Apple

iOS 27 and iPadOS 27

149034 Sep 14, 2026 Source: Vendor

Imported by the Apple release catcher from https://support.apple.com/en-us/149034. 126 CVE entries, 67 additional recognitions. Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later. Draft. Review before publishing.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://support.apple.com/en-us/149034

Are you credited here? Sign in and claim your line: it is yours immediately, no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

378 lines

Showing 51–100 of 378 · page 2 of 8

CVE-2026-84624 BR2026-0000-012277 CoreML unclaimed

A sandboxed app may be able to access restricted files

Credited as tamdao

CVE-2026-43737 BR2026-0000-012278 CoreMotion unclaimed

An app may be able to access motion data from headphones without user consent

Credited as Stuart Wallace

CVE-2026-65412 BR2026-0000-012279 CoreText unclaimed

Processing web content may lead to a denial-of-service

Credited as Pavan Nallamothu

CVE-2026-84596 BR2026-0000-012280 CoreText unclaimed

Processing a maliciously crafted font may result in the disclosure of process memory

Credited as ret2happy

CVE-2026-84596 BR2026-0000-012281 CoreText unclaimed

Processing a maliciously crafted font may result in the disclosure of process memory

Credited as Meta Product Security

CVE-2026-84575 BR2026-0000-012282 CoreUI unclaimed

Processing a maliciously crafted file may lead to unexpected app termination

Credited as Mustafa Calap (@ordinal0, dbg.re)

CVE-2026-84489 BR2026-0000-012283 CoreUI unclaimed

An app may be able to cause a denial of service

Credited as stratan (@5tratan)

CVE-2026-84489 BR2026-0000-012284 CoreUI unclaimed

An app may be able to cause a denial of service

Credited as Peter Malone

CVE-2026-84571 BR2026-0000-012285 CoreUI unclaimed

Processing a maliciously crafted image may lead to unexpected app termination

Credited as stratan (@5tratan)

CVE-2026-84571 BR2026-0000-012286 CoreUI unclaimed

Processing a maliciously crafted image may lead to unexpected app termination

Credited as Peter Malone

CVE-2026-43738 BR2026-0000-012287 CoreUI unclaimed

Processing a maliciously crafted asset catalog may result in disclosure of process memory

Credited as Peter Malone

CVE-2026-84511 BR2026-0000-012288 CoreUI unclaimed

Processing a maliciously crafted asset catalog may lead to unexpected process termination

Credited as Rahul Raj

CVE-2026-84511 BR2026-0000-012289 CoreUI unclaimed

Processing a maliciously crafted asset catalog may lead to unexpected process termination

Credited as stratan (@5tratan)

CVE-2026-84612 BR2026-0000-012290 DeviceCheck unclaimed

An app may be able to read persistent device identifiers

Credited as N.M.Praveen Nawarathne (@zblockrat)

CVE-2026-84612 BR2026-0000-012291 DeviceCheck unclaimed

An app may be able to read persistent device identifiers

Credited as James Gill (@jjtech@infosec.exchange)

CVE-2026-84552 BR2026-0000-012292 Disk Images unclaimed

An app may be able to cause unexpected system termination

Credited as Tommy DeVoss from Braze Security Team (@thedawgyg)

CVE-2026-84552 BR2026-0000-012293 Disk Images unclaimed

An app may be able to cause unexpected system termination

Credited as flower xu

CVE-2026-84552 BR2026-0000-012294 Disk Images unclaimed

An app may be able to cause unexpected system termination

Credited as Adriatik Raci

CVE-2026-84552 BR2026-0000-012295 Disk Images unclaimed

An app may be able to cause unexpected system termination

Credited as PETOWORKS의 Bugeun Choi (@Bugeun)

CVE-2026-84552 BR2026-0000-012296 Disk Images unclaimed

An app may be able to cause unexpected system termination

Credited as Peter Malone

CVE-2026-84552 BR2026-0000-012297 Disk Images unclaimed

An app may be able to cause unexpected system termination

Credited as Daisuke Hatakeyama

CVE-2026-84552 BR2026-0000-012298 Disk Images unclaimed

An app may be able to cause unexpected system termination

Credited as Ryohei Ueki (@SYZD Research)

CVE-2026-84552 BR2026-0000-012299 Disk Images unclaimed

An app may be able to cause unexpected system termination

Credited as Hyunwoo Kim (@v4bel)

