Apple

iOS 18.7.10 and iPadOS 18.7.10

148287 Aug 17, 2026 Source: Vendor

Imported by the Apple release catcher from https://support.apple.com/en-us/148287. 122 CVE entries, 6 additional recognitions. Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation. Draft. Review before publishing.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://support.apple.com/en-us/148287

Are you credited here? Sign in and claim your line: it is yours immediately, no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

224 lines

Showing 1–50 of 224 · page 1 of 5

CVE-2026-64732 BR2026-0000-006414 Accessibility unclaimed

An attacker with physical access may be able to access sensitive user data during iPhone Mirroring

Credited as Jorge Welch (@jorgwelch)

CVE-2026-43667 BR2026-0000-006415 AirDrop unclaimed

An attacker in a privileged network position may be able to cause a denial-of-service

Credited as Arash Ale Ebrahim from SCy-Phy research group of CISPA Helmholtz Center for Information Security

CVE-2026-64695 BR2026-0000-006416 APFS unclaimed

A remote user may be able to cause unexpected system termination or corrupt kernel memory

Credited as Narendra Singh (@_3P1C)

CVE-2026-64695 BR2026-0000-006417 APFS unclaimed

A remote user may be able to cause unexpected system termination or corrupt kernel memory

Credited as Peter Malone

CVE-2026-43801 BR2026-0000-006418 App Store unclaimed

An app may be able to access sensitive user data

Credited as Rahul Raj

CVE-2026-43776 BR2026-0000-006419 AppleDouble unclaimed

Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution

Credited as Peter Malone

CVE-2026-43776 BR2026-0000-006420 AppleDouble unclaimed

Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution

Credited as Nicolas Rabrenovic

CVE-2026-43776 BR2026-0000-006421 AppleDouble unclaimed

Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution

Credited as Irvin Wang

CVE-2026-64725 BR2026-0000-006422 Audio unclaimed

An app may be able to cause a denial-of-service

Credited as Seonung Park

CVE-2026-64725 BR2026-0000-006423 Audio unclaimed

An app may be able to cause a denial-of-service

Credited as ALTV!ST (altvi.st/)

CVE-2026-64747 BR2026-0000-006424 AVEVideoEncoder unclaimed

An app may be able to execute arbitrary code with kernel privileges

Credited as Franco Belman at Blackwing Intelligence

CVE-2026-64762 BR2026-0000-006425 AVEVideoEncoder unclaimed

An app may be able to cause unexpected system termination

Credited as Franco Belman at Blackwing Intelligence

CVE-2026-64762 BR2026-0000-006426 AVEVideoEncoder unclaimed

An app may be able to cause unexpected system termination

Credited as Dun

CVE-2026-64707 BR2026-0000-006427 BackgroundAssets unclaimed

An app may be able to delete files for which it does not have permission

Credited as YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab

CVE-2026-43811 BR2026-0000-006428 Books unclaimed

An app may be able to modify protected parts of the file system

Credited as Rodolphe Brunetti (@eisw0lf) of Lupus Nova

CVE-2026-64746 BR2026-0000-006429 Contacts unclaimed

An app may be able to add contacts without user authorization

Credited as Rodolphe Brunetti (@eisw0lf) of Lupus Nova

CVE-2026-64746 BR2026-0000-006430 Contacts unclaimed

An app may be able to add contacts without user authorization

Credited as Daniel Febrero

CVE-2026-64734 BR2026-0000-006431 Contacts unclaimed

Processing a maliciously crafted contact may leak sensitive data

Credited as Daniel Williams

CVE-2026-43797 BR2026-0000-006432 Contacts unclaimed

An app may be able to access information about a user's contacts

Credited as Arni Hardarson (Neonix Security)

CVE-2026-43673 BR2026-0000-006433 CoreAudio unclaimed

Processing a maliciously crafted audio file may corrupt process memory

Credited as Anonymous working with TrendAI Zero Day Initiative

CVE-2026-43744 BR2026-0000-006434 CoreAudio unclaimed

Processing an audio stream in a maliciously crafted media file may terminate the process

Credited as ret2happy

CVE-2026-43744 BR2026-0000-006435 CoreAudio unclaimed

Processing an audio stream in a maliciously crafted media file may terminate the process

Credited as Mathis Mansière

CVE-2026-43803 BR2026-0000-006436 CoreAudio unclaimed

A remote attacker may be able to cause unexpected system termination

Credited as Rahul Raj

CVE-2026-43711 BR2026-0000-006437 CoreMedia unclaimed

Processing a maliciously crafted video file may lead to unexpected app termination

Credited as James Duffy (@0x4A616D657344)

CVE-2026-43738 BR2026-0000-006438 CoreUI unclaimed

Processing a maliciously crafted asset catalog may result in disclosure of process memory

Credited as Peter Malone

CVE-2026-64742 BR2026-0000-006439 FrontBoard unclaimed

An app may be able to access sensitive user data

Credited as Huỳnh Tấn Ngàn

CVE-2026-64740 BR2026-0000-006440 Game Center unclaimed

A malicious app may be able to break out of its sandbox

Credited as Manuel Fernandez (Stackhopper Security)

CVE-2026-43796 BR2026-0000-006441 Game Center unclaimed

An app may be able to read a persistent device identifier

Credited as Stanislav Jelezoglo

CVE-2026-43796 BR2026-0000-006442 Game Center unclaimed

An app may be able to read a persistent device identifier

Credited as Ilya Andr (andrd3v) of Positive Technologies

CVE-2026-64692 BR2026-0000-006443 Heimdal unclaimed

An app may be able to cause a denial-of-service

Credited as Redon Gashi

CVE-2026-64716 BR2026-0000-006444 ImageIO unclaimed