iPad y sus accesorios (iPadOS 26)

[Tiberiuz]

Una de las mierdas de Apple. No poder instalar vida antiguas.. o sí?

 

[ManuJedi]

Tengo que actualizar mi iPad 8 que con los 32 pírricos Gb que tiene no puedo ni actualizar sin borrar casi todo.
El caso es que tengo esta duda: iPad A16 de 128Gb nuevo por 350€ o Air M1 de 256Gb de back market en condiciones "Premium" por 420€... Para uso de ver YouTube y tomar notas de vez en cuando, nada más. Tengo un MacBook Air m1 y el iPhone 17, por dar contexto.
¿Qué dicen los sabiondos de por aquí?

All those moments will be lost in time, like tears in the rain…

 

[ManuJedi]

Bueno, yo creo que así ya tengo todo el feedback que necesitaba.

 

[Tozzi]

El otro día me topé con mi iPad 2 en el trastero. Sorprendentemente, arrancó y la batería dura un montón de horas.

¿Qué puedo hacer con el a día de hoy? ¿Se os ocurre algo? ¿Algún trapicheo para hacerle overclock? ¿Algún sistema operativo alternativo?

Es por darle utilidad aunque sólo sea para ver vídeos en el coche, las aplicaciones de streaming lógicamente están descartadas.

Si encuentras algo comparte, tengo un 2 y un 3 en el cajón pero ni YouTube funciona ya. Creo que hay que hacerle jailbreak y con Cydia vuelve a revivir un poco, pero todavía no me he metido con ellos

 

[Tozzi]

Bueno, yo creo que así ya tengo todo el feedback que necesitaba.

Del más caro, dos.

 

[Hinomura Krycek]

Yo tengo un iPad 3 inservible desde iOS 8.

 

[Hallowed]

Si encuentras algo comparte, tengo un 2 y un 3 en el cajón pero ni YouTube funciona ya. Creo que hay que hacerle jailbreak y con Cydia vuelve a revivir un poco, pero todavía no me he metido con ellos

Seguro que tu encuentras algo antes, así que ya contarás...

 

[DeBilbao]

iPadOS 26.3 disponible, con número de compilación 23D127, la misma que en el iPhone.

Descargando e instalando...

 

[DeBilbao]

iPadOS 26.3.1 disponible para dar soporte a los nuevos dispositivos presentados, incluyendo los Studio Displays.

Actualizado sin problema en mi iPad Pro M1.

 

[DeBilbao]

iPadOS 26.3.1 se ha actualizado a la versión 26.3.1 (a) (25D771280a), la primera actualización de seguridad en segundo plano que lanza Apple para proteger a los equipos de una vulnerabilidad.

En este caso un agujero en Webkit que evita que un atacante pueda atacar el equipo con un contenido web creado de forma maliciosa.

About the security content of Background Security Improvements for iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1, and macOS 26.3.2 - Apple Support

This document describes the content of Background Security Improvements.

support.apple.com

A pesar de que en Ajustes > Privacidad y seguridad > Mejoras de seguridad, tengo activada la instalación automática, en mi iPad Pro M1 de 3ª Gen no se había instalado aún, pero ha sido entrar a ver si tenía configurado bien este ajuste y ha detectado la actualización, que se ha descargado e instalado en poco tiempo.

 

[DeBilbao]

iPadOS 26.4 disponible

 

[Manu1001]

No se a que espera Apple para sacar MacOS para iPad, aunque fuera para los Pro con Magic Keyboard…

 

[Hinomura Krycek]

No se a que espera Apple para sacar MacOS para iPad, aunque fuera para los Pro con Magic Keyboard…

Lo importante son los emojis nuevos.

 

[DeBilbao]

iPadOS 26.5 disponible

 

[DeBilbao]

iPadOS 25.6.2 disponible

Actualizado sin problema en un iPad Air 3 que tenemos en casa, al que ya le cuesta funcionar bien con esta versión, y todo porque solo tiene 3 cutres GB de RAM.

