{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "nl", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." }, { "category": "description", "text": "Apple heeft meerdere kwetsbaarheden verholpen in iOS en iPadOS.", "title": "Feiten" }, { "category": "description", "text": "De kwetsbaarheden betreffen onder andere onjuist geheugenbeheer zoals use-after-free, buffer overflows, out-of-bounds reads en writes, integer overflows, race conditions, en onvoldoende inputvalidatie. Deze fouten kunnen leiden tot onverwachte crashes, geheugenbeschadiging, het lekken van gevoelige gegevens zoals OAuth2 tokens en kernel geheugen, het omzeilen van sandboxbeperkingen, en in sommige gevallen het uitvoeren van arbitraire code. Bij libcurl kunnen OAuth2 bearer tokens bijvoorbeeld gelekt worden naar een tweede host tijdens HTTP(S) redirects in combinatie met .netrc bestand gebruik. In WebKitGTK kunnen kwaadaardig opgemaakte webcontent en bestanden leiden tot procescrashes, sandbox escapes, en datalekken. Diverse Apple besturingssystemen zijn getroffen door kwetsbaarheden die het mogelijk maken dat applicaties zonder juiste autorisatie toegang krijgen tot gevoelige gebruikersdata, contactinformatie, of systeembronnen. Er zijn ook problemen opgelost die het mogelijk maakten dat applicaties bestanden buiten hun sandbox konden lezen of verwijderen. De updates verbeteren de validatie van invoer, geheugenbeheer, en beveiligingscontroles om deze risico's te mitigeren.", "title": "Interpretaties" }, { "category": "description", "text": "Apple heeft updates uitgebracht voor iOS en iPadOS om de beschreven kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.", "title": "Oplossingen" }, { "category": "general", "text": "medium", "title": "Kans" }, { "category": "general", "text": "high", "title": "Schade" }, { "category": "general", "text": "Improper Input Validation", "title": "CWE-20" }, { "category": "general", "text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "title": "CWE-22" }, { "category": "general", "text": "Improper Restriction of Operations within the Bounds of a Memory Buffer", "title": "CWE-119" }, { "category": "general", "text": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "title": "CWE-120" }, { "category": "general", "text": "Stack-based Buffer Overflow", "title": "CWE-121" }, { "category": "general", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "general", "text": "Integer Overflow or Wraparound", "title": "CWE-190" }, { "category": "general", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" }, { "category": "general", "text": "Insertion of Sensitive Information Into Sent Data", "title": "CWE-201" }, { "category": "general", "text": "Privilege Issues", "title": "CWE-265" }, { "category": "general", "text": "Improper Access Control", "title": "CWE-284" }, { "category": "general", "text": "Improper Authorization", "title": "CWE-285" }, { "category": "general", "text": "Authentication Bypass by Primary Weakness", "title": "CWE-305" }, { "category": "general", "text": "Cleartext Transmission of Sensitive Information", "title": "CWE-319" }, { "category": "general", "text": "Origin Validation Error", "title": "CWE-346" }, { "category": "general", "text": "Cross-Site Request Forgery (CSRF)", "title": "CWE-352" }, { "category": "general", "text": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "title": "CWE-362" }, { "category": "general", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" }, { "category": "general", "text": "Improper Resource Shutdown or Release", "title": "CWE-404" }, { "category": "general", "text": "Use After Free", "title": "CWE-416" }, { "category": "general", "text": "User Interface (UI) Misrepresentation of Critical Information", "title": "CWE-451" }, { "category": "general", "text": "Insufficiently Protected Credentials", "title": "CWE-522" }, { "category": "general", "text": "Reachable Assertion", "title": "CWE-617" }, { "category": "general", "text": "Improper Control of a Resource Through its Lifetime", "title": "CWE-664" }, { "category": "general", "text": "Improper Check or Handling of Exceptional Conditions", "title": "CWE-703" }, { "category": "general", "text": "Incorrect Permission Assignment for Critical Resource", "title": "CWE-732" }, { "category": "general", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "general", "text": "Access of Resource Using Incompatible Type ('Type Confusion')", "title": "CWE-843" }, { "category": "general", "text": "Missing Authorization", "title": "CWE-862" }, { "category": "general", "text": "Permissive Cross-domain Security Policy with Untrusted Domains", "title": "CWE-942" } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "Nationaal Cyber Security Centrum", "namespace": "https://www.ncsc.nl/" }, "references": [ { "category": "external", "summary": "Reference", "url": "https://support.apple.com/en-us/148287" }, { "category": "external", "summary": "Reference", "url": "https://support.apple.com/en-us/148282" } ], "title": "Kwetsbaarheden verholpen in Apple iOS en iPadOS", "tracking": { "current_release_date": "2026-08-20T06:59:08.686688Z", "generator": { "date": "2025-08-04T16:30:00Z", "engine": { "name": "V.A.", "version": "1.3" } }, "id": "NCSC-2026-0319", "initial_release_date": "2026-08-20T06:59:08.686688Z", "revision_history": [ { "date": "2026-08-20T06:59:08.686688Z", "number": "1.0.0", "summary": "Initiele versie" } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-1" } } ], "category": "product_name", "name": "iOS" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-2" } } ], "category": "product_name", "name": "iPadOS" } ], "category": "vendor", "name": "Apple" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-3783", "cwe": { "id": "CWE-522", "name": "Insufficiently Protected Credentials" }, "notes": [ { "category": "other", "text": "Insufficiently Protected Credentials", "title": "CWE-522" }, { "category": "other", "text": "Insertion of Sensitive Information Into Sent Data", "title": "CWE-201" }, { "category": "description", "text": "A curl vulnerability in versions 7.33.0 to before 8.19.0 can leak OAuth2 bearer tokens to redirected hosts with .netrc entries, affecting products like NetApp and Apple software and risking unauthorized credential exposure.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-3783 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-3783.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "baseScore": 5.7, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-3783" }, { "cve": "CVE-2026-3784", "cwe": { "id": "CWE-305", "name": "Authentication Bypass by Primary Weakness" }, "notes": [ { "category": "other", "text": "Authentication Bypass by Primary Weakness", "title": "CWE-305" }, { "category": "description", "text": "Libcurl versions prior to 8.19.0, including Apple software, contain vulnerabilities involving improper reuse of HTTP proxy connections with different credentials during CONNECT requests, leading to potential unauthorized access and sensitive data exposure.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-3784 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-3784.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-3784" }, { "cve": "CVE-2026-4424", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "Multiple vulnerabilities in libarchive, including a critical heap out-of-bounds read in RAR processing, cause information disclosure, denial of service, and potential code execution, affecting products like Oracle Communications Cloud Native Core Console with a CVSS score of 7.5.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-4424 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-4424.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-4424" }, { "cve": "CVE-2026-28947", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "Multiple use-after-free and heap buffer overflow vulnerabilities in Safari and WebKitGTK, including webkit2gtk3 version 2.52.4, were fixed to prevent crashes and potential remote code execution from malicious web content.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-28947 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28947.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-28947" }, { "cve": "CVE-2026-28958", "notes": [ { "category": "description", "text": "WebKitGTK and related Apple platforms addressed multiple security vulnerabilities including a moderate severity flaw allowing access to sensitive user data, along with fixes for crashes, arbitrary code execution, and rendering issues in recent updates.