Apple

iOS 26.7 and iPadOS 26.7

149041 Sep 14, 2026 Source: Vendor

Imported by the Apple release catcher from https://support.apple.com/en-us/149041. 82 CVE entries, 15 additional recognitions. Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later. Draft. Review before publishing.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://support.apple.com/en-us/149041

Are you credited here? Sign in and claim your line: it is yours immediately, no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

170 lines

Showing 1–50 of 170 · page 1 of 4

CVE-2026-86882 BR2026-0000-012605 Accelerate Framework unclaimed

Processing a maliciously crafted image may lead to unexpected process termination

Credited as Peter Malone

CVE-2026-43664 BR2026-0000-012606 Accessibility unclaimed

An app may be able to access sensitive user data

Credited as Stuart Wallace

CVE-2026-43664 BR2026-0000-012607 Accessibility unclaimed

An app may be able to access sensitive user data

Credited as Rosyna Keller of Totally Not Malicious Software

CVE-2026-43664 BR2026-0000-012608 Accessibility unclaimed

An app may be able to access sensitive user data

Credited as Jian Lee (@speedyfriend433)

CVE-2026-43664 BR2026-0000-012609 Accessibility unclaimed

An app may be able to access sensitive user data

Credited as Ilya Andr (andrd3v)

CVE-2026-43664 BR2026-0000-012610 Accessibility unclaimed

An app may be able to access sensitive user data

Credited as Gongyu Ma (@Mezone0)

CVE-2026-43664 BR2026-0000-012611 Accessibility unclaimed

An app may be able to access sensitive user data

Credited as David Strnadel

CVE-2026-43664 BR2026-0000-012612 Accessibility unclaimed

An app may be able to access sensitive user data

Credited as Daniel Febrero

CVE-2026-43664 BR2026-0000-012613 Accessibility unclaimed

An app may be able to access sensitive user data

Credited as CJ Vana

CVE-2026-43664 BR2026-0000-012614 Accessibility unclaimed

An app may be able to access sensitive user data

Credited as Asaf Cohen

CVE-2026-84523 BR2026-0000-012615 APFS unclaimed

An app may be able to cause unexpected system termination or write kernel memory

Credited as Cem Onat Karagun

CVE-2026-65408 BR2026-0000-012616 Apple Neural Engine unclaimed

An app may be able to cause unexpected system termination

Credited as tamdao

CVE-2026-65407 BR2026-0000-012617 AppleAVD unclaimed

An app may be able to cause unexpected system termination

Credited as Franco Belman at Blackwing Intelligence

CVE-2026-84519 BR2026-0000-012618 AppleDouble unclaimed

Mounting a disk image with maliciously crafted files may lead to unexpected system termination

Credited as Richard Zana

CVE-2026-84583 BR2026-0000-012619 AuthKit unclaimed

A local app may be able to read a persistent account identifier

Credited as Zhongcheng Li from IES Red Team

CVE-2026-65410 BR2026-0000-012620 AVEVideoEncoder unclaimed

An app may be able to cause unexpected system termination

Credited as Calif.io in collaboration with Claude and Anthropic Research

CVE-2026-84616 BR2026-0000-012621 AVEVideoEncoder unclaimed

An app may be able to cause unexpected system termination

Credited as Peter Malone

CVE-2026-84607 BR2026-0000-012622 AVEVideoEncoder unclaimed

A sandboxed app may be able to execute arbitrary code with kernel privileges

Credited as Ruslan Dautov

CVE-2026-65406 BR2026-0000-012623 BackgroundAssets unclaimed

An app may be able to access sensitive user data

Credited as Ye Zhang (@VAR10CK) of Baidu Security

CVE-2026-65399 BR2026-0000-012624 copyfile unclaimed

An archive may be able to bypass Gatekeeper

Credited as Rishabh Jain (rjcyber) of cyberplanet

CVE-2026-65399 BR2026-0000-012625 copyfile unclaimed

An archive may be able to bypass Gatekeeper

Credited as Pasquale Scola

CVE-2026-65344 BR2026-0000-012626 CoreMedia unclaimed

Processing a maliciously crafted video file may lead to unexpected app termination

Credited as Siyeong kim

CVE-2026-86876 BR2026-0000-012627 CoreMedia unclaimed

A sandboxed process may be able to circumvent sandbox restrictions

Credited as Chris Bailey - Short Circuit

CVE-2026-43702 BR2026-0000-012628 CoreMedia Video Toolbox unclaimed

Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory

Credited as Nathaniel Oh (@calysteon)