Además, es el modelo con 64GB de almacenamiento y para actualizarlo tengo que descargar el firmware completo y actualizarlo desde macOS, porque no tengo espacio suficiente para descargar la actualización OTA en el dispositivo y para hacer la actualización.

Indican que es una actualización con correcciones de seguridad, documentadas en

https://support.apple.com/en-us/127594

About the security content of iOS 26.5.2 and iPadOS 26.5.2​

This update delivers security fixes that were first made available in the iOS 26.6 and iPadOS 26.6 betas. This document describes the security content of iOS 26.5.2 and iPadOS 26.5.2.

About Apple security updates​

For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.

Apple security documents reference vulnerabilities by CVE-ID when possible.

For more information about security, see the Apple Product Security page.

iOS 26.5.2 and iPadOS 26.5.2​

Released June 29, 2026

IOGPUFamily​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to cause unexpected system termination

Description: A race condition was addressed with improved state handling.

CVE-2026-43743: Lyutoon, Dun

Kernel​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to cause unexpected system termination or write kernel memory

Description: The issue was addressed with improved input sanitization.

CVE-2026-43724: Hyunwoo Kim (@v4bel)

Kernel​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to leak sensitive kernel state

Description: The issue was addressed with improved input sanitization.

CVE-2026-43722: Feng Xue and XGPT of ThreatBook, Hyunwoo Kim (@v4bel)

Kernel​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to cause unexpected system termination or corrupt kernel memory

Description: This issue was addressed with improved input validation.

CVE-2026-39868: Vladislav Shevchenko (Positive Technologies), Ye Zhang (@VAR10CK) of Baidu Security, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.

libxslt​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing maliciously crafted web content may lead to an unexpected process crash

Description: A double free issue was addressed with improved memory management.

CVE-2026-43706: Tristan Madani (@TristanInSec) from Talence Security

libxslt​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing maliciously crafted web content may lead to an unexpected process crash

Description: The issue was addressed with improved memory handling.

CVE-2026-43703: Tristan Madani (@TristanInSec) from Talence Security

Web Extensions​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: A malicious web extension may be able to cause an unexpected process crash

Description: A use-after-free issue was addressed with improved memory management.

WebKit Bugzilla: 314642
CVE-2026-43704: dr3dd

WebKit​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing maliciously crafted web content may disclose sensitive user information

Description: A cross-origin issue was addressed with improved tracking of security origins.

WebKit Bugzilla: 315368
CVE-2026-43700: Vitaly Simonovich, Christian Meurer Xavier

WebKit​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: A malicious website may exfiltrate data cross-origin

Description: The issue was addressed with improved checks.

WebKit Bugzilla: 313357
CVE-2026-43735: Merrick Hare, Drinor Selmanaj (Sentry), Khai Tran, John Lussier, Rhyru9, Kwak Kiyong, Song Nuri

WebKit​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing maliciously crafted web content may lead to an unexpected process crash

Description: A use-after-free issue was addressed with improved memory management.

WebKit Bugzilla: 313693
CVE-2026-43734: Jonathan Alush-Aben

WebKit Bugzilla: 313857
CVE-2026-43726: Josef Korbel (Citadelo), Tristan Madani (@TristanInSec) from Talence Security, Gia Bui (@yabeow) from Calif.io, Narendra Singh (@_3P1C)

WebKit Bugzilla: 314398
CVE-2026-43709

WebKit Bugzilla: 317227
CVE-2026-43699: Tommy DeVoss from Braze Security Team (@thedawgyg)

WebKit Bugzilla: 315161
CVE-2026-43742: Юлия Мерцалова

WebKit​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing maliciously crafted web content may disclose sensitive user information

Description: A path handling issue was addressed with improved validation.