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-28958 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28958.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-28958" }, { "cve": "CVE-2026-28973", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "other", "text": "Integer Overflow or Wraparound", "title": "CWE-190" }, { "category": "description", "text": "An integer overflow vulnerability in Apple operating systems including iOS, iPadOS, macOS, and watchOS was addressed through enhanced input validation to prevent malicious applications from escaping their sandbox environment.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-28973 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28973.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "baseScore": 8.6, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-28973" }, { "cve": "CVE-2026-28979", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "An out-of-bounds access vulnerability in multiple Apple OS versions was fixed by improved bounds checking to prevent unexpected process crashes triggered by maliciously crafted web content.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-28979 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28979.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-28979" }, { "cve": "CVE-2026-28984", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "A memory handling flaw in Safari causing crashes when processing malicious web content was resolved in iOS 18.7.10 and iPadOS 18.7.10.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-28984 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28984.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-28984" }, { "cve": "CVE-2026-28990", "notes": [ { "category": "description", "text": "A memory corruption vulnerability caused by processing a maliciously crafted image was resolved through improved memory handling across multiple operating systems including iOS 18.7.10, iPadOS 18.7.10, and macOS Sequoia 15.7.7.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-28990 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28990.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-28990" }, { "cve": "CVE-2026-28996", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')" }, "notes": [ { "category": "other", "text": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "title": "CWE-362" }, { "category": "description", "text": "A race condition vulnerability allowing potential unauthorized access to sensitive user data was resolved through additional validation across multiple Apple operating systems including iOS 18.7.10, iPadOS 18.7.10, and macOS Sequoia 15.7.7.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-28996 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28996.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-28996" }, { "cve": "CVE-2026-39868", "notes": [ { "category": "description", "text": "An input validation flaw causing unexpected system termination or kernel memory corruption was fixed across multiple Apple OS versions including iOS 18.7.10, iPadOS 18.7.10, and macOS Sequoia 15.7.8.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-39868 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-39868.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-39868" }, { "cve": "CVE-2026-39872", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "Multiple security vulnerabilities including use-after-free, memory corruption, and arbitrary JavaScript execution in WebKitGTK, Safari, and related Apple OS versions were addressed by improved memory handling to prevent unexpected process crashes caused by malicious web content.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-39872 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-39872.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-39872" }, { "cve": "CVE-2026-39877", "notes": [ { "category": "description", "text": "A memory corruption vulnerability allowing disclosure of kernel memory was addressed by Apple through improved memory handling in iOS 18.7.10, iPadOS 18.7.10, macOS Sequoia 15.7.8, and macOS Sonoma 14.8.8.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-39877 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-39877.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-39877" }, { "cve": "CVE-2026-43658", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')" }, "notes": [ { "category": "other", "text": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "title": "CWE-120" }, { "category": "description", "text": "The webkit2gtk3 2.52.4 update and Safari 26.5 address multiple security vulnerabilities including crashes and potential arbitrary code execution caused by improper memory handling of malicious web content, alongside various bug fixes and feature enhancements.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43658 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43658.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43658" }, { "cve": "CVE-2026-43661", "cwe": { "id": "CWE-121", "name": "Stack-based Buffer Overflow" }, "notes": [ { "category": "other", "text": "Stack-based Buffer Overflow", "title": "CWE-121" }, { "category": "description", "text": "A buffer overflow vulnerability in multiple Apple operating systems was fixed by enhancing memory handling to prevent process memory corruption from maliciously crafted images.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43661 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43661.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43661" }, { "cve": "CVE-2026-43663", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "Multiple security vulnerabilities including use-after-free, memory corruption, and arbitrary JavaScript execution in WebKitGTK, Safari, and related Apple OS versions were addressed by improved memory handling to prevent unexpected process crashes caused by malicious web content.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43663 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43663.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43663" }, { "cve": "CVE-2026-43667", "cwe": { "id": "CWE-617", "name": "Reachable Assertion" }, "notes": [ { "category": "other", "text": "Reachable Assertion", "title": "CWE-617" }, { "category": "description", "text": "A reachable assertion vulnerability in iOS 18.7.10 and iPadOS 18.7.10 could allow an attacker in a privileged network position to cause a denial-of-service through improved input validation.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43667 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43667.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43667" }, { "cve": "CVE-2026-43673", "notes": [ { "category": "description", "text": "A memory corruption vulnerability caused by processing maliciously crafted audio files was resolved through improved memory handling across multiple Apple operating systems including iOS 18.7.10, iPadOS 18.7.10, and macOS Sequoia 15.7.8.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43673 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43673.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43673" }, { "cve": "CVE-2026-43676", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "Multiple vulnerabilities including out-of-bounds access, use-after-free, memory corruption, and sandbox escapes in WebKit and WebKitGTK were fixed by improving bounds checking and other security measures to prevent crashes and arbitrary code execution from malicious web content.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43676 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43676.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43676" }, { "cve": "CVE-2026-43699", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "Multiple use-after-free vulnerabilities and other memory management issues in WebKitGTK, webkit2gtk3, and Apple OS versions cause unexpected process crashes and security risks when processing malicious web content.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43699 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43699.