pwn.watch: macOS incident updates

[high] Apple CoreGraphics zero-day CVE-2026-86950

Tue, 29 Sep 2026 00:00:00 GMT

Apple patched CVE-2026-86950, an out-of-bounds write in CoreGraphics that may lead to arbitrary code execution, and indicated it may have been exploited in a sophisticated targeted attack against earlier iOS versions. Fixed in iOS/iPadOS 26.7.1 and corresponding macOS updates. CISA added to KEV Sept 29.

Status: closed · Patch: patched · Fixed in: iOS/iPadOS 26.7.1, macOS security updates per Apple HT149226/149228/149229

CVEs: CVE-2026-86950

[high] Apple macOS: Apple macOS Improper Authentication Vulnerability

Tue, 18 Aug 2026 00:00:00 GMT

Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials. Added to CISA KEV on 2026-08-18.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-08-18: CISA added CVE-2026-65400 to the KEV catalog (due 2026-08-21).

CVEs: CVE-2026-65400

[high] Apple Multiple Products: Apple Multiple Products Improper Locking Vulnerability

Fri, 20 Mar 2026 00:00:00 GMT

Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability that could allow a malicious application to cause unexpected changes in memory shared between processes. CISA added CVE-2025-43510, CVE-2025-43520, CVE-2025-31277 to the Known Exploited Vulnerabilities catalog on 2026-03-20 based on evidence of active exploitation.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-03-20: CISA added CVE-2025-43510, CVE-2025-43520, CVE-2025-31277 to the KEV catalog (due 2026-04-03).

CVEs: CVE-2025-43510, CVE-2025-43520, CVE-2025-31277

[high] Apple Multiple Products: Apple Multiple Buffer Overflow Vulnerability

Thu, 12 Feb 2026 00:00:00 GMT

Apple iOS, macOS, tvOS, watchOS, and visionOS contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow an attacker with memory write the capability to execute arbitrary code. Added to CISA KEV on 2026-02-12.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-02-12: CISA added CVE-2026-20700 to the KEV catalog (due 2026-03-05).

CVEs: CVE-2026-20700

[high] Apple Multiple Products: Multiple Products Use-After-Free WebKit Vulnerability

Mon, 15 Dec 2025 00:00:00 GMT

Apple iOS, iPadOS, macOS, and other Apple products contain a use-after-free vulnerability in WebKit. Processing maliciously crafted web content may lead to memory corruption. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2025-12-15.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-12-15: CISA added CVE-2025-43529 to the KEV catalog (due 2026-01-05).

CVEs: CVE-2025-43529

[high] Apple Multiple Products: Multiple Products Unspecified Vulnerability

Mon, 20 Oct 2025 00:00:00 GMT

Apple macOS, iOS, tvOS, Safari, and watchOS contain an unspecified vulnerability in JavaScriptCore that when processing web content may lead to arbitrary code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Added to CISA KEV on 2025-10-20.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-10-20: CISA added CVE-2022-48503 to the KEV catalog (due 2025-11-10).

CVEs: CVE-2022-48503

[critical] Apple iOS, iPadOS, and macOS: iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability

Thu, 21 Aug 2025 00:00:00 GMT

Apple iOS, iPadOS, and macOS contain an out-of-bounds write vulnerability in the Image I/O framework. Added to CISA KEV on 2025-08-21.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-08-21: CISA added CVE-2025-43300 to the KEV catalog (due 2025-09-11).

CVEs: CVE-2025-43300

[medium] Apple Multiple Products: Multiple Products Unspecified Vulnerability

Mon, 16 Jun 2025 00:00:00 GMT

Apple iOS, iPadOS, macOS, watchOS, and visionOS, contain an unspecified vulnerability when processing a maliciously crafted photo or video shared via an iCloud Link. Added to CISA KEV on 2025-06-16.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-06-16: CISA added CVE-2025-43200 to the KEV catalog (due 2025-07-07).

CVEs: CVE-2025-43200

[critical] Apple Multiple Products: 2 exploited vulnerabilities (CVE-2025-31200, CVE-2025-31201)

Thu, 17 Apr 2025 00:00:00 GMT

CVE-2025-31200: Apple iOS, iPadOS, macOS, and other Apple products contain a memory corruption vulnerability that allows for code execution when processing an audio stream in a maliciously crafted media file. CVE-2025-31201: Apple iOS, iPadOS, macOS, and other Apple products contain an arbitrary read and write vulnerability that allows an attacker to bypass Pointer Authentication. Added to CISA KEV on 2025-04-17.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-04-17: CISA added CVE-2025-31200 to the KEV catalog (due 2025-05-08).
2025-04-17: CISA added CVE-2025-31201 to the KEV catalog (due 2025-05-08).