WebKit Bugzilla: 313085
CVE-2026-43732: Nan Wang (@eternalsakura13)

WebKit​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing maliciously crafted web content may lead to memory corruption

Description: A use-after-free issue was addressed with improved memory management.

WebKit Bugzilla: 314115
CVE-2026-43731: dr3dd

WebKit Bugzilla: 313577
CVE-2026-43715: Milad Nasr and Nicholas Carlini with Claude, Anthropic

WebKit​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash

Description: A use-after-free issue was addressed with improved memory management.

WebKit Bugzilla: 313691
CVE-2026-43727: Tommy DeVoss from Braze Security Team (@thedawgyg), Gia Bui (@yabeow) from Calif.io, Gurpreet Shergill

WebKit​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: A malicious website may be able to process restricted web content outside the sandbox

Description: The issue was addressed with improved input validation.

WebKit Bugzilla: 312832
CVE-2026-43725: Luke Francis

WebKit​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing maliciously crafted web content may lead to an unexpected process crash

Description: The issue was addressed with improved memory handling.

WebKit Bugzilla: 312781
CVE-2026-43663: Soyeon Park, Amy Burnett, Khai Tran, sherkito, Kota Toda, HexRabbit (@h3xr4bb1t) and NiNi (@terrynini38514) of DEVCORE Research Team, Using GLM From Z.AI, Tristan Madani (@TristanInSec) from Talence Security, Brian Carpenter

WebKit Bugzilla: 313528
CVE-2026-39872: Utkarsh Pal, Ignacio Sanmillan (@ulexec)

WebKit Bugzilla: 314235
CVE-2026-43712: Kwak Kiyong, Song Nuri, Tristan Madani (@TristanInSec) from Talence Security

WebKit​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash

Description: The issue was addressed with improved memory handling.

WebKit Bugzilla: 315047
CVE-2026-43716: Tuan and Duc from Calif.io, OpenAI Codex Security - Amy Burnett, Evan Lambert

WebKit​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash

Description: An out-of-bounds access issue was addressed with improved bounds checking.

WebKit Bugzilla: 317231
CVE-2026-43676: Mateusz Krzywicki (iVerify.io), dr3dd, Tommy DeVoss from Braze Security Team (@thedawgyg)

WebKit​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing maliciously crafted web content may result in the disclosure of process memory

Description: The issue was addressed with improved memory handling.

WebKit Bugzilla: 308046
CVE-2026-43740: Nathaniel Oh (@calysteon), Arni Hardarson

WebKit​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Visiting a website may leak sensitive data

Description: A permissions issue was addressed with additional restrictions.

WebKit Bugzilla: 314806
CVE-2026-43713: Jody Ritonga

WebKit​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: A malicious website may exfiltrate data cross-origin

Description: The issue was addressed with improved input validation.

WebKit Bugzilla: 315306
CVE-2026-43708: Behzad Najjarpour Jabbari (@_G4ru_)

WebKit​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing maliciously crafted web content may lead to an unexpected process crash

Description: A memory corruption issue was addressed with improved memory handling.

WebKit Bugzilla: 315951
CVE-2026-43707: OpenAI Codex Security - Amy Burnett

WebKit​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing maliciously crafted web content may lead to memory corruption

Description: A type confusion issue was addressed with improved checks.

WebKit Bugzilla: 314528
CVE-2026-43705: dr3dd

WebKit​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: A malicious website may be able to process restricted web content outside the sandbox

Description: The issue was addressed with improved checks.

WebKit Bugzilla: 315004
CVE-2026-43701: Aaron Grattafiori - NVIDIA AI Red Team

WebKit​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash

Description: An out-of-bounds write issue was addressed with improved input validation.

WebKit Bugzilla: 315365
CVE-2026-43745: OpenAI Codex Security - Amy Burnett, Khai Tran

WebKit Canvas​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash

Description: A use-after-free issue was addressed with improved memory management.

