pwn.watch: iOS incident updates

[critical] Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)

Thu, 22 Oct 2026 16:00:43 GMT

A bug in RingRTC, the open-source library behind Signal's voice and video calls, lets the other party on a call flood the call's state-machine event queue so a local hang-up gets stuck behind the backlog, and audio (possibly video) keeps flowing to them after the victim thinks the call ended. Affects every Signal client (Android, iOS, Desktop) embedding RingRTC before 2.72.0. Fixed in RingRTC 2.72.0 (released Sep 4 2026, disclosed Oct 20); a conceptual PoC is public, no known exploitation.

Status: closed · Patch: patched · Fixed in: RingRTC 2.72.0 (update Signal on every device)

Latest updates:

2026-10-22: No known exploitation; CISA has not added it to KEV and NVD lists it as awaiting analysis. (source)
2026-10-22: SecurityWeek: the hang-up was queued behind peer events with no rate limit or priority; the fix makes call termination bypass the queue. Users should update Signal and check the call indicator after hanging up. (source)
2026-10-22: Closed on pwn.watch: the fix shipped Sep 4 (RingRTC 2.72.0), there is still no known exploitation and no new developments, so this is now a patch-and-move-on item. Make sure Signal is updated on every device. (source)

CVEs: CVE-2026-113380

[high] Apple CoreGraphics zero-day CVE-2026-86950

Tue, 29 Sep 2026 00:00:00 GMT

Apple patched CVE-2026-86950, an out-of-bounds write in CoreGraphics that may lead to arbitrary code execution, and indicated it may have been exploited in a sophisticated targeted attack against earlier iOS versions. Fixed in iOS/iPadOS 26.7.1 and corresponding macOS updates. CISA added to KEV Sept 29.

Status: closed · Patch: patched · Fixed in: iOS/iPadOS 26.7.1, macOS security updates per Apple HT149226/149228/149229

CVEs: CVE-2026-86950

[high] Apple Multiple Products: Apple Multiple Products Improper Locking Vulnerability

Fri, 20 Mar 2026 00:00:00 GMT

Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability that could allow a malicious application to cause unexpected changes in memory shared between processes. CISA added CVE-2025-43510, CVE-2025-43520, CVE-2025-31277 to the Known Exploited Vulnerabilities catalog on 2026-03-20 based on evidence of active exploitation.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-03-20: CISA added CVE-2025-43510, CVE-2025-43520, CVE-2025-31277 to the KEV catalog (due 2026-04-03).

CVEs: CVE-2025-43510, CVE-2025-43520, CVE-2025-31277

[high] Apple Multiple Products: Apple Multiple Buffer Overflow Vulnerability

Thu, 12 Feb 2026 00:00:00 GMT

Apple iOS, macOS, tvOS, watchOS, and visionOS contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow an attacker with memory write the capability to execute arbitrary code. Added to CISA KEV on 2026-02-12.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-02-12: CISA added CVE-2026-20700 to the KEV catalog (due 2026-03-05).

CVEs: CVE-2026-20700

[high] Apple Multiple Products: Multiple Products Use-After-Free WebKit Vulnerability

Mon, 15 Dec 2025 00:00:00 GMT

Apple iOS, iPadOS, macOS, and other Apple products contain a use-after-free vulnerability in WebKit. Processing maliciously crafted web content may lead to memory corruption. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2025-12-15.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-12-15: CISA added CVE-2025-43529 to the KEV catalog (due 2026-01-05).

CVEs: CVE-2025-43529

[high] Apple Multiple Products: Multiple Products Unspecified Vulnerability

Mon, 20 Oct 2025 00:00:00 GMT

Apple macOS, iOS, tvOS, Safari, and watchOS contain an unspecified vulnerability in JavaScriptCore that when processing web content may lead to arbitrary code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Added to CISA KEV on 2025-10-20.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-10-20: CISA added CVE-2022-48503 to the KEV catalog (due 2025-11-10).

CVEs: CVE-2022-48503

[critical] Apple iOS, iPadOS, and macOS: iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability

Thu, 21 Aug 2025 00:00:00 GMT

Apple iOS, iPadOS, and macOS contain an out-of-bounds write vulnerability in the Image I/O framework. Added to CISA KEV on 2025-08-21.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-08-21: CISA added CVE-2025-43300 to the KEV catalog (due 2025-09-11).

