Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
355 vulnerabilities found for Xcode by Apple
CERTFR-2026-AVI-1172
Vulnerability from certfr_avis - Published: 2026-09-15 - Updated: 2026-09-15
De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Apple | iOS | iOS versions antérieures à 27 | ||
| Apple | macOS | macOS Tahoe versions antérieures à 26.7 | ||
| Apple | Safari | Safari versions antérieures à 27 | ||
| Apple | Xcode | Xcode versions antérieures à 27 | ||
| Apple | macOS | macOS Golden Gate versions antérieures à 27 | ||
| Apple | iOS | iOS versions antérieures à 26.7 | ||
| Apple | iPadOS | iPadOS versions antérieures à 26.7 | ||
| Apple | tvOS | tvOS versions antérieures à 27 | ||
| Apple | iPadOS | iPadOS versions antérieures à 27 | ||
| Apple | visionOS | visionOS versions antérieures à 26.6.1 | ||
| Apple | visionOS | visionOS versions antérieures à 27 | ||
| Apple | macOS | macOS Sequoia versions antérieures à 15.8 | ||
| Apple | watchOS | watchOS versions antérieures à 27 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "iOS versions ant\u00e9rieures \u00e0 27",
"product": {
"name": "iOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS Tahoe versions ant\u00e9rieures \u00e0 26.7",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Safari versions ant\u00e9rieures \u00e0 27",
"product": {
"name": "Safari",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Xcode versions ant\u00e9rieures \u00e0 27",
"product": {
"name": "Xcode",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS Golden Gate versions ant\u00e9rieures \u00e0 27",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iOS versions ant\u00e9rieures \u00e0 26.7",
"product": {
"name": "iOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iPadOS versions ant\u00e9rieures \u00e0 26.7",
"product": {
"name": "iPadOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "tvOS versions ant\u00e9rieures \u00e0 27",
"product": {
"name": "tvOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iPadOS versions ant\u00e9rieures \u00e0 27",
"product": {
"name": "iPadOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "visionOS versions ant\u00e9rieures \u00e0 26.6.1",
"product": {
"name": "visionOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "visionOS versions ant\u00e9rieures \u00e0 27",
"product": {
"name": "visionOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS Sequoia versions ant\u00e9rieures \u00e0 15.8",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "watchOS versions ant\u00e9rieures \u00e0 27",
"product": {
"name": "watchOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-86886",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86886"
},
{
"name": "CVE-2026-86885",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86885"
},
{
"name": "CVE-2026-65362",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65362"
},
{
"name": "CVE-2026-28930",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28930"
},
{
"name": "CVE-2026-86879",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86879"
},
{
"name": "CVE-2026-43697",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43697"
},
{
"name": "CVE-2026-65391",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65391"
},
{
"name": "CVE-2026-84566",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84566"
},
{
"name": "CVE-2026-84572",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84572"
},
{
"name": "CVE-2026-43664",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43664"
},
{
"name": "CVE-2026-84558",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84558"
},
{
"name": "CVE-2026-84553",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84553"
},
{
"name": "CVE-2026-84626",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84626"
},
{
"name": "CVE-2026-84549",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84549"
},
{
"name": "CVE-2026-64788",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64788"
},
{
"name": "CVE-2026-65337",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65337"
},
{
"name": "CVE-2026-84527",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84527"
},
{
"name": "CVE-2026-84487",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84487"
},
{
"name": "CVE-2026-86890",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86890"
},
{
"name": "CVE-2026-84556",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84556"
},
{
"name": "CVE-2026-84489",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84489"
},
{
"name": "CVE-2026-84520",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84520"
},
{
"name": "CVE-2026-65331",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65331"
},
{
"name": "CVE-2026-65352",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65352"
},
{
"name": "CVE-2026-43695",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43695"
},
{
"name": "CVE-2026-43738",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43738"
},
{
"name": "CVE-2026-84621",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84621"
},
{
"name": "CVE-2026-84517",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84517"
},
{
"name": "CVE-2026-84585",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84585"
},
{
"name": "CVE-2026-84522",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84522"
},
{
"name": "CVE-2026-86887",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86887"
},
{
"name": "CVE-2026-65381",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65381"
},
{
"name": "CVE-2026-43791",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43791"
},
{
"name": "CVE-2026-86905",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86905"
},
{
"name": "CVE-2026-84565",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84565"
},
{
"name": "CVE-2026-86902",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86902"
},
{
"name": "CVE-2026-84580",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84580"
},
{
"name": "CVE-2026-84559",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84559"
},
{
"name": "CVE-2026-65332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65332"
},
{
"name": "CVE-2026-84491",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84491"
},
{
"name": "CVE-2026-65413",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65413"
},
{
"name": "CVE-2026-84615",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84615"
},
{
"name": "CVE-2026-43661",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43661"
},
{
"name": "CVE-2026-64760",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64760"
},
{
"name": "CVE-2026-65406",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65406"
},
{
"name": "CVE-2026-84611",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84611"
},
{
"name": "CVE-2026-64712",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64712"
},
{
"name": "CVE-2026-65365",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65365"
},
{
"name": "CVE-2026-65343",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65343"
},
{
"name": "CVE-2026-84630",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84630"
},
{
"name": "CVE-2026-84551",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84551"
