription: The issue was addressed with improved checks.\n\nCVE-2026-65347: Geonha Lee (@leegn4a)\n\n### ImageIO\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing an image may lead to arbitrary code execution\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-65346: Meta Red Team X - Nik Tsytsarkin\n\n### IOGPUFamily\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64788: an anonymous researcher, f00l (@PPPF00L) and 3ndy1(@_3ndy1) and Minghao Lin@Y1nkoc and 云散花折, Arjanit Isufi\n\nEntry updated September 14, 2026\n\n### IOMobileFrameBuffer\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds access issue was addressed with improved bounds checking.\n\nCVE-2026-64736: Ruslan Dautov, hxr1\n\nEntry added September 14, 2026\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A remote attacker may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-65343: Drinor Selmanaj (Sentry), Surya Narayan Kushwaha\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\nCVE-2026-65349: an anonymous researcher\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-65330: Ashish Kunwar, Mikhail Lozhnikov of Positive Technologies, Bhaswanth Chigurupati, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nCVE-2026-28935: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nEntry updated September 14, 2026\n\n### Telephony\n\nAvailable for: iPhone 11 and later\n\nImpact: An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic\n\nDescription: An authentication issue was addressed with improved state management.\n\nCVE-2026-65329: Bedran Karakoc, Tobias Funke, Jacopo Clark, Katharina Kohls of Ruhr University Bochum\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: An out-of-bounds access issue was addressed with improved bounds checking.\n\nWebKit Bugzilla: 317632\n\nCVE-2026-64784: Janggoon Lee of Out of Bounds, OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: The issue was addressed with improved memory handling.\n\nWebKit Bugzilla: 313452\n\nCVE-2026-43795: wwwlk\n\nWebKit Bugzilla: 318348\n\nCVE-2026-65338: OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: The issue was addressed with improved memory handling.\n\nWebKit Bugzilla: 318405\n\nCVE-2026-65341: Henock Habte\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A memory corruption vulnerability was addressed with improved locking.\n\nWebKit Bugzilla: 321480\n\nCVE-2026-64782: Charles Kern, Seonwook Kim, Shubham Chaskar, lattice, Josef Korbel\n\nEntry updated September 14, 2026\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: The issue was addressed with improved input validation.\n\nWebKit Bugzilla: 321484\n\nCVE-2026-64781: Thomas Guillem\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nWebKit Bugzilla: 321517\n\nCVE-2026-65351: Niels Hofmans\n\nWebKit Bugzilla: 316996\n\nCVE-2026-65340: Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Josef Korbel (Citadelo)\n\nWebKit Bugzilla: 317142\n\nCVE-2026-65337: OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317349\n\nCVE-2026-65336: Josef Korbel\n\nWebKit Bugzilla: 316723\n\nCVE-2026-65335: OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317603\n\nCVE-2026-65333: OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317450\n\nCVE-2026-65332: Kun Peeks (@SwayZGl1tZyyy), OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317611\n\nCVE-2026-65331: OpenAI Codex Security - Amy Burnett\n\nEntry updated September 14, 2026\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process crash\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 316347\n\nCVE-2026-64715: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nWebKit Bugzilla: 316918\n\nCVE-2026-64780: OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A memory corruption issue was addressed with improved state management.\n\nWebKit Bugzilla: 316791\n\nCVE-2026-65334: OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nWebKit Bugzilla: 317317\n\nCVE-2026-43794: Dung Do (@_piers2) of Calif.io\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process termination\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 313703\n\nCVE-2026-64787: 杉山 壮太, Shubham Chaskar\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A website may be able to determine a user's IP address with Private Relay turned on\n\nDescription: An information disclosure issue was addressed with improved state management.\n\nWebKit Bugzilla: 321065\n\nCVE-2026-65352: Talal Haj Bakry and Tommy Mysk of Mysk Inc. @mysk_co\n\n### WebKit History\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Visiting a maliciously crafted website may leak sensitive data\n\nDescription: The issue was addressed with improved checks.\n\nWebKit Bugzilla: 322124\n\nCVE-2026-64778: Mohit Negi\n\n### WebKit Storage\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A memory corruption vulnerability was addressed with improved locking.