CVE-2026-84624 BR2026-0000-012629 CoreML unclaimed

A sandboxed app may be able to access restricted files

Credited as AL Najafi

CVE-2026-84624 BR2026-0000-012630 CoreML unclaimed

A sandboxed app may be able to access restricted files

Credited as tamdao

CVE-2026-43737 BR2026-0000-012631 CoreMotion unclaimed

An app may be able to access motion data from headphones without user consent

Credited as Stuart Wallace

CVE-2026-65412 BR2026-0000-012632 CoreText unclaimed

Processing web content may lead to a denial-of-service

Credited as Pavan Nallamothu

CVE-2026-84612 BR2026-0000-012633 DeviceCheck unclaimed

An app may be able to read persistent device identifiers

Credited as N.M.Praveen Nawarathne (@zblockrat)

CVE-2026-84612 BR2026-0000-012634 DeviceCheck unclaimed

An app may be able to read persistent device identifiers

Credited as James Gill (@jjtech@infosec.exchange)

CVE-2026-84552 BR2026-0000-012635 Disk Images unclaimed

An app may be able to cause unexpected system termination

Credited as Tommy DeVoss from Braze Security Team (@thedawgyg)

CVE-2026-84552 BR2026-0000-012636 Disk Images unclaimed

An app may be able to cause unexpected system termination

Credited as flower xu

CVE-2026-84552 BR2026-0000-012637 Disk Images unclaimed

An app may be able to cause unexpected system termination

Credited as Adriatik Raci

CVE-2026-84552 BR2026-0000-012638 Disk Images unclaimed

An app may be able to cause unexpected system termination

Credited as PETOWORKS의 Bugeun Choi (@Bugeun)

CVE-2026-84552 BR2026-0000-012639 Disk Images unclaimed

An app may be able to cause unexpected system termination

Credited as Peter Malone

CVE-2026-84552 BR2026-0000-012640 Disk Images unclaimed

An app may be able to cause unexpected system termination

Credited as Hyunwoo Kim (@v4bel)

CVE-2026-84552 BR2026-0000-012641 Disk Images unclaimed

An app may be able to cause unexpected system termination

Credited as Daisuke Hatakeyama

CVE-2026-84552 BR2026-0000-012642 Disk Images unclaimed

An app may be able to cause unexpected system termination

Credited as Ryohei Ueki (@SYZD Research)

CVE-2026-84510 BR2026-0000-012643 exFAT unclaimed

Mounting a maliciously crafted volume may lead to unexpected system termination

Credited as Richard Zana

CVE-2026-84510 BR2026-0000-012644 exFAT unclaimed

Mounting a maliciously crafted volume may lead to unexpected system termination

Credited as Meta Red Team X - Nik Tsytsarkin

CVE-2026-84534 BR2026-0000-012645 file_cmds unclaimed

Extracting a maliciously crafted archive may allow an attacker to write arbitrary files

Credited as Geoffrey Lovelace

CVE-2026-65409 BR2026-0000-012646 Foundation unclaimed

An app may be able to cause a denial of service

Credited as Bruce Dang of Calif.io in collaboration with Claude and Anthropic Research

CVE-2026-84492 BR2026-0000-012647 Graphics unclaimed

An app may be able to cause unexpected system termination

Credited as Tommy DeVoss from Braze Security Team (@thedawgyg)

CVE-2026-84492 BR2026-0000-012648 Graphics unclaimed

An app may be able to cause unexpected system termination

Credited as Jiyong Yang

CVE-2026-84564 BR2026-0000-012649 ImageIO unclaimed

Processing a maliciously crafted image may result in disclosure of process memory

Credited as Justin O'Leary

CVE-2026-64758 BR2026-0000-012650 ImageIO unclaimed

Processing a maliciously crafted file may lead to unexpected app termination

Credited as 진규정 (Gyujeong Jin, @G1uN4sh)

CVE-2026-43661 BR2026-0000-012651 ImageIO unclaimed

Processing a maliciously crafted image may corrupt process memory

Credited as Gandalf4a of PKU-ICODE

CVE-2026-43661 BR2026-0000-012652 ImageIO unclaimed

Processing a maliciously crafted image may corrupt process memory

Credited as Anton Pakhunov

CVE-2026-86869 BR2026-0000-012653 ImageIO unclaimed

Processing a maliciously crafted image may lead to unexpected app termination

Credited as Niels Hofmans

CVE-2026-86869 BR2026-0000-012654 ImageIO unclaimed

Processing a maliciously crafted image may lead to unexpected app termination

Credited as Meta Red Team X