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43699" }, { "cve": "CVE-2026-43700", "cwe": { "id": "CWE-346", "name": "Origin Validation Error" }, "notes": [ { "category": "other", "text": "Origin Validation Error", "title": "CWE-346" }, { "category": "description", "text": "A cross-origin vulnerability was fixed by enhancing security origin tracking in Apple operating systems and Safari to prevent sensitive user information disclosure from malicious web content.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43700 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43700.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43700" }, { "cve": "CVE-2026-43701", "notes": [ { "category": "description", "text": "A vulnerability in WebKitGTK and Safari allowed malicious websites to process restricted web content outside the sandbox, which was fixed by improved checks in updates including webkit2gtk3 2.52.5 and Safari 26.5.2.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43701 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43701.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43701" }, { "cve": "CVE-2026-43705", "cwe": { "id": "CWE-843", "name": "Access of Resource Using Incompatible Type ('Type Confusion')" }, "notes": [ { "category": "other", "text": "Access of Resource Using Incompatible Type ('Type Confusion')", "title": "CWE-843" }, { "category": "description", "text": "Multiple WebKitGTK and Apple OS versions addressed type confusion vulnerabilities causing memory corruption from malicious web content, alongside other issues like use-after-free, out-of-bounds access, sandbox escapes, crashes, and data leaks.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43705 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43705.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43705" }, { "cve": "CVE-2026-43708", "notes": [ { "category": "description", "text": "Multiple Apple OS versions, including Safari 26.5.2 and iOS 18.7.10, addressed a cross-origin data exfiltration vulnerability by implementing improved input validation to prevent malicious websites from exfiltrating data across origins.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43708 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43708.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43708" }, { "cve": "CVE-2026-43711", "notes": [ { "category": "description", "text": "A memory corruption vulnerability causing unexpected application termination when processing maliciously crafted video files was resolved by enhancing memory handling across multiple Apple operating systems.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43711 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43711.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43711" }, { "cve": "CVE-2026-43714", "notes": [ { "category": "description", "text": "The vulnerability was addressed by enhancing input sanitization across multiple OS versions to prevent malicious applications from accessing protected user data.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43714 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43714.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43714" }, { "cve": "CVE-2026-43717", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "A use-after-free vulnerability in Safari across multiple OS versions was fixed by enhancing memory management to prevent crashes caused by maliciously crafted web content.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43717 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43717.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43717" }, { "cve": "CVE-2026-43720", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "Multiple use-after-free vulnerabilities and memory management flaws in WebKitGTK and Apple Safari were fixed to prevent unexpected crashes and security issues caused by maliciously crafted web content.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43720 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43720.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43720" }, { "cve": "CVE-2026-43722", "notes": [ { "category": "description", "text": "A vulnerability in specific versions of iOS, iPadOS, and macOS that allowed apps to leak sensitive kernel state was addressed by implementing improved input sanitization.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43722 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43722.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43722" }, { "cve": "CVE-2026-43723", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "title": "CWE-22" }, { "category": "description", "text": "A path handling vulnerability allowing privilege escalation to root was addressed by Apple through enhanced validation in iOS, iPadOS, macOS, tvOS, visionOS, and watchOS updates.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43723 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43723.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43723" }, { "cve": "CVE-2026-43724", "notes": [ { "category": "description", "text": "An input sanitization flaw in multiple OS versions, including iOS 18.7.10 and macOS Sequoia 15.7.8, allowed apps to cause unexpected system termination or write to kernel memory, which was resolved by improving input validation.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43724 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43724.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43724" }, { "cve": "CVE-2026-43725", "notes": [ { "category": "description", "text": "A vulnerability in WebKitGTK and Safari allowed malicious websites to bypass sandbox restrictions and process restricted web content due to improper input validation, addressed in webkit2gtk3 update 2.52.5 and related Apple OS updates.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43725 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43725.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43725" }, { "cve": "CVE-2026-43726", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "Multiple use-after-free vulnerabilities and other memory management issues in WebKitGTK and Apple platforms were fixed to prevent unexpected process crashes caused by maliciously crafted web content.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43726 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43726.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43726" }, { "cve": "CVE-2026-43727", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "Multiple use-after-free vulnerabilities and other memory management issues in WebKitGTK and Apple Safari were fixed to prevent crashes and security risks from malicious web content.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43727 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43727.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43727" }, { "cve": "CVE-2026-43729", "notes": [ { "category": "description", "text": "A memory corruption vulnerability triggered by processing maliciously crafted images was resolved through enhanced memory handling across multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, and visionOS versions.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43729 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43729.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43729" }, { "cve": "CVE-2026-43731", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "Multiple use-after-free vulnerabilities and other memory management flaws in WebKitGTK and Safari were fixed to prevent memory corruption, crashes, data leaks, and arbitrary JavaScript execution from malicious web content.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43731 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43731.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43731" }, { "cve": "CVE-2026-43733", "notes": [ { "category": "description", "text": "A memory corruption vulnerability triggered by processing maliciously crafted images has been resolved through enhanced memory handling in iOS 18.7.10, iPadOS 18.7.10, iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, and macOS Tahoe 26.6.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43733 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43733.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43733" }, { "cve": "CVE-2026-43734", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "Multiple use-after-free vulnerabilities and other memory management issues in WebKitGTK and Apple platforms were fixed to prevent unexpected process crashes caused by malicious web content.