CVE-2026-84510 BR2026-0000-012300 exFAT unclaimed

Mounting a maliciously crafted volume may lead to unexpected system termination

Credited as Meta Red Team X - Nik Tsytsarkin

CVE-2026-84510 BR2026-0000-012301 exFAT unclaimed

Mounting a maliciously crafted volume may lead to unexpected system termination

Credited as Richard Zana

CVE-2026-43785 BR2026-0000-012302 File Bookmark unclaimed

An app may be able to modify a file it only had permission to read

Credited as Junyeong Lee (jylab.github.io)

CVE-2026-43785 BR2026-0000-012303 File Bookmark unclaimed

An app may be able to modify a file it only had permission to read

Credited as Merrick Hare

CVE-2026-43785 BR2026-0000-012304 File Bookmark unclaimed

An app may be able to modify a file it only had permission to read

Credited as Aditya Kumar

CVE-2026-43785 BR2026-0000-012305 File Bookmark unclaimed

An app may be able to modify a file it only had permission to read

Credited as John Nzyuko Uvyu

CVE-2026-43785 BR2026-0000-012306 File Bookmark unclaimed

An app may be able to modify a file it only had permission to read

Credited as Narendra Singh (@_3P1C)

CVE-2026-84534 BR2026-0000-012307 file_cmds unclaimed

Extracting a maliciously crafted archive may allow an attacker to write arbitrary files

Credited as Geoffrey Lovelace

CVE-2026-43688 BR2026-0000-012308 Filters unclaimed

Processing a maliciously crafted file may lead to unexpected app termination

Credited as Peter Malone

CVE-2026-84597 BR2026-0000-012309 FontParser unclaimed

Processing a maliciously crafted font may result in the disclosure of process memory

Credited as Nik Tsytsarkin

CVE-2026-65409 BR2026-0000-012310 Foundation unclaimed

An app may be able to cause a denial of service

Credited as Bruce Dang of Calif.io in collaboration with Claude and Anthropic Research

CVE-2026-84492 BR2026-0000-012311 Graphics unclaimed

An app may be able to cause unexpected system termination

Credited as Tommy DeVoss from Braze Security Team (@thedawgyg)

CVE-2026-84492 BR2026-0000-012312 Graphics unclaimed

An app may be able to cause unexpected system termination

Credited as Jiyong Yang

CVE-2026-84533 BR2026-0000-012313 Heimdal unclaimed

An attacker in a privileged network position may be able to modify network traffic

Credited as Vishal Patidar

CVE-2026-84533 BR2026-0000-012314 Heimdal unclaimed

An attacker in a privileged network position may be able to modify network traffic

Credited as Roman Zabicki

CVE-2026-84606 BR2026-0000-012315 iCloud unclaimed

An app may be able to identify a user across reinstalls

Credited as Ilya Andr (andrd3v)

CVE-2026-64756 BR2026-0000-012316 Image Capture unclaimed

An app may be able to access user-sensitive data

Credited as Luke Symons

CVE-2026-84564 BR2026-0000-012317 ImageIO unclaimed

Processing a maliciously crafted image may result in disclosure of process memory

Credited as Justin O'Leary

CVE-2026-65395 BR2026-0000-012318 ImageIO unclaimed

Processing a maliciously crafted image may result in memory corruption

Credited as Mateusz Jurczyk of Google Project Zero

CVE-2026-65395 BR2026-0000-012319 ImageIO unclaimed

Processing a maliciously crafted image may result in memory corruption

Credited as Varik Matevosyan

CVE-2026-28969 BR2026-0000-012320 IOKit unclaimed

An app may be able to cause unexpected system termination

Credited as Mihalis Haatainen

CVE-2026-28969 BR2026-0000-012321 IOKit unclaimed

An app may be able to cause unexpected system termination

Credited as Ashish Kunwar

CVE-2026-28969 BR2026-0000-012322 IOKit unclaimed

An app may be able to cause unexpected system termination

Credited as Ari Hawking

CVE-2026-28969 BR2026-0000-012323 IOKit unclaimed

An app may be able to cause unexpected system termination

Credited as 이재영

CVE-2026-65398 BR2026-0000-012324 IOMobileFrameBuffer unclaimed

An app may be able to cause unexpected system termination or corrupt kernel memory

Credited as Chris Bailey - Short Circuit

CVE-2026-65398 BR2026-0000-012325 IOMobileFrameBuffer unclaimed

An app may be able to cause unexpected system termination or corrupt kernel memory

Credited as Mustafa Calap (@ordinal0, dbg.re)

CVE-2026-65398 BR2026-0000-012326 IOMobileFrameBuffer unclaimed

An app may be able to cause unexpected system termination or corrupt kernel memory

Credited as David Strnadel