apple vulnerabilities

Recent CVEs affecting apple products. 86 tracked.

apple has 86 tracked vulnerabilities, 27 critical and 2 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 86. Most recent: 2026-09-28. Highest priority: CVE-2026-65400 (score 87/100).

• CVE-2026-43682 CRITICAL 9.8 UPGRADE The issue was addressed with improved memory handling
• CVE-2026-64695 CRITICAL 9.8 UPGRADE The issue was addressed with improved memory handling
• CVE-2026-64696 CRITICAL 9.8 UPGRADE The issue was addressed with improved memory handling
• CVE-2026-28982 CRITICAL 9.8 UPGRADE A race condition was addressed with improved locking
• CVE-2026-39873 CRITICAL 9.8 UPGRADE The issue was addressed with improved memory handling
• CVE-2026-43694 CRITICAL 9.8 UPGRADE The issue was addressed with improved memory handling
• CVE-2026-43710 CRITICAL 9.8 UPGRADE The issue was addressed with improved memory handling
• CVE-2026-43748 CRITICAL 9.8 UPGRADE An out-of-bounds write issue was addressed with improved bounds checking
• CVE-2026-43757 CRITICAL 9.8 UPGRADE An out-of-bounds read was addressed with improved bounds checking
• CVE-2026-43764 CRITICAL 9.8 UPGRADE An integer overflow was addressed with improved input validation
• CVE-2026-43773 CRITICAL 9.8 UPGRADE An out-of-bounds read was addressed with improved bounds checking
• CVE-2026-43793 CRITICAL 9.8 UPGRADE An issue existed in the handling of environment variables
• CVE-2026-43802 CRITICAL 9.8 UPGRADE An out-of-bounds write issue was addressed with improved bounds checking
• CVE-2026-43809 CRITICAL 9.8 UPGRADE An out-of-bounds read was addressed with improved bounds checking
• CVE-2026-64694 CRITICAL 9.8 UPGRADE An integer overflow was addressed with improved input validation
• CVE-2026-64698 CRITICAL 9.8 UPGRADE The issue was addressed with improved memory handling
• CVE-2026-64703 CRITICAL 9.8 UPGRADE A use after free issue was addressed with improved memory management
• CVE-2026-64731 CRITICAL 9.8 UPGRADE A path handling issue was addressed with improved validation
• CVE-2026-64738 CRITICAL 9.8 UPGRADE A permissions issue was addressed with additional restrictions
• CVE-2026-43750 CRITICAL 9.8 UPGRADE A buffer overflow was addressed with improved bounds checking
• CVE-2026-28911 CRITICAL 9.8 UPGRADE The issue was addressed with improved memory handling
• CVE-2026-43779 CRITICAL 9.8 UPGRADE A logic issue was addressed with improved restrictions
• CVE-2026-64691 CRITICAL 9.8 UPGRADE A buffer overflow was addressed with improved size validation
• CVE-2026-64697 CRITICAL 9.8 UPGRADE The issue was addressed with improved memory handling
• CVE-2026-64704 CRITICAL 9.8 UPGRADE A type confusion issue was addressed with improved memory handling
• CVE-2026-64702 CRITICAL 9.8 UPGRADE An access issue was addressed with additional sandbox restrictions
• CVE-2026-43760 HIGH 8.6 UPGRADE An access issue was addressed with improved access restrictions
• CVE-2026-43777 HIGH 7.5 UPGRADE This issue was addressed with improved input validation
• CVE-2026-43823 HIGH 7.5 UPGRADE When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: firs
• CVE-2026-43728 HIGH 7.5 UPGRADE This issue was addressed through improved state management
• CVE-2026-43820 HIGH 7.7 UPGRADE NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's SANs
• CVE-2026-43772 HIGH 8.2 UPGRADE A path traversal issue was addressed with improved input validation
• CVE-2026-28981 HIGH 7.8 UPGRADE A buffer overflow was addressed with improved bounds checking
• CVE-2026-43698 HIGH 7.8 UPGRADE An injection issue was addressed with improved validation
• CVE-2026-64737 HIGH 8.2 UPGRADE An authorization issue was addressed with improved state management
• CVE-2026-64785 MEDIUM 5.3 UPGRADE SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control ch
• CVE-2026-28896 HIGH 7.7 UPGRADE The issue was addressed with improved memory handling
• CVE-2026-28912 HIGH 7.8 UPGRADE A logic issue was addressed with improved restrictions
• CVE-2026-39877 HIGH 7.8 UPGRADE A memory corruption issue was addressed with improved memory handling
• CVE-2026-43749 HIGH 7.8 UPGRADE A parsing issue in the handling of directory paths was addressed with improved path validation
• CVE-2026-39874 HIGH 7.8 UPGRADE A permissions issue was addressed with additional restrictions
• CVE-2026-39875 HIGH 7.8 UPGRADE A permissions issue was addressed with additional restrictions
• CVE-2026-43771 HIGH 7.1 UPGRADE A stack overflow was addressed with improved input validation
• CVE-2026-28945 HIGH 7.1 UPGRADE A permissions issue was addressed with additional sandbox restrictions