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43734 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43734.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43734" }, { "cve": "CVE-2026-43735", "cwe": { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)" }, "notes": [ { "category": "other", "text": "Cross-Site Request Forgery (CSRF)", "title": "CWE-352" }, { "category": "description", "text": "Apple addressed a cross-origin data exfiltration vulnerability by implementing improved checks across multiple operating systems and Safari versions, including iOS, macOS, tvOS, visionOS, and watchOS.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43735 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43735.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "baseScore": 8.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43735" }, { "cve": "CVE-2026-43738", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "A memory handling vulnerability causing potential process memory disclosure via malicious asset catalogs was fixed in iOS 18.7.10, iPadOS 18.7.10, macOS Sequoia 15.7.8, and macOS Sonoma 14.8.8.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43738 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43738.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43738" }, { "cve": "CVE-2026-43742", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "Multiple use-after-free and memory management vulnerabilities in WebKitGTK and Safari can cause unexpected process crashes when processing malicious web content, addressed in WebKitGTK 2.52.5 and recent Apple OS updates.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43742 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43742.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43742" }, { "cve": "CVE-2026-43744", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "An out-of-bounds write vulnerability in multiple Apple operating systems was fixed by enhancing bounds checking to prevent process termination caused by maliciously crafted audio streams.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43744 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43744.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43744" }, { "cve": "CVE-2026-43745", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "Multiple vulnerabilities including out-of-bounds write, use-after-free, and memory corruption in WebKitGTK and Safari were fixed to prevent crashes and arbitrary JavaScript execution triggered by malicious web content.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43745 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43745.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43745" }, { "cve": "CVE-2026-43754", "notes": [ { "category": "description", "text": "An issue allowing apps to potentially leak sensitive kernel state was addressed by enhanced redaction of sensitive information in iOS 18.7.10, iPadOS 18.7.10, and macOS versions Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43754 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43754.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43754" }, { "cve": "CVE-2026-43757", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "An out-of-bounds read vulnerability causing unexpected system termination was addressed by enhanced bounds checking in iOS 18.7.10, iPadOS 18.7.10, and macOS versions Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43757 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43757.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43757" }, { "cve": "CVE-2026-43769", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "other", "text": "Integer Overflow or Wraparound", "title": "CWE-190" }, { "category": "description", "text": "An integer overflow vulnerability causing unexpected system termination was addressed via enhanced input validation across multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43769 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43769.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43769" }, { "cve": "CVE-2026-43776", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')" }, "notes": [ { "category": "other", "text": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "title": "CWE-120" }, { "category": "description", "text": "A buffer overflow vulnerability in iOS, iPadOS, and macOS was fixed by enhancing bounds checking to prevent unexpected application termination or arbitrary code execution triggered by maliciously crafted files.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43776 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43776.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43776" }, { "cve": "CVE-2026-43778", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "A use after free vulnerability affecting multiple Apple operating systems including iOS 18.7.10, iPadOS 18.7.10, and macOS Sequoia 15.7.8 was fixed through improved memory management to prevent unexpected system termination or kernel memory corruption.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43778 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43778.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43778" }, { "cve": "CVE-2026-43794", "notes": [ { "category": "description", "text": "A memory corruption vulnerability in Safari, iOS, iPadOS, and macOS was addressed by improving memory handling to prevent exploitation via maliciously crafted web content.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43794 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43794.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43794" }, { "cve": "CVE-2026-43795", "notes": [ { "category": "description", "text": "A memory corruption vulnerability causing unexpected Safari crashes from maliciously crafted web content was fixed through improved memory handling and locking in Safari 26.6.1, iOS 18.7.10, iPadOS 18.7.10, and macOS Tahoe 26.6.2.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43795 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43795.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43795" }, { "cve": "CVE-2026-43796", "notes": [ { "category": "description", "text": "A vulnerability allowing unauthorized access to a persistent device identifier was resolved through enhanced data protection across multiple Apple OS versions including iOS 18.7.10, iPadOS 18.7.10, and macOS Sequoia 15.7.8.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43796 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43796.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43796" }, { "cve": "CVE-2026-43797", "notes": [ { "category": "description", "text": "An issue allowing unauthorized access to user contact information was resolved through enhanced validation checks in iOS 18.7.10, iPadOS 18.7.10, iOS 26.6, iPadOS 26.6, and macOS Tahoe 26.6.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43797 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43797.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43797" }, { "cve": "CVE-2026-43799", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "A use-after-free vulnerability causing unexpected system termination was fixed in multiple Apple operating systems including iOS 18.7.10, iPadOS 26.6, macOS 15.7.8, tvOS 14.8.8, visionOS 26.6, and watchOS 26.6 through improved memory management.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43799 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43799.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43799" }, { "cve": "CVE-2026-43800", "notes": [ { "category": "description", "text": "An information disclosure vulnerability in Apple operating systems was addressed by removing vulnerable code in iOS 18.7.10, iPadOS 18.7.10, iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, and watchOS 26.6.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43800 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43800.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43800" }, { "cve": "CVE-2026-43801", "notes": [ { "category": "description", "text": "Improved security checks were implemented in multiple Apple operating systems, including iOS 18.7.10, iPadOS 18.7.10, and macOS Sequoia 15.7.8, to prevent apps from accessing sensitive user data without authorization.