\n\nWebKit Bugzilla: 321485\n\nCVE-2026-64779: Shubham Chaskar, Tommy DeVoss from Braze Security Team (@thedawgyg)\n\n### WebRTC\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-65391: Myungyong Lee\n\nEntry added September 14, 2026\n\n### WebRTC\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-65390: Kwak Kiyong (@Pwnkai23), Song Nuri\n\nEntry added September 14, 2026\n\n## Additional recognition\n\n### Compression\n\nWe would like to acknowledge Tommy DeVoss from Braze Security Team (@thedawgyg) for their assistance.\n\n### libcryptex\n\nWe would like to acknowledge Ashish Kunwar for their assistance.\n\n### WebKit\n\nWe would like to acknowledge Henock Habte for their assistance.\n\n Published Date: September 14, 2026","published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":14249,"url":"https://support.apple.com/en-us/148281","title":"Apple: About the security content of macOS Tahoe 26.6.2 - Apple Support","kind":"vendor","source":"nvd","publisher":"vendor","text":"About the security content of macOS Tahoe 26.6.2 - Apple Support\n\n# About the security content of macOS Tahoe 26.6.2\n\nThis update delivers security fixes that were first made available in the macOS Golden Gate 27 beta. This document describes the security content of macOS Tahoe 26.6.2.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## macOS Tahoe 26.6.2\n\nReleased August 17, 2026\n\n### Audio\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to leak sensitive user information\n\nDescription: A logic issue was addressed with improved checks.\n\nCVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik Tsytsarkin\n\nEntry updated September 14, 2026\n\n### Authentication Services\n\nAvailable for: macOS Tahoe\n\nImpact: A website may be able to determine a user's IP address with Private Relay turned on\n\nDescription: An information disclosure issue was addressed with improved state management.\n\nCVE-2026-65355: Xint Code\n\nEntry added September 14, 2026\n\n### ImageIO\n\nAvailable for: macOS Tahoe\n\nImpact: Processing an image may lead to a denial-of-service\n\nDescription: The issue was addressed with improved checks.\n\nCVE-2026-65347: Geonha Lee (@leegn4a)\n\n### ImageIO\n\nAvailable for: macOS Tahoe\n\nImpact: Processing an image may lead to arbitrary code execution\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-65346: Meta Red Team X - Nik Tsytsarkin\n\n### IOGPUFamily\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64788: an anonymous researcher, f00l (@PPPF00L) and 3ndy1(@_3ndy1) and Minghao Lin@Y1nkoc and 云散花折, Arjanit Isufi\n\nEntry updated September 14, 2026\n\n### IOMobileFrameBuffer\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds access issue was addressed with improved bounds checking.\n\nCVE-2026-64736: Ruslan Dautov, hxr1\n\nEntry added September 14, 2026\n\n### Kernel\n\nImpact: A remote attacker may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-65343: Drinor Selmanaj (Sentry), Surya Narayan Kushwaha\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\nCVE-2026-65349: an anonymous researcher\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-65330: Ashish Kunwar, Mikhail Lozhnikov of Positive Technologies, Bhaswanth Chigurupati, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nCVE-2026-28935: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nEntry updated September 14, 2026\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: An out-of-bounds access issue was addressed with improved bounds checking.\n\nWebKit Bugzilla: 317632\n\nCVE-2026-64784: Janggoon Lee of Out of Bounds, OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: The issue was addressed with improved memory handling.\n\nWebKit Bugzilla: 313452\n\nCVE-2026-43795: wwwlk\n\nWebKit Bugzilla: 318348\n\nCVE-2026-65338: OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nWebKit Bugzilla: 318405\n\nCVE-2026-65341: Henock Habte\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A memory corruption vulnerability was addressed with improved locking.