CVEs: CVE-2025-43300

[medium] Apple Multiple Products: Multiple Products Unspecified Vulnerability

Mon, 16 Jun 2025 00:00:00 GMT

Apple iOS, iPadOS, macOS, watchOS, and visionOS, contain an unspecified vulnerability when processing a maliciously crafted photo or video shared via an iCloud Link. Added to CISA KEV on 2025-06-16.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-06-16: CISA added CVE-2025-43200 to the KEV catalog (due 2025-07-07).

CVEs: CVE-2025-43200

[critical] Apple Multiple Products: 2 exploited vulnerabilities (CVE-2025-31200, CVE-2025-31201)

Thu, 17 Apr 2025 00:00:00 GMT

CVE-2025-31200: Apple iOS, iPadOS, macOS, and other Apple products contain a memory corruption vulnerability that allows for code execution when processing an audio stream in a maliciously crafted media file. CVE-2025-31201: Apple iOS, iPadOS, macOS, and other Apple products contain an arbitrary read and write vulnerability that allows an attacker to bypass Pointer Authentication. Added to CISA KEV on 2025-04-17.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-04-17: CISA added CVE-2025-31200 to the KEV catalog (due 2025-05-08).
2025-04-17: CISA added CVE-2025-31201 to the KEV catalog (due 2025-05-08).

CVEs: CVE-2025-31200, CVE-2025-31201

[critical] Apple Multiple Products: Multiple Products WebKit Out-of-Bounds Write Vulnerability

Thu, 13 Mar 2025 00:00:00 GMT

Apple iOS, iPadOS, macOS, and other Apple products contain an out-of-bounds write vulnerability in WebKit that may allow maliciously crafted web content to break out of Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2025-03-13.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-03-13: CISA added CVE-2025-24201 to the KEV catalog (due 2025-04-03).

CVEs: CVE-2025-24201

[medium] Apple iOS and iPadOS: iOS and iPadOS Incorrect Authorization Vulnerability

Wed, 12 Feb 2025 00:00:00 GMT

Apple iOS and iPadOS contains an incorrect authorization vulnerability that allows a physical attacker to disable USB Restricted Mode on a locked device. Added to CISA KEV on 2025-02-12.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-02-12: CISA added CVE-2025-24200 to the KEV catalog (due 2025-03-05).

CVEs: CVE-2025-24200

[critical] Apple Multiple Products: Multiple Products Use-After-Free Vulnerability

Wed, 29 Jan 2025 00:00:00 GMT

Apple iOS, macOS, and other Apple products contain a user-after-free vulnerability that could allow a malicious application to elevate privileges. Added to CISA KEV on 2025-01-29.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-01-29: CISA added CVE-2025-24085 to the KEV catalog (due 2025-02-19).

CVEs: CVE-2025-24085

[high] Apple Multiple Products: 2 actively exploited vulnerabilities

Thu, 21 Nov 2024 00:00:00 GMT

CVE-2024-44308: Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to arbitrary code execution. CVE-2024-44309: Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to a cross-site scripting (XSS) attack. Added to the CISA KEV catalog on 2024-11-21.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-11-21: CISA added CVE-2024-44308 to the KEV catalog (federal deadline 2024-12-12) (source)
2024-11-21: CISA added CVE-2024-44309 to the KEV catalog (federal deadline 2024-12-12) (source)
2024-11-19: CVE-2024-44308 published (source)

CVEs: CVE-2024-44308, CVE-2024-44309

[high] Apple Multiple Products: 2 actively exploited vulnerabilities

Wed, 06 Mar 2024 00:00:00 GMT

CVE-2024-23225: Apple iOS, iPadOS, macOS, tvOS, watchOS, and visionOS kernel contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections. CVE-2024-23296: Apple iOS, iPadOS, macOS, tvOS, and watchOS RTKit contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections. Added to the CISA KEV catalog on 2024-03-06.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-03-06: CISA added CVE-2024-23225 to the KEV catalog (federal deadline 2024-03-27) (source)
2024-03-06: CISA added CVE-2024-23296 to the KEV catalog (federal deadline 2024-03-27) (source)
2024-03-05: CVE-2024-23225 published (source)