• CVE-2026-43672 HIGH 7.1 UPGRADE An authorization issue was addressed with improved state management
• CVE-2026-43681 HIGH 7.1 UPGRADE A buffer overflow was addressed with improved bounds checking
• CVE-2026-43747 HIGH 7.1 UPGRADE An out-of-bounds read was addressed with improved bounds checking
• CVE-2026-28926 HIGH 7.0 UPGRADE A race condition was addressed with improved state handling
• CVE-2026-43693 HIGH 7.0 UPGRADE A race condition was addressed with improved state handling
• CVE-2026-43755 HIGH 7.0 UPGRADE A race condition was addressed with improved state management
• CVE-2026-20672 MEDIUM 5.5 UPGRADE An information disclosure issue was addressed with improved privacy controls
• CVE-2026-28932 MEDIUM 5.5 UPGRADE A logic issue existed resulting in memory corruption
• CVE-2026-43738 MEDIUM 5.5 UPGRADE The issue was addressed with improved memory handling
• CVE-2026-43754 MEDIUM 5.5 UPGRADE This issue was addressed with improved redaction of sensitive information
• CVE-2026-43765 MEDIUM 5.5 UPGRADE This issue was addressed with improved handling of symlinks
• CVE-2026-43768 MEDIUM 5.5 UPGRADE The issue was addressed with improved memory handling
• CVE-2026-43774 MEDIUM 5.5 UPGRADE An out-of-bounds read was addressed with improved bounds checking
• CVE-2026-43782 MEDIUM 5.5 UPGRADE This issue was addressed with improved checks
• CVE-2026-64699 MEDIUM 5.5 UPGRADE A memory initialization issue was addressed with improved memory handling
• CVE-2026-64708 MEDIUM 5.5 UPGRADE A file quarantine bypass was addressed with additional checks
• CVE-2026-64710 MEDIUM 5.5 UPGRADE A privacy issue was addressed by removing sensitive data
• CVE-2026-64744 MEDIUM 5.5 UPGRADE An information leakage was addressed with additional validation
• CVE-2026-28849 MEDIUM 5.5 UPGRADE The issue was addressed with improved checks
• CVE-2026-28900 MEDIUM 5.5 UPGRADE A file quarantine bypass was addressed with additional checks
• CVE-2026-43665 MEDIUM 5.5 UPGRADE This issue was addressed with additional entitlement checks
• CVE-2026-43756 MEDIUM 5.5 UPGRADE A logic issue was addressed with improved validation
• CVE-2026-43763 MEDIUM 5.5 UPGRADE A permissions issue was addressed by removing the vulnerable code
• CVE-2026-43775 MEDIUM 5.5 UPGRADE An authorization issue was addressed with improved state management
• CVE-2026-43806 MEDIUM 5.5 UPGRADE A denial of service issue was addressed by removing the vulnerable code
• CVE-2026-43819 MEDIUM 5.5 UPGRADE An access issue was addressed with additional sandbox restrictions
• CVE-2026-64723 MEDIUM 5.5 UPGRADE A logic issue was addressed with improved checks
• CVE-2026-43766 MEDIUM 4.6 UPGRADE An authorization issue was addressed with improved state management
• CVE-2026-64732 MEDIUM 4.6 UPGRADE UPGRADE This issue was addressed through improved state management
• CVE-2026-43767 MEDIUM 5.0 UPGRADE The issue was addressed with improved memory handling
• CVE-2026-43781 MEDIUM 4.7 UPGRADE A race condition was addressed with improved state handling
• CVE-2026-43811 MEDIUM 4.7 UPGRADE UPGRADE A race condition was addressed with improved checks
• CVE-2026-64745 LOW 2.4 UPGRADE This issue was addressed with additional restrictions on the lock screen
• CVE-2023-28319 HIGH 7.5 UPGRADE UPGRADE A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH ser
• CVE-2022-43552 MEDIUM 5.9 UPGRADE UPGRADE A use after free vulnerability exists in curl <7.87.0
• CVE-2023-28320 MEDIUM 5.9 UPGRADE UPGRADE A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backend
• CVE-2023-28322 LOW 3.7 UPGRADE MITIGATE An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might err
• CVE-2026-65400 CRITICAL 9.8 EXPLOITED UPGRADE Apple macOS Improper Authentication Vulnerability
• CVE-2026-65370 HIGH 7.5 UPGRADE ServiceTalk HTTP/1.x incorrectly handles malformed Transfer-Encoding which could result in request smuggling a
• CVE-2026-65329 MEDIUM 5.9 UPGRADE UPGRADE An authentication issue was addressed with improved state management
• CVE-2026-64760 MEDIUM 5.5 UPGRADE UPGRADE An information leakage was addressed with additional validation
• CVE-2026-86950 HIGH 8.8 EXPLOITED UPGRADE UPGRADE Apple Multiple Products Out-of-Bounds Write Vulnerability

FAQ

How do I fix apple vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is apple being exploited right now?

Yes: 2 apple CVEs are on the CISA Known Exploited Vulnerabilities list, so patch those first.

Which apple CVE should I patch first?

CVE-2026-65400 currently ranks highest (87/100): Apple macOS Improper Authentication Vulnerability.

Products

• ipados
• iphone os
• macos
• servicetalk
• swift-crypto
• swiftnio http\/2
• swiftnio ssl

← Back to latest CVEs