--- id: "CVE-2026-65352" page: "https://infrastack.ai/live/CVE-2026-65352" kind: "vulnerability" aliases: ["CVE-2026-65352"] title: "An information disclosure issue was addressed with improved state management" severity: "medium" cvss: 4.3 epss: null exploited: false status: "open" category: "vendor" products: [{"name": "apple ipados", "fixed": ["26.6.1"], "affected": "< 26.6.1", "ecosystem": "vendor"}, {"name": "apple iphone os", "fixed": ["26.6.1"], "affected": "< 26.6.1", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["26.6.2"], "affected": "< 26.6.2", "ecosystem": "vendor"}, {"name": "apple visionos", "fixed": ["26.6.1"], "affected": "< 26.6.1", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["apple", "ios", "ipad", "ipados", "iphone", "vendor", "vendor-advisory"] not_affected_if: ["already-on-later-version"] published_at: "2026-09-14T00:00:00+00:00" first_seen_at: "2026-11-12T20:57:53+00:00" updated_at: "2026-11-12T21:11:28+00:00" sources: [{"source": "lab", "url": "https://support.apple.com/en-us/148282", "first_seen_at": "2026-11-12T20:57:53+00:00"}, {"source": "lab", "url": "https://support.apple.com/en-us/148281", "first_seen_at": "2026-11-12T20:58:01+00:00"}, {"source": "lab", "url": "https://support.apple.com/en-us/148353", "first_seen_at": "2026-11-12T20:58:01+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65352", "first_seen_at": "2026-11-12T21:11:28+00:00"}] exploit_sources: [] --- # An information disclosure issue was addressed with improved state management Link for people: https://infrastack.ai/live/CVE-2026-65352 (this .md is for agents) Apple's iOS 26.6.1 and iPadOS 26.6.1 security notes list dozens of CVEs across Audio, ImageIO, Kernel, WebKit, Telephony and other components. Several entries say an attacker may run code or crash the device through crafted images or web content, and the advisory names CVE-2026-65352 only as the page identifier. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:apple ipados affected < 26.6.1 fixed 26.6.1 - vendor:apple iphone os affected < 26.6.1 fixed 26.6.1 - vendor:apple macos affected < 26.6.2 fixed 26.6.2 - vendor:apple visionos affected < 26.6.1 fixed 26.6.1 ## How to check - Open Settings > General > About on the iPhone or iPad and read the iOS or iPadOS version - Compare against `26.6.1` or later from Apple's advisory ## Timeline - 2026-11-12T20:57:53+00:00 lab https://support.apple.com/en-us/148282 — Apple: About the security content of iOS 26.6.1 and iPadOS 26.6.1 - Apple Support - 2026-11-12T20:58:01+00:00 lab https://support.apple.com/en-us/148281 — Apple: About the security content of macOS Tahoe 26.6.2 - Apple Support - 2026-11-12T20:58:01+00:00 lab https://support.apple.com/en-us/148353 — Apple: About the security content of visionOS 26.6.1 - Apple Support - 2026-11-12T21:11:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-65352 ## Documents - [advisory] Apple: About the security content of visionOS 26.6.1 - Apple Support https://support.apple.com/en-us/148353 - [advisory] Apple: About the security content of macOS Tahoe 26.6.2 - Apple Support https://support.apple.com/en-us/148281 - [advisory] Apple: About the security content of iOS 26.6.1 and iPadOS 26.6.1 - Apple Support https://support.apple.com/en-us/148282 - [mentions] Apple: About the security content of macOS Tahoe 26.6.2 - Apple Support https://support.apple.com/en-us/148281 - [mentions] Apple: About the security content of iOS 26.6.1 and iPadOS 26.6.1 - Apple Support https://support.apple.com/en-us/148282 ## From the sources About the security content of iOS 26.6.1 and iPadOS 26.6.1 - Apple Support # About the security content of iOS 26.6.1 and iPadOS 26.6.1 This update delivers security fixes that were first made available in the iOS 27 and iPadOS 27 betas. This document describes the security content of iOS 26.6.1 and iPadOS 26.6.1. ## About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page. Apple security documents reference vulnerabilities by CVE-ID when possible. For more information about security, see the Apple Product Security page. ## iOS 26.6.1 and iPadOS 26.6.1 Released August 17, 2026 ### Audio Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to leak sensitive user information Description: A logic issue was addressed with improved checks. CVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik Tsytsarkin Entry updated September 14, 2026 ### Authentication Services Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: A website may be able to determine a user's IP address with Private Relay turned on Description: An information disclosure issue was addressed with improved state management. CVE-2026-65355: Xint Code Entry added September 14, 2026 ### ImageIO Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing an image may lead to a denial-of-service Description: The issue was addressed with improved checks. CVE-2026-65347: Geonha Lee (@leegn4a) ### ImageIO Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing an image may lead to arbitrary code execution Description: An integer overflow was addressed with improved input validation. CVE-2026-65346: Meta Red Team X - Nik Tsytsarkin ### IOGPUFamily Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to memory corruption Description: The issue was addressed with improved memory handling. CVE-2026-64788: an anonymous researcher, f00l (@PPPF00L) and 3ndy1(@_3ndy1) and Minghao Lin@Y1nkoc and 云散花折, Arjanit Isufi Entry updated September 14, 2026 ### IOMobileFrameBuffer Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: An out-of-bounds access issue was addressed with improved bounds checking. CVE-2026-64736: Ruslan Dautov, hxr1 Entry added September 14, 2026 ### Kernel Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: A remote attacker may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-65343: Drinor Selmanaj (Sentry), Surya Narayan Kushwaha ### Kernel Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2026-65349: an anonymous researcher ### Kernel Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-65330: Ashish Kunwar, Mikhail Lozhnikov of Positive Technologies, Bhaswanth Chigurupati, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. CVE-2026-28935: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Entry updated September 14, 2026 ### Telephony Available for: iPhone 11 and later Impact: An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic Description: An authentication issue was addressed with improved state management. CVE-2026-65329: Bedran Karakoc, Tobias Funke, Jacopo Clark, Katharina Kohls of Ruhr University Bochum ### WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: An out-of-bounds access issue was addressed with improved bounds checking. WebKit Bugzilla: 317632 CVE-2026-64784: Janggoon Lee of Out of Bounds, OpenAI Codex Security - Amy Burnett ### WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 313452 CVE-2026-43795: wwwlk WebKit Bugzilla: 318348 CVE-2026-65338: OpenAI Codex Security - Amy Burnett ### WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to memory corruption Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 318405 CVE-2026-65341: Henock Habte ### WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A memory corruption vulnerability was addressed with improved locking. WebKit Bugzilla: 321480 CVE-2026-64782: Charles Kern, Seonwook Kim, Shubham Chaskar, lattice, Josef Korbel Entry updated September 14, 2026 ### WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and late --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_