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43801 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43801.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43801" }, { "cve": "CVE-2026-43802", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "An out-of-bounds write vulnerability causing unexpected system termination was addressed through enhanced bounds checking in iOS 18.7.10, iPadOS 18.7.10, and macOS versions Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43802 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43802.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43802" }, { "cve": "CVE-2026-43803", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "An out-of-bounds write vulnerability was fixed by enhancing bounds checking across multiple Apple operating systems, preventing remote attackers from causing unexpected system termination.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43803 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43803.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43803" }, { "cve": "CVE-2026-43807", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')" }, "notes": [ { "category": "other", "text": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "title": "CWE-120" }, { "category": "description", "text": "A buffer overflow vulnerability in multiple Apple operating systems was addressed by improved bounds checking to prevent unexpected app termination caused by malicious accessories.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43807 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43807.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43807" }, { "cve": "CVE-2026-43809", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "An out-of-bounds read vulnerability causing unexpected system termination was addressed by enhanced bounds checking in iOS 18.7.10, iPadOS 18.7.10, and macOS versions Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43809 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43809.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43809" }, { "cve": "CVE-2026-43810", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "A memory handling vulnerability allowing remote users to cause unexpected system termination or kernel memory corruption was fixed in multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43810 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43810.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43810" }, { "cve": "CVE-2026-43811", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')" }, "notes": [ { "category": "other", "text": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "title": "CWE-362" }, { "category": "description", "text": "A race condition vulnerability in iOS and iPadOS versions 18.7.10 and 26.6 allowed apps to modify protected file system areas, which was addressed by enhanced validation checks.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43811 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43811.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N", "baseScore": 4.7, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43811" }, { "cve": "CVE-2026-43812", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "A use-after-free vulnerability causing unexpected system termination was resolved through enhanced memory management in Apple operating systems including iOS, iPadOS, macOS, tvOS, and visionOS versions 18.7.10, 26.6, 15.7.8, and 26.6 respectively.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43812 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43812.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43812" }, { "cve": "CVE-2026-43818", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "other", "text": "Integer Overflow or Wraparound", "title": "CWE-190" }, { "category": "description", "text": "An integer overflow vulnerability in iOS, iPadOS, and macOS was addressed by Apple through enhanced input validation to prevent arbitrary code execution via maliciously crafted images.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43818 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43818.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43818" }, { "cve": "CVE-2026-43821", "notes": [ { "category": "description", "text": "An access control vulnerability allowing applications to read files outside their sandbox was addressed through improved restrictions in multiple operating system versions including Safari 26.6 and iOS 18.7.10.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43821 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43821.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43821" }, { "cve": "CVE-2026-43822", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "A use after free vulnerability affecting multiple OS versions including iOS 18.7.10 and macOS Sequoia 15.7.8 was fixed through improved memory management to prevent unexpected system termination caused by apps.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-43822 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43822.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-43822" }, { "cve": "CVE-2026-64692", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "An out-of-bounds read vulnerability affecting multiple OS versions including iOS 18.7.10 and macOS Sequoia 15.7.8 was fixed by implementing improved bounds checking to prevent denial-of-service attacks by applications.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64692 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64692.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64692" }, { "cve": "CVE-2026-64693", "cwe": { "id": "CWE-843", "name": "Access of Resource Using Incompatible Type ('Type Confusion')" }, "notes": [ { "category": "other", "text": "Access of Resource Using Incompatible Type ('Type Confusion')", "title": "CWE-843" }, { "category": "description", "text": "A type confusion vulnerability causing denial-of-service via maliciously crafted images was fixed with improved validation checks in multiple Apple operating systems including iOS 18.7.10, iPadOS 18.7.10, and macOS Sequoia 15.7.8.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64693 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64693.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64693" }, { "cve": "CVE-2026-64695", "notes": [ { "category": "description", "text": "A memory handling vulnerability fixed in iOS 18.7.10, iPadOS 18.7.10, and various macOS versions prevents remote users from causing unexpected system termination or kernel memory corruption.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64695 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64695.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64695" }, { "cve": "CVE-2026-64700", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "A use-after-free vulnerability causing unexpected system termination was fixed in multiple Apple operating systems including iOS 18.7.10, iPadOS 26.6, macOS 15.7.8, tvOS 14.8.8, visionOS 26.6, and watchOS 26.6 through improved memory management.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64700 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64700.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64700" }, { "cve": "CVE-2026-64707", "cwe": { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource" }, "notes": [ { "category": "other", "text": "Incorrect Permission Assignment for Critical Resource", "title": "CWE-732" }, { "category": "description", "text": "A permissions vulnerability allowing apps to delete files without proper authorization was fixed through improved validation across multiple Apple operating systems including iOS, iPadOS, macOS, and visionOS.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64707 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64707.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64707" }, { "cve": "CVE-2026-64709", "notes": [ { "category": "description", "text": "A kernel memory disclosure vulnerability affecting multiple Apple operating systems including iOS 18.7.10, iPadOS 18.7.10, and macOS Sequoia 15.7.8 was resolved through improved memory handling.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64709 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64709.