WebKit Bugzilla: 313175
CVE-2026-43720: Gia Bui (@yabeow) from Calif.io, Josef Korbel

WebKit Storage​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: A malicious website may be able to silently hijack clipboard data

Description: This issue was addressed through improved state management.

WebKit Bugzilla: 313478

CVE-2026-43721: Idan Masas

WebRTC​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing maliciously crafted web content may lead to an unexpected process crash

Description: An out-of-bounds access issue was addressed with improved bounds checking.

WebKit Bugzilla: 317324
CVE-2026-28979

WebRTC​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash

Description: A stack overflow was addressed with improved input validation.

WebKit Bugzilla: 313350
CVE-2026-43718: Nan Wang (@eternalsakura13)

WebRTC​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash

Description: A use-after-free issue was addressed with improved memory management.

WebKit Bugzilla: 313351
CVE-2026-43717: Nan Wang (@eternalsakura13)

WebKit Bugzilla: 314090
CVE-2026-43746: dr3dd

Additional recognition​

libxslt​

We would like to acknowledge Kubilay Berk Alkan for their assistance.

WebKit​

We would like to acknowledge Henock Habte, Souta Sugiyama for their assistance.

WebKit JavaScript Bindings​

We would like to acknowledge Karan Kurani for their assistance.

 

[DeBilbao]

iPadOS se actualiza a la versión 26.6 para corregir errores, actualizaciones de seguridad y para preparar el índice de Spotlight para la próxima versión de iPadOS 27.

Actualizado sin problema en los iPad que tenemos por casa.

Como comentaba en el hilo de macOS Tahoe, apuesto a que con el acceso que tienen a los modelos de IA como Fable de Anthropic, están identificando vulnerabilidades a cascoporro, porque el número de CVEs corregidos es muy alto.

iOS 26.6 and iPadOS 26.6​

Released July 27, 2026

Accessibility​

Available for: iPhone 11 and later

Impact: An attacker with physical access may be able to access sensitive user data during iPhone Mirroring

Description: This issue was addressed through improved state management.

CVE-2026-64732: Jorge Welch (@jorgwelch)

Accounts Framework​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to fingerprint the user

Description: This issue was addressed with improved data protection.

CVE-2026-64733: Rosyna Keller of Totally Not Malicious Software (paradisefacade.com)

App Store​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to access sensitive user data

Description: This issue was addressed with improved checks.

CVE-2026-43801: Rahul Raj

Apple Neural Engine​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to cause unexpected system termination

Description: A use after free issue was addressed with improved memory management.

CVE-2026-28928: Dun

AppleDouble​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution

Description: A buffer overflow was addressed with improved bounds checking.

CVE-2026-43776: Irvin Wang, Peter Malone, Nicolas Rabrenovic

Audio​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to cause a denial-of-service

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)

AuthKit​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to fingerprint the user

Description: A permissions issue was addressed with additional restrictions.

CVE-2026-43730: David Strnadel

AVEVideoEncoder​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to execute arbitrary code with kernel privileges

Description: A buffer overflow was addressed with improved size validation.

CVE-2026-64747: Franco Belman at Blackwing Intelligence

BackgroundAssets​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to delete files for which it does not have permission

Description: A permissions issue was addressed with improved validation.

CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab

Books​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to modify protected parts of the file system

Description: A race condition was addressed with improved checks.

CVE-2026-43811: Rodolphe Brunetti (@eisw0lf) of Lupus Nova

CloudAttestation​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: A maliciously crafted app may be able to bypass code signing enforcement

Description: A validation issue was addressed with improved input sanitization.

CVE-2026-43813: Anton Pakhunov

Contacts​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to add contacts without user authorization

Description: An authorization issue was addressed with improved validation.

CVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel Febrero

Contacts​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing a maliciously crafted contact may leak sensitive data

Description: The issue was addressed with improved checks.