},
{
"name": "CVE-2026-65400",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65400"
},
{
"name": "CVE-2026-43696",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43696"
},
{
"name": "CVE-2026-84635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84635"
},
{
"name": "CVE-2026-84540",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84540"
},
{
"name": "CVE-2026-65364",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65364"
},
{
"name": "CVE-2026-65340",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65340"
},
{
"name": "CVE-2026-84538",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84538"
},
{
"name": "CVE-2026-64790",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64790"
},
{
"name": "CVE-2026-64761",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64761"
},
{
"name": "CVE-2026-43698",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43698"
},
{
"name": "CVE-2026-65399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65399"
},
{
"name": "CVE-2026-84550",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84550"
},
{
"name": "CVE-2026-86895",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86895"
},
{
"name": "CVE-2026-65412",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65412"
},
{
"name": "CVE-2026-20683",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20683"
},
{
"name": "CVE-2026-86876",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86876"
},
{
"name": "CVE-2022-3437",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3437"
},
{
"name": "CVE-2026-43763",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43763"
},
{
"name": "CVE-2026-84506",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84506"
},
{
"name": "CVE-2026-84512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84512"
},
{
"name": "CVE-2026-84631",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84631"
},
{
"name": "CVE-2026-84544",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84544"
},
{
"name": "CVE-2026-65344",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65344"
},
{
"name": "CVE-2026-43691",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43691"
},
{
"name": "CVE-2026-64753",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64753"
},
{
"name": "CVE-2026-65360",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65360"
},
{
"name": "CVE-2026-64752",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64752"
},
{
"name": "CVE-2026-84620",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84620"
},
{
"name": "CVE-2026-84543",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84543"
},
{
"name": "CVE-2026-84629",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84629"
},
{
"name": "CVE-2026-84541",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84541"
},
{
"name": "CVE-2026-84505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84505"
},
{
"name": "CVE-2026-64781",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64781"
},
{
"name": "CVE-2026-84623",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84623"
},
{
"name": "CVE-2026-84619",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84619"
},
{
"name": "CVE-2026-84513",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84513"
},
{
"name": "CVE-2026-84534",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84534"
},
{
"name": "CVE-2026-86888",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86888"
},
{
"name": "CVE-2026-84531",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84531"
},
{
"name": "CVE-2026-65345",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65345"
},
{
"name": "CVE-2026-84625",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84625"
},
{
"name": "CVE-2026-84497",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84497"
},
{
"name": "CVE-2026-84554",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84554"
},
{
"name": "CVE-2026-64787",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64787"
},
{
"name": "CVE-2026-65339",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65339"
},
{
"name": "CVE-2026-86897",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86897"
},
{
"name": "CVE-2026-86884",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86884"
},
{
"name": "CVE-2026-84596",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84596"
},
{
"name": "CVE-2026-86911",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86911"
},
{
"name": "CVE-2026-43674",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43674"
},
{
"name": "CVE-2026-84532",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84532"
},
{
"name": "CVE-2026-28935",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28935"
},
{
"name": "CVE-2026-64718",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64718"
},
{
"name": "CVE-2026-84600",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84600"
},
{
"name": "CVE-2026-43737",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43737"
},
{
"name": "CVE-2026-84524",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84524"
},
{
"name": "CVE-2026-86904",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86904"
},
{
"name": "CVE-2026-86894",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86894"
},
{
"name": "CVE-2026-28969",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28969"
},
{
"name": "CVE-2026-65395",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65395"
},
{
"name": "CVE-2026-84593",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84593"
},
{
"name": "CVE-2026-84597",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84597"
},
{
"name": "CVE-2026-84530",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84530"
},
{
"name": "CVE-2026-84533",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84533"
},
{
"name": "CVE-2026-65351",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65351"
},
{
"name": "CVE-2026-84576",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84576"
},
{
"name": "CVE-2026-28966",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28966"
},
{
"name": "CVE-2026-84568",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84568"
},
{
"name": "CVE-2026-84616",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84616"
},
{
"name": "CVE-2026-84581",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84581"
},
{
"name": "CVE-2026-64779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64779"
},
{
"name": "CVE-2026-65341",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65341"
},
{
"name": "CVE-2026-84589",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84589"
},
{
"name": "CVE-2026-86882",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86882"
},
{
"name": "CVE-2026-65377",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65377"
},
{
"name": "CVE-2026-65410",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65410"
},
{
"name": "CVE-2026-84516",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84516"
},
{
"name": "CVE-2026-43683",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43683"
},
{
"name": "CVE-2026-86917",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86917"
},
{