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64709" }, { "cve": "CVE-2026-64715", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "A use-after-free vulnerability in multiple Apple operating systems was fixed by enhancing memory management to prevent unexpected process crashes caused by malicious web content.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64715 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64715.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64715" }, { "cve": "CVE-2026-64716", "notes": [ { "category": "description", "text": "A memory corruption vulnerability caused by processing a maliciously crafted image was resolved through improved memory handling across multiple Apple operating systems including iOS 18.7.10, iPadOS 18.7.10, and macOS Sequoia 15.7.8.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64716 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64716.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64716" }, { "cve": "CVE-2026-64719", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "An out-of-bounds access vulnerability causing unexpected crashes in Safari when processing malicious web content was fixed through improved bounds checking in Safari 26.6 and related OS versions.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64719 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64719.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "baseScore": 8.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64719" }, { "cve": "CVE-2026-64721", "notes": [ { "category": "description", "text": "Apple addressed a vulnerability in multiple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS that could allow apps to access sensitive user data through improved state management.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64721 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64721.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64721" }, { "cve": "CVE-2026-64722", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')" }, "notes": [ { "category": "other", "text": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "title": "CWE-120" }, { "category": "description", "text": "A buffer overflow vulnerability affecting memory processing of 3D models has been addressed in iOS 18.7.10, iPadOS 18.7.10, iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, and macOS Tahoe 26.6 through enhanced memory handling.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64722 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64722.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64722" }, { "cve": "CVE-2026-64723", "notes": [ { "category": "description", "text": "A logic flaw allowing unauthorized app access to sensitive user data was resolved in iOS 18.7.10, iPadOS 18.7.10, and macOS versions Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64723 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64723.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64723" }, { "cve": "CVE-2026-64724", "notes": [ { "category": "description", "text": "A memory handling vulnerability allowing local network attackers to cause denial-of-service was fixed across multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS in their respective recent versions.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64724 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64724.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64724" }, { "cve": "CVE-2026-64725", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "An out-of-bounds write vulnerability causing potential denial-of-service was addressed through improved bounds checking in multiple Apple operating systems including iOS 18.7.10, iPadOS 18.7.10, and macOS Sequoia 15.7.8.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64725 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64725.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64725" }, { "cve": "CVE-2026-64726", "notes": [ { "category": "description", "text": "A memory corruption vulnerability exploitable by an attacker in physical proximity has been addressed in multiple Apple operating systems including iOS 18.7.10, iPadOS 18.7.10, and macOS Tahoe 26.6.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64726 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64726.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64726" }, { "cve": "CVE-2026-64732", "notes": [ { "category": "description", "text": "A vulnerability in iPhone Mirroring allowed attackers with physical access to retrieve sensitive user data, which was resolved by Apple through improved state management in iOS 18.7.10, iPadOS 18.7.10, iOS 26.6, and iPadOS 26.6.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64732 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64732.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 4.6, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64732" }, { "cve": "CVE-2026-64734", "notes": [ { "category": "description", "text": "A sensitive data leakage vulnerability caused by processing maliciously crafted contacts was addressed with improved validation checks across multiple Apple operating systems including iOS, iPadOS, macOS, visionOS, and watchOS.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64734 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64734.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64734" }, { "cve": "CVE-2026-64735", "cwe": { "id": "CWE-451", "name": "User Interface (UI) Misrepresentation of Critical Information" }, "notes": [ { "category": "other", "text": "User Interface (UI) Misrepresentation of Critical Information", "title": "CWE-451" }, { "category": "description", "text": "An inconsistent user interface issue in multiple Apple OS versions was fixed by improving state management to prevent remote attackers from bypassing network filters.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64735 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64735.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64735" }, { "cve": "CVE-2026-64738", "notes": [ { "category": "description", "text": "A permissions vulnerability allowing malicious apps to escape their sandbox was addressed with enhanced restrictions in iOS 18.7.10, iPadOS 18.7.10, and macOS versions Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64738 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64738.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64738" }, { "cve": "CVE-2026-64739", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "An out-of-bounds write vulnerability causing unexpected application termination was addressed by enhanced bounds checking across multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64739 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64739.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64739" }, { "cve": "CVE-2026-64740", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "title": "CWE-22" }, { "category": "description", "text": "A parsing issue in directory path handling was fixed with improved path validation in multiple Apple OS versions to prevent malicious apps from escaping their sandbox environment.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64740 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64740.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.3, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64740" }, { "cve": "CVE-2026-64742", "cwe": { "id": "CWE-319", "name": "Cleartext Transmission of Sensitive Information" }, "notes": [ { "category": "other", "text": "Cleartext Transmission of Sensitive Information", "title": "CWE-319" }, { "category": "description", "text": "The vulnerability involving potential unauthorized access to sensitive user data by an app was addressed by enforcing HTTPS for network communication and resolved in specific versions of iOS, iPadOS, tvOS, visionOS, and watchOS.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64742 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64742.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64742" }, { "cve": "CVE-2026-64743", "notes": [ { "category": "description", "text": "An authorization flaw allowing apps to access sensitive user data was resolved via enhanced state management across multiple Apple OS versions including iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS 26.6 and iOS/iPadOS 18.7.10.