CVE-2026-64734: Daniel Williams

Contacts​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to access information about a user's contacts

Description: This issue was addressed with improved checks.

CVE-2026-43797: Arni Hardarson (Neonix Security)

CoreAudio​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing a maliciously crafted audio file may corrupt process memory

Description: The issue was addressed with improved memory handling.

CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative

CoreAudio​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing an audio stream in a maliciously crafted media file may terminate the process

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2026-43744: Mathis Mansière, an anonymous researcher

CoreAudio​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: A remote attacker may be able to cause unexpected system termination

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2026-43803: Rahul Raj

CoreMedia​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing a maliciously crafted video file may lead to unexpected app termination

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2026-43711: James Duffy (@0x4A616D657344)

curl​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Authentication credentials may be sent to a server on another origin

Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.

CVE-2026-3784

CVE-2026-3783

DriverKit​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An attacker with physical access to a locked device may be able to view sensitive user information

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2026-43753: Niels Hofmans

Foundation​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: A malicious app may be able to access protected user data

Description: The issue was addressed with improved input sanitization.

CVE-2026-43714: an anonymous researcher

FrontBoard​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to access sensitive user data

Description: This issue was addressed by using HTTPS when sending information over the network.

CVE-2026-64742: Huỳnh Tấn Ngàn

Game Center​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: A malicious app may be able to break out of its sandbox

Description: A parsing issue in the handling of directory paths was addressed with improved path validation.

CVE-2026-64740: Manuel Fernandez (Stackhopper Security)

Game Center​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to access sensitive user data

Description: This issue was addressed with improved data protection.

CVE-2026-43796: Ilya Andr (andrd3v) of Positive Technologies, Stanislav Jelezoglo

Heimdal​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to cause a denial-of-service

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2026-64692: Redon Gashi

ImageIO​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing a maliciously crafted texture may lead to unexpected app termination

Description: An integer overflow was addressed with improved input validation.

CVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative

ImageIO​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: An integer overflow was addressed with improved input validation.

CVE-2026-43818: an anonymous researcher

ImageIO​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing a maliciously crafted image may corrupt process memory

Description: The issue was addressed with improved memory handling.

CVE-2026-64716: Arni Hardarson, Jonathan Alush-Aben, Peter Malone

ImageIO​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing a maliciously crafted file may lead to unexpected app termination

Description: The issue was addressed with improved bounds checks.

CVE-2026-64758: 진규정 (Gyujeong Jin, @G1uN4sh)

ImageIO​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing a maliciously crafted file may lead to a denial-of-service

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2026-64754: PETOWORKS의 Bugeun Choi (@Bugeun), Rahul Raj

ImageIO​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing a maliciously crafted image may lead to a denial-of-service

Description: A type confusion issue was addressed with improved checks.

CVE-2026-64693: Geonha Lee (@leegn4a)

IOKit​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to cause unexpected system termination or write kernel memory

Description: A race condition was addressed with improved state handling.

CVE-2026-43805: 이재영

Kernel​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to cause unexpected system termination or corrupt kernel memory

Description: The issue was addressed with improved memory handling.

CVE-2026-64749: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ashish Kunwar, Hiroki Imai (LAC Co., Ltd.), hxr1

Kernel​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to cause unexpected system termination or corrupt kernel memory

Description: A use after free issue was addressed with improved memory management.

CVE-2026-43778: f0r of MurphySec, Feng Xue and XGPT of ThreatBook, Mahmoud Abdelmoniem, an anonymous researcher, Wang Yu, Lyutoon, Hiroki Imai (LAC Co., Ltd.), DARKNAVY (@DarkNavyOrg), Fábio Luís @scanpt, Nicolas Rabrenovic

Kernel​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to disclose kernel memory

Description: The issue was addressed with improved memory handling.

CVE-2026-64709: Pasquale Scola, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.