\n\nWebKit Bugzilla: 321480\n\nCVE-2026-64782: Charles Kern, Shubham Chaskar, Seonwook Kim, lattice, Josef Korbel\n\nEntry updated September 14, 2026\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nWebKit Bugzilla: 321484\n\nCVE-2026-64781: Thomas Guillem\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nWebKit Bugzilla: 321517\n\nCVE-2026-65351: Niels Hofmans\n\nWebKit Bugzilla: 316996\n\nCVE-2026-65340: Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Josef Korbel (Citadelo)\n\nWebKit Bugzilla: 317142\n\nCVE-2026-65337: OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317349\n\nCVE-2026-65336: Josef Korbel\n\nWebKit Bugzilla: 316723\n\nCVE-2026-65335: OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317603\n\nCVE-2026-65333: OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317450\n\nCVE-2026-65332: Kun Peeks (@SwayZGl1tZyyy), OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317611\n\nCVE-2026-65331: OpenAI Codex Security - Amy Burnett\n\nEntry updated September 14, 2026\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process crash\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 316347\n\nCVE-2026-64715: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nWebKit Bugzilla: 316918\n\nCVE-2026-64780: OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nWebKit Bugzilla: 316791\n\nCVE-2026-65334: OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nWebKit Bugzilla: 317317\n\nCVE-2026-43794: Dung Do (@_piers2) of Calif.io\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process termination\n\nWebKit Bugzilla: 313703\n\nCVE-2026-64787: 杉山 壮太, Shubham Chaskar\n\n### WebKit\n\nImpact: A website may be able to determine a user's IP address with Private Relay turned on\n\nWebKit Bugzilla: 321065\n\nCVE-2026-65352: Talal Haj Bakry and Tommy Mysk of Mysk Inc. @mysk_co\n\nEntry added September 14, 2026\n\n### WebKit History\n\nImpact: Visiting a maliciously crafted website may leak sensitive data\n\nWebKit Bugzilla: 322124\n\nCVE-2026-64778: Mohit Negi\n\n### WebKit Storage\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A memory corruption vulnerability was addressed with improved locking.\n\nWebKit Bugzilla: 321485\n\nCVE-2026-64779: Shubham Chaskar, Tommy DeVoss from Braze Security Team (@thedawgyg)\n\n### WebRTC\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-65391: Myungyong Lee\n\nEntry added September 14, 2026\n\n### WebRTC\n\nAvailable for: macOS Tahoe\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-65390: Kwak Kiyong (@Pwnkai23), Song Nuri\n\nEntry added September 14, 2026\n\n## Additional recognition\n\n### Compression\n\nWe would like to acknowledge Tommy DeVoss from Braze Security Team (@thedawgyg) for their assistance.\n\n### libcryptex\n\nWe would like to acknowledge Ashish Kunwar for their assistance.\n\n### WebKit\n\nWe would like to acknowledge Henock Habte for their assistance.\n\nInformation about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. Contact the vendor for additional information.\n\n Published Date: September 14, 2026","published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: support.apple.com"},{"id":14250,"url":"https://support.apple.com/en-us/148282","title":"Apple: About the security content of iOS 26.6.1 and iPadOS 26.6.1 - Apple Support","kind":"vendor","source":"nvd","publisher":"vendor","text":"About the security content of iOS 26.6.1 and iPadOS 26.6.1 - Apple Support\n\n# About the security content of iOS 26.6.1 and iPadOS 26.6.1\n\nThis update delivers security fixes that were first made available in the iOS 27 and iPadOS 27 betas. This document describes the security content of iOS 26.6.1 and iPadOS 26.6.1.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## iOS 26.6.1 and iPadOS 26.6.1\n\nReleased August 17, 2026\n\n### Audio\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to leak sensitive user information\n\nDescription: A logic issue was addressed with improved checks.\n\nCVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik Tsytsarkin\n\nEntry updated September 14, 2026\n\n### Authentication Services\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A website may be able to determine a user's IP address with Private Relay turned on\n\nDescription: An information disclosure issue was addressed with improved state management.\n\nCVE-2026-65355: Xint Code\n\nEntry added September 14, 2026\n\n### ImageIO\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing an image may lead to a denial-of-service\n\nDescription: The issue was addressed with improved checks.\n\nCVE-2026-65347: Geonha Lee (@leegn4a)\n\n### ImageIO\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing an image may lead to arbitrary code execution\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-65346: Meta Red Team X - Nik Tsytsarkin\n\n### IOGPUFamily\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64788: an anonymous researcher, f00l (@PPPF00L) and 3ndy1(@_3ndy1) and Minghao Lin@Y1nkoc and 云散花折, Arjanit Isufi\n\nEntry updated September 14, 2026\n\n### IOMobileFrameBuffer\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds access issue was addressed with improved bounds checking.