CVEs: CVE-2024-23225, CVE-2024-23296

[high] Apple Multiple Products Memory Corruption

Wed, 31 Jan 2024 00:00:00 GMT

Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a time-of-check/time-of-use (TOCTOU) memory corruption vulnerability that allows an attacker with read and write capabilities to bypass Pointer Authentication. Added to the CISA KEV catalog on 2024-01-31. CVE-2022-48618 was assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-01-31: CISA added CVE-2022-48618 to the KEV catalog (federal deadline 2024-02-21) (source)
2024-01-09: CVE-2022-48618 published (source)

CVEs: CVE-2022-48618

[high] Apple Multiple Products WebKit Type Confusion

Tue, 23 Jan 2024 00:00:00 GMT

Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to the CISA KEV catalog on 2024-01-23.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-01-23: CVE-2024-23222 published (source)
2024-01-23: CISA added CVE-2024-23222 to the KEV catalog (federal deadline 2024-02-13) (source)

CVEs: CVE-2024-23222

[high] Apple Multiple Products Code Execution

Mon, 08 Jan 2024 00:00:00 GMT

Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability that allows for code execution when processing a font file. Added to the CISA KEV catalog on 2024-01-08. CVE-2023-41990 was assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-01-08: CISA added CVE-2023-41990 to the KEV catalog (federal deadline 2024-01-29) (source)

CVEs: CVE-2023-41990

[high] Operation Triangulation: zero-click iMessage spyware on Kaspersky's iPhones

Wed, 27 Dec 2023 00:00:00 GMT

Kaspersky found a years-long zero-click iMessage campaign on its own staff's iPhones. The chain used several Apple zero-days, including a bypass of hardware memory protections through undocumented MMIO registers (CVE-2023-38606), which was revealed at 37C3 in December 2023.

Status: closed · Patch: patched · Fixed in: CVE-2023-32434: iOS 16.5.1, iOS 15.7.7, macOS Ventura 13.4.1, Monterey 12.6.7, Big Sur 11.7.8, watchOS 9.5.2, 8.8.1 (NVD), CVE-2023-32435: iOS 16.4, iOS 15.7.7, macOS Ventura 13.3, Safari 16.4 (NVD), CVE-2023-38606: iOS 16.6, iOS 15.7.8, macOS Ventura 13.5, Monterey 12.6.8, Big Sur 11.7.9, tvOS 16.6, watchOS 9.6 (NVD)

Latest updates:

2023-12-27: At 37C3, Kaspersky details the hardware-feature bypass behind CVE-2023-38606 (source)
2023-07-24: Apple fixes CVE-2023-38606 (iOS 16.6); KEV entry follows on July 26 (source)
2023-06-21: Apple fixes CVE-2023-32434 and CVE-2023-32435; CISA adds them to KEV on June 23 (source)

CVEs: CVE-2023-32434, CVE-2023-32435, CVE-2023-38606

[high] Apple Multiple Products: 2 exploited vulnerabilities (CVE-2023-42916, CVE-2023-42917)

Mon, 04 Dec 2023 00:00:00 GMT

Apple iOS, iPadOS, macOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-12-04.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-12-04: CISA added CVE-2023-42916 to the KEV catalog (due 2023-12-25).
2023-12-04: CISA added CVE-2023-42917 to the KEV catalog (due 2023-12-25).

CVEs: CVE-2023-42916, CVE-2023-42917

[high] Apple iOS and iPadOS: Kernel Privilege Escalation (CVE-2023-42824)

Thu, 05 Oct 2023 00:00:00 GMT

Apple iOS and iPadOS contain an unspecified vulnerability that allows for local privilege escalation. Added to CISA KEV on 2023-10-05.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-10-05: CISA added CVE-2023-42824 to the KEV catalog (due 2023-10-26).