Kernel​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: A remote attacker may be able to bypass network filters

Description: An inconsistent user interface issue was addressed with improved state management.

CVE-2026-64735: Gor Aleksanyan

Kernel​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to cause unexpected system termination

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2026-43739: impost0r (ret2plt), Ruslan Dautov, Aleksandr Tarasikov, jay, Dhiyanesh Selvaraj (@redroot97), Vinay Kumar Rasala (Xplo8E) from Appknox, Lyutoon, DongJun Kim (smlijun) with UIUC, Hwiwon Lee (hwiwonl) with UIUC, Jongseong Kim (nevul37) with UIUC, Younggi Park (grill66) with UIUC, Peter Malone, an anonymous researcher, Hari Shanmugam (The Hxr1), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Marco Grassi, Dun, Daniele Castronovo, Michal Kosiorek

CVE-2026-43816: Josh Maine of Calif.io, Ruslan Dautov, 재영 정, @rootxran (Rao Ali Nawaz), Chanwit Muenprakoddee (ChemIndy), an anonymous researcher, Ye Zhang (@VAR10CK) of Baidu Security, Franco Belman at Blackwing Intelligence, Christian Figueroa, Johnny Franks (@zeroxjf), Ashmit Sharma & Atul RV, Peter Malone, Muhamad Syaiful, Muneeb Amin Bhat, Dhiyanesh Selvaraj (@redroot97), Ali Marzouq, Bountyy Oy - Mihalis Haatainen, Huy Nguyen (@34306) of Calif.io

Kernel​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to cause unexpected system termination

Description: A use after free issue was addressed with improved memory management.

CVE-2026-43822: Eddy Tsalolikhin, Michal Kosiorek

CVE-2026-64729: Josh Maine of Calif.io, beist, Adam Doupé of ASU SEFCOM, Dun, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Johnny Franks (@zeroxjf)

CVE-2026-43814: Somair Ansar, Huy Nguyen (@34306) of Calif.io

CVE-2026-64700: Asjid Kalam (@odinshell)

CVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.

Kernel​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Connecting to a malicious NFS server may lead to kernel memory corruption

Description: A buffer overflow was addressed with improved bounds checking.

CVE-2026-28931: Redon Gashi, Abhijeet Singh (linkedin.com/in/abhiunix/), Peter Malone, Omar Cerrito

Kernel​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to cause unexpected system termination

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2026-43817: Huy Nguyen (@34306) of Calif.io

Kernel​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to cause unexpected system termination

Description: An integer overflow was addressed with improved input validation.

CVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.

Kernel​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory

Description: The issue was addressed with improved memory handling.

CVE-2026-43810: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.

Kernel​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to cause unexpected system termination

Description: A memory initialization issue was addressed with improved memory handling.

CVE-2026-64775: Ryan Hileman via Xint Code (xint.io)

Kernel​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to cause unexpected system termination

Description: A race condition was addressed with improved state handling.

CVE-2026-64720: an anonymous researcher, Asjid Kalam (@odinshell), Jian Zhou and Ye Zhang

Kernel​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to cause unexpected system termination or write kernel memory

Description: A use after free issue was addressed with improved memory management.

CVE-2026-64751: N.M.Praveen Nawarathne (@zblockrat)

Kernel​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to access sensitive user data

Description: This issue was addressed through improved state management.

CVE-2026-64721: Lukas Gerlach

libarchive​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing a maliciously crafted file may result in disclosure of process memory

Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.

CVE-2026-4424

libc​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: A malicious app may be able to break out of its sandbox

Description: An integer overflow was addressed with improved input validation.

CVE-2026-28973: an anonymous researcher

Libnotify​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An attacker may be able to cause unexpected app termination

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2026-64739: Feng Xue and XGPT of ThreatBook, Dun

Managed Configuration​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to access sensitive user data

Description: An authorization issue was addressed with improved state management.