"name": "CVE-2026-43677",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43677"
},
{
"name": "CVE-2026-65404",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65404"
},
{
"name": "CVE-2026-43787",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43787"
},
{
"name": "CVE-2026-84518",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84518"
},
{
"name": "CVE-2026-43790",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43790"
},
{
"name": "CVE-2026-84617",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84617"
},
{
"name": "CVE-2026-65334",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65334"
},
{
"name": "CVE-2026-84563",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84563"
},
{
"name": "CVE-2026-43689",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43689"
},
{
"name": "CVE-2026-84521",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84521"
},
{
"name": "CVE-2026-65414",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65414"
},
{
"name": "CVE-2026-84612",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84612"
},
{
"name": "CVE-2026-84515",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84515"
},
{
"name": "CVE-2026-64782",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64782"
},
{
"name": "CVE-2026-84537",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84537"
},
{
"name": "CVE-2026-84525",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84525"
},
{
"name": "CVE-2026-84523",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84523"
},
{
"name": "CVE-2026-28934",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28934"
},
{
"name": "CVE-2026-84574",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84574"
},
{
"name": "CVE-2026-86889",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86889"
},
{
"name": "CVE-2026-65346",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65346"
},
{
"name": "CVE-2026-34979",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34979"
},
{
"name": "CVE-2026-64778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64778"
},
{
"name": "CVE-2026-84601",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84601"
},
{
"name": "CVE-2026-65329",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65329"
},
{
"name": "CVE-2026-84555",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84555"
},
{
"name": "CVE-2026-64780",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64780"
},
{
"name": "CVE-2026-84514",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84514"
},
{
"name": "CVE-2026-65378",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65378"
},
{
"name": "CVE-2026-86878",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86878"
},
{
"name": "CVE-2026-86924",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86924"
},
{
"name": "CVE-2026-86869",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86869"
},
{
"name": "CVE-2026-65354",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65354"
},
{
"name": "CVE-2026-65405",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65405"
},
{
"name": "CVE-2026-84492",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84492"
},
{
"name": "CVE-2026-84586",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84586"
},
{
"name": "CVE-2026-43684",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43684"
},
{
"name": "CVE-2026-84583",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84583"
},
{
"name": "CVE-2026-84598",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84598"
},
{
"name": "CVE-2026-65393",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65393"
},
{
"name": "CVE-2026-43688",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43688"
},
{
"name": "CVE-2026-84571",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84571"
},
{
"name": "CVE-2026-43786",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43786"
},
{
"name": "CVE-2026-84546",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84546"
},
{
"name": "CVE-2026-86910",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86910"
},
{
"name": "CVE-2026-64714",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64714"
},
{
"name": "CVE-2026-43719",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43719"
},
{
"name": "CVE-2026-84606",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84606"
},
{
"name": "CVE-2026-86901",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86901"
},
{
"name": "CVE-2026-86881",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86881"
},
{
"name": "CVE-2026-43687",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43687"
},
{
"name": "CVE-2026-86903",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86903"
},
{
"name": "CVE-2026-65361",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65361"
},
{
"name": "CVE-2026-84577",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84577"
},
{
"name": "CVE-2026-84622",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84622"
},
{
"name": "CVE-2026-64758",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64758"
},
{
"name": "CVE-2026-65376",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65376"
},
{
"name": "CVE-2026-84588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84588"
},
{
"name": "CVE-2026-65349",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65349"
},
{
"name": "CVE-2026-86870",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86870"
},
{
"name": "CVE-2026-65390",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65390"
},
{
"name": "CVE-2026-86900",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86900"
},
{
"name": "CVE-2026-43686",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43686"
},
{
"name": "CVE-2026-84636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84636"
},
{
"name": "CVE-2026-84587",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84587"
},
{
"name": "CVE-2026-65380",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65380"
},
{
"name": "CVE-2026-43794",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43794"
},
{
"name": "CVE-2026-84548",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84548"
},
{
"name": "CVE-2026-65348",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65348"
},
{
"name": "CVE-2026-65355",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65355"
},
{
"name": "CVE-2026-65409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65409"
},
{
"name": "CVE-2026-65403",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65403"
},
{
"name": "CVE-2026-65369",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65369"
},
{
"name": "CVE-2026-65382",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65382"
},
{
"name": "CVE-2026-84578",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84578"
},
{
"name": "CVE-2026-86891",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86891"
},
{
"name": "CVE-2026-84569",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84569"
},
{
"name": "CVE-2026-43702",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43702"
},
{
"name": "CVE-2026-84624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84624"
},
{
"name": "CVE-2026-84609",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84609"
},
{