CVEs: CVE-2025-31200, CVE-2025-31201

[critical] Apple Multiple Products: Multiple Products WebKit Out-of-Bounds Write Vulnerability

Thu, 13 Mar 2025 00:00:00 GMT

Apple iOS, iPadOS, macOS, and other Apple products contain an out-of-bounds write vulnerability in WebKit that may allow maliciously crafted web content to break out of Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2025-03-13.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-03-13: CISA added CVE-2025-24201 to the KEV catalog (due 2025-04-03).

CVEs: CVE-2025-24201

[critical] Apple Multiple Products: Multiple Products Use-After-Free Vulnerability

Wed, 29 Jan 2025 00:00:00 GMT

Apple iOS, macOS, and other Apple products contain a user-after-free vulnerability that could allow a malicious application to elevate privileges. Added to CISA KEV on 2025-01-29.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-01-29: CISA added CVE-2025-24085 to the KEV catalog (due 2025-02-19).

CVEs: CVE-2025-24085

[high] Apple Multiple Products: 2 actively exploited vulnerabilities

Thu, 21 Nov 2024 00:00:00 GMT

CVE-2024-44308: Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to arbitrary code execution. CVE-2024-44309: Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to a cross-site scripting (XSS) attack. Added to the CISA KEV catalog on 2024-11-21.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-11-21: CISA added CVE-2024-44308 to the KEV catalog (federal deadline 2024-12-12) (source)
2024-11-21: CISA added CVE-2024-44309 to the KEV catalog (federal deadline 2024-12-12) (source)
2024-11-19: CVE-2024-44308 published (source)

CVEs: CVE-2024-44308, CVE-2024-44309

[high] Apple Multiple Products: 2 actively exploited vulnerabilities

Wed, 06 Mar 2024 00:00:00 GMT

CVE-2024-23225: Apple iOS, iPadOS, macOS, tvOS, watchOS, and visionOS kernel contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections. CVE-2024-23296: Apple iOS, iPadOS, macOS, tvOS, and watchOS RTKit contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections. Added to the CISA KEV catalog on 2024-03-06.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-03-06: CISA added CVE-2024-23225 to the KEV catalog (federal deadline 2024-03-27) (source)
2024-03-06: CISA added CVE-2024-23296 to the KEV catalog (federal deadline 2024-03-27) (source)
2024-03-05: CVE-2024-23225 published (source)

CVEs: CVE-2024-23225, CVE-2024-23296

[high] Apple Multiple Products Memory Corruption

Wed, 31 Jan 2024 00:00:00 GMT

Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a time-of-check/time-of-use (TOCTOU) memory corruption vulnerability that allows an attacker with read and write capabilities to bypass Pointer Authentication. Added to the CISA KEV catalog on 2024-01-31. CVE-2022-48618 was assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-01-31: CISA added CVE-2022-48618 to the KEV catalog (federal deadline 2024-02-21) (source)
2024-01-09: CVE-2022-48618 published (source)

CVEs: CVE-2022-48618

[high] Apple Multiple Products WebKit Type Confusion

Tue, 23 Jan 2024 00:00:00 GMT

Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to the CISA KEV catalog on 2024-01-23.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-01-23: CVE-2024-23222 published (source)
2024-01-23: CISA added CVE-2024-23222 to the KEV catalog (federal deadline 2024-02-13) (source)

CVEs: CVE-2024-23222

[high] Apple Multiple Products Code Execution

Mon, 08 Jan 2024 00:00:00 GMT

Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability that allows for code execution when processing a font file. Added to the CISA KEV catalog on 2024-01-08. CVE-2023-41990 was assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-01-08: CISA added CVE-2023-41990 to the KEV catalog (federal deadline 2024-01-29) (source)

CVEs: CVE-2023-41990

[high] Apple Multiple Products: 2 exploited vulnerabilities (CVE-2023-42916, CVE-2023-42917)

Mon, 04 Dec 2023 00:00:00 GMT

Apple iOS, iPadOS, macOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-12-04.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-12-04: CISA added CVE-2023-42916 to the KEV catalog (due 2023-12-25).
2023-12-04: CISA added CVE-2023-42917 to the KEV catalog (due 2023-12-25).

CVEs: CVE-2023-42916, CVE-2023-42917

[high] Apple Multiple Products: 3 exploited vulnerabilities (CVE-2023-41991, CVE-2023-41992, CVE-2023-41993)

Mon, 25 Sep 2023 00:00:00 GMT

Apple iOS, iPadOS, macOS, and watchOS contain an improper certificate validation vulnerability that can allow a malicious app to bypass signature validation. Apple iOS, iPadOS, macOS, and watchOS contain an unspecified vulnerability that allows for local privilege escalation. Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-09-25.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-09-25: CISA added CVE-2023-41991 to the KEV catalog (due 2023-10-16).
2023-09-25: CISA added CVE-2023-41992 to the KEV catalog (due 2023-10-16).
2023-09-25: CISA added CVE-2023-41993 to the KEV catalog (due 2023-10-16).