CVE-2026-64743: Daniel Febrero

mDNSResponder​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An attacker on the local network may be able to cause a denial-of-service

Description: The issue was addressed with improved memory handling.

CVE-2026-64724: Daisuke Hatakeyama (@SYZD Research)

MediaRemote​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to gain root privileges

Description: A path handling issue was addressed with improved validation.

CVE-2026-43723: Richard Zana, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs

Model I/O​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing a maliciously crafted image may corrupt process memory

Description: The issue was addressed with improved memory handling.

CVE-2026-43733: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative

CVE-2026-43729: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative

Model I/O​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: A remote attacker may be able to cause unexpected application termination or heap corruption

Description: An out-of-bounds write issue was addressed with improved input validation.

CVE-2026-64772: stratan (@5tratan), wh0am1i

Model I/O​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: A remote attacker may be able to cause unexpected application termination or heap corruption

Description: A buffer overflow was addressed with improved bounds checking.

CVE-2026-64771: wh0am1i

Model I/O​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing a 3D model may result in disclosure of process memory

Description: A buffer overflow issue was addressed with improved memory handling.

CVE-2026-64722: wh0am1i

Model I/O​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: A remote attacker may be able to cause unexpected application termination or heap corruption

Description: An integer overflow was addressed with improved input validation.

CVE-2026-64774: stratan (@5tratan)

Model I/O​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: A remote attacker may be able to cause unexpected application termination or heap corruption

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2026-64770: stratan (@5tratan)

CVE-2026-64769: stratan (@5tratan)

Model I/O​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: A remote attacker may cause an unexpected app termination

Description: An out-of-bounds read issue was addressed with improved input validation.

CVE-2026-64768: stratan (@5tratan)

NSColorPanel​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to leak sensitive user information

Description: This issue was addressed with additional entitlement checks.

CVE-2026-64711: Koh M. Nakagawa (@tsunek0h) of FFRI Security, Inc.

Pro Res​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to cause unexpected system termination

Description: A use after free issue was addressed with improved memory management.

CVE-2026-43812: Francisco Knabe

Sandbox Profiles​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to read a persistent device identifier

Description: A permissions issue was addressed with additional restrictions.

CVE-2026-64741: 彦辰

SceneKit​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution

Description: An integer overflow was addressed with improved input validation.

CVE-2026-64766: stratan (@5tratan)

CVE-2026-64765: stratan (@5tratan)

SceneKit​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2026-64764: stratan (@5tratan)

SceneKit​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution

Description: An out-of-bounds write issue was addressed by removing the vulnerable code.

CVE-2026-64763: stratan (@5tratan)

Siri​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to access sensitive user data

Description: An information disclosure issue was addressed by removing the vulnerable code.

CVE-2026-43800: Stanislav Jelezoglo

WebKit​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing maliciously crafted web content may result in the disclosure of process memory

Description: The issue was addressed with improved memory handling.

WebKit Bugzilla: 308046
CVE-2026-43740: Arni Hardarson, Nathaniel Oh (@calysteon)

WebKit​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Websites may know if the user has visited a given link

Description: This issue was addressed with improved checks.

WebKit Bugzilla: 316827
CVE-2026-64713: Kwak Kiyong, Song Nuri

WebKit​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Visiting a website that frames malicious content may lead to UI spoofing

Description: The issue was addressed with improved UI.

WebKit Bugzilla: 311660
CVE-2026-64730: Kagami Rosylight of Mozilla

WebKit​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Maliciously crafted web content may violate iframe sandboxing policy

Description: A permissions issue was addressed with improved validation.

WebKit Bugzilla: 313220
CVE-2026-64728: an anonymous researcher

WebKit​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash

Description: A use-after-free issue was addressed with improved memory management.

WebKit Bugzilla: 313521
CVE-2026-64783: 杉山 壮太, lattice, Behzad Najjarpour Jabbari (@_G4ru_), Junyeong Lee, Mooth.ai, OGINOME Tomohito, Using GLM From Z.AI, Gia Bui (@yabeow) from Calif.io

WebKit​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash

Description: A memory corruption issue was addressed with improved state management.

