Apple

iOS 26.6 and iPadOS 26.6

128066 Jul 27, 2026 Source: Vendor

Imported by the Apple release catcher from https://support.apple.com/en-us/128066. 86 CVE entries, 12 additional recognitions. Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later. Draft — review before publishing.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://support.apple.com/en-us/128066

Are you credited here? Sign in and claim your line — it is yours immediately, no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

217 lines

Showing 1–50 of 217 · page 1 of 5

CVE-2026-64732 BR2026-0000-000646 Accessibility unclaimed

An attacker with physical access may be able to access sensitive user data during iPhone Mirroring

Credited as Jorge Welch (@jorgwelch)

CVE-2026-64733 BR2026-0000-000647 Accounts Framework unclaimed

An app may be able to fingerprint the user

Credited as Rosyna Keller of Totally Not Malicious Software (paradisefacade.com)

CVE-2026-43801 BR2026-0000-000648 App Store unclaimed

An app may be able to access sensitive user data

Credited as Rahul Raj

CVE-2026-28928 BR2026-0000-000649 Apple Neural Engine unclaimed

An app may be able to cause unexpected system termination

Credited as Dun

CVE-2026-43776 BR2026-0000-000650 AppleDouble unclaimed

Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution

Credited as Irvin Wang

CVE-2026-43776 BR2026-0000-000651 AppleDouble unclaimed

Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution

Credited as Peter Malone

CVE-2026-43776 BR2026-0000-000652 AppleDouble unclaimed

Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution

Credited as Nicolas Rabrenovic

CVE-2026-64725 BR2026-0000-000653 Audio unclaimed

An app may be able to cause a denial-of-service

Credited as Seonung Park

CVE-2026-64725 BR2026-0000-000654 Audio unclaimed

An app may be able to cause a denial-of-service

Credited as ALTV!ST (altvi.st/)

CVE-2026-43730 BR2026-0000-000655 AuthKit unclaimed

An app may be able to fingerprint the user

Credited as David Strnadel

CVE-2026-64747 BR2026-0000-000656 AVEVideoEncoder unclaimed

An app may be able to execute arbitrary code with kernel privileges

Credited as Franco Belman at Blackwing Intelligence

CVE-2026-64707 BR2026-0000-000657 BackgroundAssets unclaimed

An app may be able to delete files for which it does not have permission

Credited as YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab

CVE-2026-43811 BR2026-0000-000658 Books unclaimed

An app may be able to modify protected parts of the file system

Credited as Rodolphe Brunetti (@eisw0lf) of Lupus Nova

CVE-2026-43813 BR2026-0000-000659 CloudAttestation unclaimed

A maliciously crafted app may be able to bypass code signing enforcement

Credited as Anton Pakhunov

CVE-2026-64746 BR2026-0000-000660 Contacts unclaimed

An app may be able to add contacts without user authorization

Credited as Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova

CVE-2026-64746 BR2026-0000-000661 Contacts unclaimed

An app may be able to add contacts without user authorization

Credited as Daniel Febrero

CVE-2026-64734 BR2026-0000-000662 Contacts unclaimed

Processing a maliciously crafted contact may leak sensitive data

Credited as Daniel Williams

CVE-2026-43797 BR2026-0000-000663 Contacts unclaimed

An app may be able to access information about a user's contacts

Credited as Arni Hardarson (Neonix Security)

CVE-2026-43673 BR2026-0000-000664 CoreAudio unclaimed

Processing a maliciously crafted audio file may corrupt process memory

Credited as Anonymous working with TrendAI Zero Day Initiative

CVE-2026-43744 BR2026-0000-000665 CoreAudio unclaimed

Processing an audio stream in a maliciously crafted media file may terminate the process

Credited as Mathis Mansière

CVE-2026-43803 BR2026-0000-000666 CoreAudio unclaimed

A remote attacker may be able to cause unexpected system termination

Credited as Rahul Raj

CVE-2026-43711 BR2026-0000-000667 CoreMedia unclaimed

Processing a maliciously crafted video file may lead to unexpected app termination

Credited as James Duffy (@0x4A616D657344)

CVE-2026-43753 BR2026-0000-000668 DriverKit unclaimed

An attacker with physical access to a locked device may be able to view sensitive user information

Credited as Niels Hofmans

CVE-2026-64742 BR2026-0000-000669 FrontBoard unclaimed

An app may be able to access sensitive user data

Credited as Huỳnh Tấn Ngàn

CVE-2026-64740 BR2026-0000-000670 Game Center unclaimed

A malicious app may be able to break out of its sandbox

Credited as Manuel Fernandez (Stackhopper Security)

CVE-2026-43796 BR2026-0000-000671 Game Center unclaimed

An app may be able to access sensitive user data

Credited as Ilya Andr (andrd3v) of Positive Technologies

CVE-2026-43796 BR2026-0000-000672 Game Center unclaimed

An app may be able to access sensitive user data

Credited as Stanislav Jelezoglo

CVE-2026-64692 BR2026-0000-000673 Heimdal unclaimed

An app may be able to cause a denial-of-service

Credited as Redon Gashi

CVE-2026-43780 BR2026-0000-000674 ImageIO unclaimed

Processing a maliciously crafted texture may lead to unexpected app termination

Credited as Michael DePlante (@izobashi) of TrendAI Zero Day Initiative

CVE-2026-64716 BR2026-0000-000675 ImageIO unclaimed

Processing a maliciously crafted image may corrupt process memory

Credited as Arni Hardarson

CVE-2026-64716 BR2026-0000-000676 ImageIO unclaimed

Processing a maliciously crafted image may corrupt process memory

Credited as Jonathan Alush-Aben

CVE-2026-64716 BR2026-0000-000677 ImageIO unclaimed

Processing a maliciously crafted image may corrupt process memory

Credited as Peter Malone

CVE-2026-64758 BR2026-0000-000678 ImageIO unclaimed

Processing a maliciously crafted file may lead to unexpected app termination

Credited as 진규정 (Gyujeong Jin, @G1uN4sh)

CVE-2026-64754 BR2026-0000-000679 ImageIO unclaimed

Processing a maliciously crafted file may lead to a denial-of-service

Credited as PETOWORKS의 Bugeun Choi (@Bugeun)

CVE-2026-64754 BR2026-0000-000680 ImageIO unclaimed

Processing a maliciously crafted file may lead to a denial-of-service

Credited as Rahul Raj

CVE-2026-64693 BR2026-0000-000681 ImageIO unclaimed

Processing a maliciously crafted image may lead to a denial-of-service

Credited as Geonha Lee (@leegn4a)

CVE-2026-43805 BR2026-0000-000682 IOKit unclaimed

An app may be able to cause unexpected system termination or write kernel memory

Credited as 이재영

CVE-2026-64749 BR2026-0000-000683 Kernel unclaimed