CVEs: CVE-2023-41991, CVE-2023-41992, CVE-2023-41993

[high] BLASTPASS: NSO zero-click iPhone exploit chain (CVE-2023-41064, CVE-2023-41061)

Mon, 11 Sep 2023 00:00:00 GMT

Citizen Lab caught BLASTPASS, a zero-click iMessage exploit chain that delivered NSO Group's Pegasus through malicious PassKit attachments carrying images. Apple fixed the ImageIO and Wallet bugs in emergency updates the same day.

Status: closed · Patch: patched · Fixed in: iOS 16.6.1 and iPadOS 16.6.1, iOS 15.7.9 and iPadOS 15.7.9, macOS Ventura 13.5.2, macOS Monterey 12.6.9, macOS Big Sur 11.7.10, watchOS 9.6.2

Latest updates:

2023-09-11: CISA adds both CVEs to the KEV catalog
2023-09-07: Citizen Lab discloses BLASTPASS; Apple ships iOS 16.6.1 and related updates (source)

CVEs: CVE-2023-41064, CVE-2023-41061

[high] Apple Multiple Products: WebKit Code Execution (CVE-2023-37450)

Thu, 13 Jul 2023 00:00:00 GMT

Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-07-13.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-07-13: CISA added CVE-2023-37450 to the KEV catalog (due 2023-08-03).

CVEs: CVE-2023-37450

[high] Apple Multiple Products: WebKit Type Confusion (CVE-2023-32439)

Fri, 23 Jun 2023 00:00:00 GMT

Apple iOS, iPadOS, macOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-06-23.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-06-23: CISA added CVE-2023-32439 to the KEV catalog (due 2023-07-14).

CVEs: CVE-2023-32439

[high] Apple Multiple Products: 3 exploited vulnerabilities (CVE-2023-28204, CVE-2023-32373, CVE-2023-32409)

Mon, 22 May 2023 00:00:00 GMT

Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an unspecified vulnerability that can allow a remote attacker to break out of the Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-05-22.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-05-22: CISA added CVE-2023-28204 to the KEV catalog (due 2023-06-12).
2023-05-22: CISA added CVE-2023-32373 to the KEV catalog (due 2023-06-12).
2023-05-22: CISA added CVE-2023-32409 to the KEV catalog (due 2023-06-12).

CVEs: CVE-2023-28204, CVE-2023-32373, CVE-2023-32409

[critical] 3CX DesktopApp supply-chain attack (trojanized signed builds)

Thu, 20 Apr 2023 00:00:00 GMT

Signed 3CX DesktopApp builds for Windows and macOS shipped with embedded malicious code. Mandiant traced it to a North Korea-linked actor (UNC4736) who first got in through a trojanized X_TRADER install from Trading Technologies: a supply-chain attack caused by another supply-chain attack.

Status: closed · Patch: patched · Fixed in: See vendor advisory

Latest updates:

2023-04-20: Mandiant: the 3CX breach began with a trojanized X_TRADER package, the first software supply-chain attack it had seen caused by another (source)
2023-03-30: 3CX confirms the compromise and tells customers to uninstall the Electron desktop app (source)
2023-03-29: CrowdStrike reports malicious activity from the signed 3CXDesktopApp on customer machines (source)

CVEs: CVE-2023-29059

[high] Apple iOS, iPadOS, and macOS: IOSurfaceAccelerator Out-of-Bounds Write (CVE-2023-28206)

Mon, 10 Apr 2023 00:00:00 GMT

Apple iOS, iPadOS, and macOS IOSurfaceAccelerator contain an out-of-bounds write vulnerability that allows an app to execute code with kernel privileges. Added to CISA KEV on 2023-04-10.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-04-10: CISA added CVE-2023-28206 to the KEV catalog (due 2023-05-01).

CVEs: CVE-2023-28206

[high] Apple Multiple Products: WebKit Use-After-Free (CVE-2023-28205)

Mon, 10 Apr 2023 00:00:00 GMT

Apple iOS, iPadOS, macOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-04-10.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-04-10: CISA added CVE-2023-28205 to the KEV catalog (due 2023-05-01).

CVEs: CVE-2023-28205

[high] Apple Multiple Products: WebKit Type Confusion (CVE-2023-23529)

Tue, 14 Feb 2023 00:00:00 GMT

Apple iOS, MacOS, Safari and iPadOS WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-02-14.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-02-14: CISA added CVE-2023-23529 to the KEV catalog (due 2023-03-07).

CVEs: CVE-2023-23529