CVEs: CVE-2023-42824

[high] Apple Multiple Products: 3 exploited vulnerabilities (CVE-2023-41991, CVE-2023-41992, CVE-2023-41993)

Mon, 25 Sep 2023 00:00:00 GMT

Apple iOS, iPadOS, macOS, and watchOS contain an improper certificate validation vulnerability that can allow a malicious app to bypass signature validation. Apple iOS, iPadOS, macOS, and watchOS contain an unspecified vulnerability that allows for local privilege escalation. Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-09-25.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-09-25: CISA added CVE-2023-41991 to the KEV catalog (due 2023-10-16).
2023-09-25: CISA added CVE-2023-41992 to the KEV catalog (due 2023-10-16).
2023-09-25: CISA added CVE-2023-41993 to the KEV catalog (due 2023-10-16).

CVEs: CVE-2023-41991, CVE-2023-41992, CVE-2023-41993

[high] BLASTPASS: NSO zero-click iPhone exploit chain (CVE-2023-41064, CVE-2023-41061)

Mon, 11 Sep 2023 00:00:00 GMT

Citizen Lab caught BLASTPASS, a zero-click iMessage exploit chain that delivered NSO Group's Pegasus through malicious PassKit attachments carrying images. Apple fixed the ImageIO and Wallet bugs in emergency updates the same day.

Status: closed · Patch: patched · Fixed in: iOS 16.6.1 and iPadOS 16.6.1, iOS 15.7.9 and iPadOS 15.7.9, macOS Ventura 13.5.2, macOS Monterey 12.6.9, macOS Big Sur 11.7.10, watchOS 9.6.2

Latest updates:

2023-09-11: CISA adds both CVEs to the KEV catalog
2023-09-07: Citizen Lab discloses BLASTPASS; Apple ships iOS 16.6.1 and related updates (source)

CVEs: CVE-2023-41064, CVE-2023-41061

[high] Apple Multiple Products: WebKit Code Execution (CVE-2023-37450)

Thu, 13 Jul 2023 00:00:00 GMT

Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-07-13.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-07-13: CISA added CVE-2023-37450 to the KEV catalog (due 2023-08-03).

CVEs: CVE-2023-37450

[high] Apple Multiple Products: WebKit Type Confusion (CVE-2023-32439)

Fri, 23 Jun 2023 00:00:00 GMT

Apple iOS, iPadOS, macOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-06-23.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-06-23: CISA added CVE-2023-32439 to the KEV catalog (due 2023-07-14).

CVEs: CVE-2023-32439

[high] Apple Multiple Products: 3 exploited vulnerabilities (CVE-2023-28204, CVE-2023-32373, CVE-2023-32409)

Mon, 22 May 2023 00:00:00 GMT

Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an unspecified vulnerability that can allow a remote attacker to break out of the Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-05-22.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-05-22: CISA added CVE-2023-28204 to the KEV catalog (due 2023-06-12).
2023-05-22: CISA added CVE-2023-32373 to the KEV catalog (due 2023-06-12).
2023-05-22: CISA added CVE-2023-32409 to the KEV catalog (due 2023-06-12).

CVEs: CVE-2023-28204, CVE-2023-32373, CVE-2023-32409

[high] Apple iOS, iPadOS, and macOS: IOSurfaceAccelerator Out-of-Bounds Write (CVE-2023-28206)

Mon, 10 Apr 2023 00:00:00 GMT

Apple iOS, iPadOS, and macOS IOSurfaceAccelerator contain an out-of-bounds write vulnerability that allows an app to execute code with kernel privileges. Added to CISA KEV on 2023-04-10.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-04-10: CISA added CVE-2023-28206 to the KEV catalog (due 2023-05-01).

CVEs: CVE-2023-28206

[high] Apple Multiple Products: WebKit Use-After-Free (CVE-2023-28205)

Mon, 10 Apr 2023 00:00:00 GMT

Apple iOS, iPadOS, macOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-04-10.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-04-10: CISA added CVE-2023-28205 to the KEV catalog (due 2023-05-01).

CVEs: CVE-2023-28205

[high] Apple Multiple Products: WebKit Type Confusion (CVE-2023-23529)

Tue, 14 Feb 2023 00:00:00 GMT

Apple iOS, MacOS, Safari and iPadOS WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-02-14.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-02-14: CISA added CVE-2023-23529 to the KEV catalog (due 2023-03-07).

CVEs: CVE-2023-23529