WebKit Bugzilla: 315082
CVE-2026-64757: Milad Nasr and Nicholas Carlini with Claude, Anthropic

WebKit​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Visiting a website may lead to an app denial-of-service

Description: This issue was addressed through improved state management.

WebKit Bugzilla: 316816
CVE-2026-43804: Heiko Kiesel of SEEMOO, TU Darmstadt

WebKit​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to read files outside of its sandbox

Description: An access issue was addressed with improved access restrictions.

WebKit Bugzilla: 314867
CVE-2026-43821: Brian Carpenter

WebKit Canvas​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash

Description: A use-after-free issue was addressed with improved memory management.

WebKit Bugzilla: 313935
CVE-2026-64718: OGINOME Tomohito, an anonymous researcher

WebRTC​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash

Description: An out-of-bounds access issue was addressed with improved bounds checking.

WebKit Bugzilla: 319404
CVE-2026-64719: Shaheen Fazim

Wi-Fi​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An attacker in physical proximity may be able to corrupt process memory

Description: The issue was addressed with improved memory handling.

CVE-2026-64726: Mathis Mansière, Peter Malone

WorkoutKit​

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to access sensitive user data

Description: An authorization issue was addressed with improved state management.

CVE-2026-64755: Stuart Wallace

Additional recognition​

CoreMedia​

We would like to acknowledge yaohway for their assistance.

Foundation​

We would like to acknowledge Nick Cook, Sentry Flag for their assistance.

Heimdal​

We would like to acknowledge Surya Narayan Kushwaha for their assistance.

IOStorageFamily​

We would like to acknowledge Aswin Kumar Gokula Kannan, Surya Narayan Kushwaha, Yatin Taneja for their assistance.

Kernel​

We would like to acknowledge Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Chris Betz, Hiroki Imai (LAC Co., Ltd.), James Duffy ( @0x4A616D657344 ), Tristan Rousseau, Vladislav Shevchenko (Positive Technologies), YingMuo (@YingMuo) of DEVCORE Research Team for their assistance.

Printing UIKit​

We would like to acknowledge Jacolon Walker ( @call_eax ) for their assistance.

Safari Downloads​

We would like to acknowledge Alfaz Hossain for their assistance.

Security​

We would like to acknowledge John Lussier, Oleh Konko of 1seal (1seal.org), alick for their assistance.

Status Bar​

We would like to acknowledge Grzegorz Skiba for their assistance.

WebKit​

We would like to acknowledge Jaya Surya Kommireddy, Jaya surya Kommireddy, Lukas Knittel (@kunte_ctf) of Ruhr-University Bochum, Nikos Fanourakis of Technical University of Crete, Sotiris Ioannidis of Technical University of Crete, Panagiotis Ilia of Cyprus University of Technology, and Kostas Drakonakis of Technical University of Crete, Tony Gorez (@tonygo_) for Reverse Society, Vitaly Simonovich, Youngjoon Kim of Team-Atlanta & sslab at Georgia Tech, s3zer0 for their assistance.

WebKit Canvas​

We would like to acknowledge Codex Security - Khai Tran, Daisuke Hatakeyama and Ryohei Ueki (@SYZD Research), David Bors at Snyk Security Labs, Giovanni Vignone and Robert van Eijk of Octane Security (octane.security), Kwak Kiyong, Song nuri, Luat Nguyen (CyberJutsu Academy), Tom Van Goethem, an anonymous researcher, dr3dd for their assistance.

WebKit Storage​

We would like to acknowledge Gurpreet Shergill, Luke Francis, Milad Nasr and Nicholas Carlini with Claude, Anthropic, Oleh Konko of 1seal (1seal.org), Vitaly Simonovich for their assistance.