\n\nCVE-2026-64736: Ruslan Dautov, hxr1\n\nEntry added September 14, 2026\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A remote attacker may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-65343: Drinor Selmanaj (Sentry), Surya Narayan Kushwaha\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\nCVE-2026-65349: an anonymous researcher\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-65330: Ashish Kunwar, Mikhail Lozhnikov of Positive Technologies, Bhaswanth Chigurupati, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nCVE-2026-28935: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nEntry updated September 14, 2026\n\n### Telephony\n\nAvailable for: iPhone 11 and later\n\nImpact: An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic\n\nDescription: An authentication issue was addressed with improved state management.\n\nCVE-2026-65329: Bedran Karakoc, Tobias Funke, Jacopo Clark, Katharina Kohls of Ruhr University Bochum\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: An out-of-bounds access issue was addressed with improved bounds checking.\n\nWebKit Bugzilla: 317632\n\nCVE-2026-64784: Janggoon Lee of Out of Bounds, OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: The issue was addressed with improved memory handling.\n\nWebKit Bugzilla: 313452\n\nCVE-2026-43795: wwwlk\n\nWebKit Bugzilla: 318348\n\nCVE-2026-65338: OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: The issue was addressed with improved memory handling.\n\nWebKit Bugzilla: 318405\n\nCVE-2026-65341: Henock Habte\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A memory corruption vulnerability was addressed with improved locking.\n\nWebKit Bugzilla: 321480\n\nCVE-2026-64782: Charles Kern, Seonwook Kim, Shubham Chaskar, lattice, Josef Korbel\n\nEntry updated September 14, 2026\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: The issue was addressed with improved input validation.\n\nWebKit Bugzilla: 321484\n\nCVE-2026-64781: Thomas Guillem\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nWebKit Bugzilla: 321517\n\nCVE-2026-65351: Niels Hofmans\n\nWebKit Bugzilla: 316996\n\nCVE-2026-65340: Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Josef Korbel (Citadelo)\n\nWebKit Bugzilla: 317142\n\nCVE-2026-65337: OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317349\n\nCVE-2026-65336: Josef Korbel\n\nWebKit Bugzilla: 316723\n\nCVE-2026-65335: OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317603\n\nCVE-2026-65333: OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317450\n\nCVE-2026-65332: Kun Peeks (@SwayZGl1tZyyy), OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317611\n\nCVE-2026-65331: OpenAI Codex Security - Amy Burnett\n\nEntry updated September 14, 2026\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process crash\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 316347\n\nCVE-2026-64715: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nWebKit Bugzilla: 316918\n\nCVE-2026-64780: OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A memory corruption issue was addressed with improved state management.\n\nWebKit Bugzilla: 316791\n\nCVE-2026-65334: OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nWebKit Bugzilla: 317317\n\nCVE-2026-43794: Dung Do (@_piers2) of Calif.io\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process termination\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 313703\n\nCVE-2026-64787: 杉山 壮太, Shubham Chaskar\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A website may be able to determine a user's IP address with Private Relay turned on\n\nDescription: An information disclosure issue was addressed with improved state management.\n\nWebKit Bugzilla: 321065\n\nCVE-2026-65352: Talal Haj Bakry and Tommy Mysk of Mysk Inc. @mysk_co\n\n### WebKit History\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Visiting a maliciously crafted website may leak sensitive data\n\nDescription: The issue was addressed with improved checks.\n\nWebKit Bugzilla: 322124\n\nCVE-2026-64778: Mohit Negi\n\n### WebKit Storage\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A memory corruption vulnerability was addressed with improved locking.\n\nWebKit Bugzilla: 321485\n\nCVE-2026-64779: Shubham Chaskar, Tommy DeVoss from Braze Security Team (@thedawgyg)\n\n### WebRTC\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-65391: Myungyong Lee\n\nEntry added September 14, 2026\n\n### WebRTC\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-65390: Kwak Kiyong (@Pwnkai23), Song Nuri\n\nEntry added September 14, 2026\n\n## Additional recognition\n\n### Compression\n\nWe would like to acknowledge Tommy DeVoss from Braze Security Team (@thedawgyg) for their assistance.\n\n### libcryptex\n\nWe would like to acknowledge Ashish Kunwar for their assistance.\n\n### WebKit\n\nWe would like to acknowledge Henock Habte for their assistance.\n\n Published Date: September 14, 2026","published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: support.apple.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}