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64743 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64743.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64743" }, { "cve": "CVE-2026-64744", "notes": [ { "category": "description", "text": "An information leakage vulnerability allowing kernel memory disclosure was addressed through enhanced validation in iOS 18.7.10, iPadOS 18.7.10, and macOS versions Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64744 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64744.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64744" }, { "cve": "CVE-2026-64746", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "notes": [ { "category": "other", "text": "Missing Authorization", "title": "CWE-862" }, { "category": "description", "text": "An authorization vulnerability allowing applications to add contacts without user consent was resolved through enhanced validation in multiple Apple operating systems including iOS, iPadOS, macOS, visionOS, and watchOS versions 18.7.10 and 26.6.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64746 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64746.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64746" }, { "cve": "CVE-2026-64747", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')" }, "notes": [ { "category": "other", "text": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "title": "CWE-120" }, { "category": "description", "text": "A buffer overflow vulnerability allowing arbitrary code execution with kernel privileges was fixed by enhancing size validation in multiple OS versions including iOS 18.7.10, iPadOS 18.7.10, and macOS Sequoia 15.7.8.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64747 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64747.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64747" }, { "cve": "CVE-2026-64749", "notes": [ { "category": "description", "text": "A memory handling flaw that could cause unexpected system termination or kernel memory corruption via an app was fixed in multiple Apple operating systems including iOS, iPadOS, macOS, and visionOS versions 18.7.10, 26.6, 15.7.8, and 26.6 respectively.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64749 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64749.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64749" }, { "cve": "CVE-2026-64755", "notes": [ { "category": "description", "text": "An authorization issue in iOS 18.7.10, iPadOS 18.7.10, iOS 26.6, and iPadOS 26.6 allowed apps to access sensitive user data, which was resolved through improved state management.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64755 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64755.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64755" }, { "cve": "CVE-2026-64757", "notes": [ { "category": "description", "text": "A memory corruption vulnerability causing unexpected crashes in Safari when processing malicious web content was fixed by improving state management in Safari 26.6 and related OS versions.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64757 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64757.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64757" }, { "cve": "CVE-2026-64760", "notes": [ { "category": "description", "text": "An information leakage vulnerability in iOS 18.7.10 and iPadOS 18.7.10 was addressed by implementing additional validation to prevent apps from exposing sensitive kernel state.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64760 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64760.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64760" }, { "cve": "CVE-2026-64762", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "An out-of-bounds read vulnerability in iOS 18.7.10, iPadOS 18.7.10, and multiple macOS versions was fixed by improving bounds checking to prevent apps from causing unexpected system termination.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64762 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64762.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64762" }, { "cve": "CVE-2026-64763", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "A vulnerability involving out-of-bounds write in multiple OS versions was fixed by removing vulnerable code, preventing unexpected application termination or arbitrary code execution triggered by maliciously crafted files.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64763 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64763.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64763" }, { "cve": "CVE-2026-64764", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "An out-of-bounds write vulnerability affecting multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS has been addressed through improved bounds checking to prevent app crashes and arbitrary code execution.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64764 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64764.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64764" }, { "cve": "CVE-2026-64765", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "other", "text": "Integer Overflow or Wraparound", "title": "CWE-190" }, { "category": "description", "text": "An integer overflow vulnerability was fixed by enhancing input validation across multiple OS versions to prevent unexpected application termination or arbitrary code execution from maliciously crafted files.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64765 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64765.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64765" }, { "cve": "CVE-2026-64766", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "other", "text": "Integer Overflow or Wraparound", "title": "CWE-190" }, { "category": "description", "text": "An integer overflow vulnerability was fixed by enhancing input validation across multiple OS versions to prevent unexpected application termination or arbitrary code execution from maliciously crafted files.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64766 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64766.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64766" }, { "cve": "CVE-2026-64768", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "An out-of-bounds read vulnerability allowing remote attackers to cause unexpected app termination was fixed via improved input validation in Apple’s iOS, iPadOS, macOS, tvOS, and visionOS.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64768 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64768.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "baseScore": 8.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64768" }, { "cve": "CVE-2026-64769", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "An out-of-bounds write vulnerability affecting multiple Apple operating systems was addressed by enhancing bounds checking to prevent application crashes and heap corruption.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64769 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64769.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64769" }, { "cve": "CVE-2026-64770", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "An out-of-bounds write vulnerability affecting multiple Apple operating systems was addressed by enhancing bounds checking to prevent application crashes and heap corruption.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64770 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64770.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64770" }, { "cve": "CVE-2026-64771", "notes": [ { "category": "description", "text": "A buffer overflow vulnerability allowing remote attackers to cause application termination or heap corruption was fixed via improved bounds checking in multiple Apple operating systems including iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, and visionOS.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64771 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64771.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64771" }, { "cve": "CVE-2026-64772", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "An out-of-bounds write vulnerability in multiple Apple operating systems was addressed by improved input validation to prevent remote attackers from causing application termination or heap corruption.