iOS and iPadOS vulnerabilities

598 known vulnerabilities in iOS and iPadOS from Apple. 587 are rated high or critical, and 61 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Multiple memory corruption issues were addressed with improved input validation.

  CVE-2025-43234Jul 30, 2025AppleEPSS 1.05%

  Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing a maliciously crafted texture may lead to unexpected app ter

• 7.5 High severity

  Safari: Exposure of Private Personal Information to an Unauthorized Actor

  CVE-2025-43227Jul 30, 2025AppleEPSS 1.25%

  This issue was addressed through improved state management. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may disclose sensitive user informat

• 7.1 High severity

  iOS and iPadOS: Out-of-bounds Write

  CVE-2025-43224Jul 30, 2025Apple

  An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6. Processing a maliciously crafted media file may lead to unexpected app termination or corru

• 7.5 High severity

  A denial-of-service issue was addressed with improved input validation.

  CVE-2025-43223Jul 30, 2025AppleEPSS 1.02%

  A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7, tvOS 18.6, visionOS 2.6, watchOS 11.6. A non-privileged user

• 7.1 High severity

  iOS and iPadOS: Out-of-bounds Read

  CVE-2025-43221Jul 30, 2025Apple

  An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6. Processing a maliciously crafted media file may lead to unexpected app termination or corru

• 8.8 High severity

  Safari: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2025-43214Jul 30, 2025AppleEPSS 1.09%

  The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.

• 8.8 High severity

  Safari: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2025-43213Jul 30, 2025Apple

  The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.

• 9.8 Critical severity

  iOS and iPadOS: Out-of-bounds Write

  CVE-2025-43209Jul 30, 2025AppleEPSS 1%

  An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciou

• 9.8 Critical severity

  iOS and iPadOS: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2025-43186Jul 30, 2025AppleEPSS 1.27%

  The issue was addressed with improved memory handling. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7, tvOS 18.6, visionOS 2.6, watchOS 11.6. Parsing a file may lead to an unexpected app terminati

• 9.1 Critical severity

  An input validation issue was addressed with improved memory handling.

  CVE-2025-31281Jul 30, 2025AppleEPSS 1.28%

  An input validation issue was addressed with improved memory handling. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6. Processing a maliciously crafted file may lead to unexpected app termination.

• 8.8 High severity

  Safari: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2025-31278Jul 30, 2025AppleEPSS 1.24%

  The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corrupt

• 8.8 High severity

  Apple Multiple Products Buffer Overflow Exploited

  CVE-2025-31277Jul 30, 2025AppleEPSS 1.68%

  The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.

• 8.8 High severity

  Safari: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2025-31273Jul 30, 2025AppleEPSS 1.14%

  The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.

• 7.5 High severity

  iOS and iPadOS: Improper Check for Unusual or Exceptional Conditions

  CVE-2025-24224Jul 30, 2025AppleEPSS 1.31%

  The issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.9, macOS Sequoia 15.5, macOS Ventura 13.7.7, tvOS 18.5, visionOS 2.5, watchOS 11.5. A remote attacker may be able to cause unexpected system termination.

• 4.2 Medium severity

  Apple Multiple Products Unspecified Exploited

  CVE-2025-43200Jun 16, 2025Apple

  This issue was addressed with improved checks. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5, macOS Sequoia 15.3.1, macOS Sonoma 14.7.4, macOS Ventura 13.7.4, visionOS 2.3.1, wa

• 9.8 Critical severity

  Safari: Origin Validation Error

  CVE-2025-30466May 29, 2025Apple

  This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4. A website may be able to bypass Same Origin Policy.

• 8.8 High severity

  Safari: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2025-24189May 19, 2025Apple

  The issue was addressed with improved checks. This issue is fixed in Safari 18.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, tvOS 18.3, visionOS 2.3, watchOS 11.3. Processing maliciously crafted web content may lead to memory corruption.

• 7.1 High severity

  iOS and iPadOS: Operation on a Resource after Expiration or Release

  CVE-2025-31253May 12, 2025Apple

  This issue was addressed through improved state management. This issue is fixed in iOS 18.5 and iPadOS 18.5. Muting the microphone during a FaceTime call may not result in audio being silenced.

• 7.3 High severity

  Safari: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2025-31238May 12, 2025AppleEPSS 1.02%

  The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to memory corruption.

• 8.2 High severity

  iOS and iPadOS: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2025-31234May 12, 2025Apple

  The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5. An attacker may be able to cause unexpected system termination or corrupt kernel memory.

• 7.1 High severity

  iOS and iPadOS: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2025-31225May 12, 2025Apple

  A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 18.5 and iPadOS 18.5. Call history from deleted apps may still appear in spotlight search results.

• 8.8 High severity

  Safari: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2025-31223May 12, 2025Apple

  The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to memory corruption.

• 7.8 High severity

  iOS and iPadOS: Improper Privilege Management

  CVE-2025-31222May 12, 2025Apple

  A correctness issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, watchOS 11.5. A user may be able to elevate privileges.

• 7.5 High severity

  iOS and iPadOS: Integer Overflow or Wraparound

  CVE-2025-31221May 12, 2025AppleEPSS 1.05%

  An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, watchOS 11.5. A remote attacker may be abl

• 7.1 High severity

  iOS and iPadOS: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2025-31219May 12, 2025AppleEPSS 1.13%

  The issue was addressed with improved memory handling. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, watchOS 11.5. An attacker may be able to cause unexpe

• 8.1 High severity

  iOS and iPadOS: Channel Accessible by Non-Endpoint

  CVE-2025-31214May 12, 2025Apple

  This issue was addressed through improved state management. This issue is fixed in iOS 18.5 and iPadOS 18.5. An attacker in a privileged network position may be able to intercept network traffic.

• 7.5 High severity

  The issue was addressed with improved checks.

  CVE-2025-31208May 12, 2025AppleEPSS 1.38%

  The issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, watchOS 11.5. Parsing a file may lead to an unexpected app ter

• 7.7 High severity

  iOS and iPadOS: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2025-31207May 12, 2025Apple

  A logic issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5. An app may be able to enumerate a user's installed apps.

• 8.8 High severity

  Safari: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2025-31204May 12, 2025Apple

  The issue was addressed with improved memory handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to memory corruption.

• 9.1 Critical severity

  iOS and iPadOS: Missing Authorization

  CVE-2025-30448May 12, 2025AppleEPSS 1.03%

  This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.4, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, visionOS 2.5. An attacker may be able to turn on sharing of an iCloud fo

• 9.1 Critical severity

  iOS and iPadOS: Improper Access Control

  CVE-2025-30436May 12, 2025Apple

  This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.4 and iPadOS 18.4. An attacker may be able to use Siri to enable Auto-Answer Calls.

• 8.0 High severity

  Safari: Cross-Site Request Forgery

  CVE-2025-24223May 12, 2025Apple

  The issue was addressed with improved memory handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to memory corruption.

• 8.8 High severity

  iOS and iPadOS: Use After Free

  CVE-2025-24252Apr 29, 2025AppleEPSS 1.31%

  A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4. An attacker on the local network may b

• 7.7 High severity

  iOS and iPadOS: Authentication Bypass Using an Alternate Path or Channel

  CVE-2025-24206Apr 29, 2025Apple

  An authentication issue was addressed with improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4. An attacker on the local network may b

• 9.8 Critical severity

  Apple Multiple Products Arbitrary Read and Write Exploited

  CVE-2025-31201Apr 16, 2025AppleEPSS 14%

  This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.

• 9.8 Critical severity

  Apple Multiple Products Memory Corruption Exploited

  CVE-2025-31200Apr 16, 2025AppleEPSS 20.9%

  A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1, watchOS 11.5. Processing an audio stream in a maliciously crafted media file may resu

• 7.8 High severity

  A path handling issue was addressed with improved validation.

  CVE-2023-42977Apr 11, 2025Apple

  A path handling issue was addressed with improved validation. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to break out of its sandbox.

• 8.8 High severity

  iOS and iPadOS: Use After Free

  CVE-2023-42970Apr 11, 2025Apple

  A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14, watchOS 10, tvOS 17, Safari 17. Processing web content may lead to arbitrary code execution.

• 7.3 High severity

  iOS and iPadOS: Improper Control of Generation of Code

  CVE-2023-42875Apr 11, 2025Apple

  Processing web content may lead to arbitrary code execution. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14, watchOS 10, tvOS 17, Safari 17. The issue was addressed with improved memory handling.

• 7.8 High severity

  Safari: Improper Preservation of Permissions

  CVE-2025-31184Mar 31, 2025Apple

  This issue was addressed with improved permissions checking. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4. An app may gain unauthorized access to Local Network.