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64772 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64772.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64772" }, { "cve": "CVE-2026-64774", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "other", "text": "Integer Overflow or Wraparound", "title": "CWE-190" }, { "category": "description", "text": "An integer overflow vulnerability in multiple Apple operating systems was addressed through enhanced input validation to prevent application termination or heap corruption.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64774 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64774.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64774" }, { "cve": "CVE-2026-64778", "notes": [ { "category": "description", "text": "A vulnerability in Safari, iOS, iPadOS, and macOS allowed sensitive data leakage when visiting maliciously crafted websites, which was resolved by implementing improved checks to prevent such leakage.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64778 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64778.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64778" }, { "cve": "CVE-2026-64779", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')" }, "notes": [ { "category": "other", "text": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "title": "CWE-362" }, { "category": "description", "text": "A memory corruption vulnerability in Safari caused crashes when processing malicious web content and was fixed by improved locking in Safari 26.6.1 and related OS updates.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64779 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64779.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L", "baseScore": 3.1, "baseSeverity": "LOW" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64779" }, { "cve": "CVE-2026-64780", "notes": [ { "category": "description", "text": "Safari versions including 26.6.1 and related OS releases addressed a crash vulnerability caused by processing maliciously crafted web content through improved validation checks.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64780 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64780.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64780" }, { "cve": "CVE-2026-64781", "notes": [ { "category": "description", "text": "Improved input validation resolved an issue in Safari and related OS versions that caused unexpected crashes when processing maliciously crafted web content.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64781 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64781.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64781" }, { "cve": "CVE-2026-64782", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')" }, "notes": [ { "category": "other", "text": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "title": "CWE-362" }, { "category": "description", "text": "A memory corruption vulnerability in Safari was resolved by enhancing locking mechanisms to prevent crashes caused by malicious web content, fixed in Safari 26.6.1 and macOS Tahoe 26.6.2.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64782 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64782.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L", "baseScore": 3.1, "baseSeverity": "LOW" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64782" }, { "cve": "CVE-2026-64784", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "An out-of-bounds access vulnerability causing potential Safari crashes when processing malicious web content was resolved by enhancing bounds checking in Safari 26.6.1 and related operating system versions.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-64784 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64784.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-64784" }, { "cve": "CVE-2026-65331", "notes": [ { "category": "description", "text": "Safari 26.6.1 and related OS versions include improved memory and state management to prevent unexpected crashes and memory corruption caused by processing maliciously crafted web content.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-65331 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65331.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-65331" }, { "cve": "CVE-2026-65332", "notes": [ { "category": "description", "text": "Safari 26.6.1 and related OS versions include improved memory and state management to prevent unexpected crashes and memory corruption caused by processing maliciously crafted web content.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-65332 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65332.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-65332" }, { "cve": "CVE-2026-65333", "notes": [ { "category": "description", "text": "Safari 26.6.1 and related OS versions include improved memory and state management to prevent unexpected crashes and memory corruption caused by processing maliciously crafted web content.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-65333 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65333.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-65333" }, { "cve": "CVE-2026-65334", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "A memory corruption vulnerability causing unexpected Safari crashes when processing malicious web content was fixed by improving state management in Safari 26.6.1 and related OS updates.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-65334 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65334.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-65334" }, { "cve": "CVE-2026-65335", "notes": [ { "category": "description", "text": "Safari 26.6.1 and related OS versions include improved memory and state management to prevent unexpected crashes and memory corruption caused by processing maliciously crafted web content.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-65335 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65335.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-65335" }, { "cve": "CVE-2026-65336", "notes": [ { "category": "description", "text": "Safari 26.6.1 and related OS versions include improved memory and state management to prevent unexpected crashes and memory corruption caused by processing maliciously crafted web content.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-65336 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65336.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-65336" }, { "cve": "CVE-2026-65337", "notes": [ { "category": "description", "text": "Safari 26.6.1 and related OS versions include improved memory and state management to prevent unexpected crashes and memory corruption caused by processing maliciously crafted web content.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-65337 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65337.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-65337" }, { "cve": "CVE-2026-65338", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "Improved memory handling in Safari, iOS, iPadOS, and macOS prevents memory corruption and unexpected crashes caused by processing maliciously crafted web content.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-65338 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65338.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-65338" }, { "cve": "CVE-2026-65340", "notes": [ { "category": "description", "text": "A memory corruption vulnerability in Safari was fixed by improving locking and state management to prevent crashes caused by malicious web content.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-65340 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65340.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-65340" }, { "cve": "CVE-2026-65341", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "A memory corruption vulnerability caused by processing maliciously crafted web content was resolved through improved memory handling in Safari 26.6.1, iOS 18.7.10 and 26.6.1, iPadOS 18.7.10 and 26.6.1, and macOS Tahoe 26.6.2.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-65341 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65341.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-65341" } ] }