"name": "CVE-2026-28937",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28937"
},
{
"name": "CVE-2026-84507",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84507"
},
{
"name": "CVE-2026-28899",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28899"
},
{
"name": "CVE-2026-84575",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84575"
},
{
"name": "CVE-2026-84560",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84560"
},
{
"name": "CVE-2026-43743",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43743"
},
{
"name": "CVE-2026-65336",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65336"
},
{
"name": "CVE-2026-43692",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43692"
},
{
"name": "CVE-2026-43785",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43785"
},
{
"name": "CVE-2026-43741",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43741"
},
{
"name": "CVE-2026-84519",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84519"
},
{
"name": "CVE-2026-64784",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64784"
},
{
"name": "CVE-2026-84552",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84552"
},
{
"name": "CVE-2026-86892",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86892"
},
{
"name": "CVE-2026-64715",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64715"
},
{
"name": "CVE-2026-65371",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65371"
},
{
"name": "CVE-2026-65402",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65402"
},
{
"name": "CVE-2026-84509",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84509"
},
{
"name": "CVE-2026-28968",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28968"
},
{
"name": "CVE-2026-65347",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65347"
},
{
"name": "CVE-2026-86893",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86893"
},
{
"name": "CVE-2026-43795",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43795"
},
{
"name": "CVE-2026-84618",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84618"
},
{
"name": "CVE-2026-86909",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86909"
},
{
"name": "CVE-2026-43788",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43788"
},
{
"name": "CVE-2026-86883",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86883"
},
{
"name": "CVE-2026-84567",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84567"
},
{
"name": "CVE-2026-65415",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65415"
},
{
"name": "CVE-2026-65383",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65383"
},
{
"name": "CVE-2026-84511",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84511"
},
{
"name": "CVE-2026-84628",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84628"
},
{
"name": "CVE-2026-84602",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84602"
},
{
"name": "CVE-2026-65411",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65411"
},
{
"name": "CVE-2026-84535",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84535"
},
{
"name": "CVE-2026-84561",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84561"
},
{
"name": "CVE-2026-65335",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65335"
},
{
"name": "CVE-2026-84584",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84584"
},
{
"name": "CVE-2026-84573",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84573"
},
{
"name": "CVE-2026-84570",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84570"
},
{
"name": "CVE-2026-84632",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84632"
},
{
"name": "CVE-2026-84526",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84526"
},
{
"name": "CVE-2026-65333",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65333"
},
{
"name": "CVE-2026-43789",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43789"
},
{
"name": "CVE-2026-84607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84607"
},
{
"name": "CVE-2026-65408",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65408"
},
{
"name": "CVE-2026-84536",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84536"
},
{
"name": "CVE-2026-64736",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64736"
},
{
"name": "CVE-2026-43715",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43715"
},
{
"name": "CVE-2026-84564",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84564"
},
{
"name": "CVE-2026-43690",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43690"
},
{
"name": "CVE-2026-65342",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65342"
},
{
"name": "CVE-2026-65359",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65359"
},
{
"name": "CVE-2026-43760",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43760"
},
{
"name": "CVE-2026-84510",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84510"
},
{
"name": "CVE-2026-65358",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65358"
},
{
"name": "CVE-2026-65374",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65374"
},
{
"name": "CVE-2026-65398",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65398"
},
{
"name": "CVE-2026-65338",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65338"
},
{
"name": "CVE-2026-84603",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84603"
},
{
"name": "CVE-2026-65401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65401"
},
{
"name": "CVE-2026-64756",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64756"
},
{
"name": "CVE-2026-65330",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65330"
},
{
"name": "CVE-2026-65407",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65407"
},
{
"name": "CVE-2026-86898",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86898"
},
{
"name": "CVE-2026-65375",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65375"
}
],
"initial_release_date": "2026-09-15T00:00:00",
"last_revision_date": "2026-09-15T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1172",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-09-15T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Apple. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Apple",
"vendor_advisories": [
{
"published_at": "2026-09-14",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 149036",
"url": "https://support.apple.com/en-us/149036"
},
{
"published_at": "2026-09-14",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 149041",
"url": "https://support.apple.com/en-us/149041"
},
{
"published_at": "2026-08-17",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 148353",
"url": "https://support.apple.com/en-us/148353"
},
{
"published_at": "2026-09-14",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 149035",
"url": "https://support.apple.com/en-us/149035"
},
{
"published_at": "2026-09-14",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 149034",
"url": "https://support.apple.com/en-us/149034"
},
{
"published_at": "2026-09-14",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 149042",
"url": "https://support.apple.com/en-us/149042"
},
{
"published_at": "2026-09-14",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 149039",
"url": "https://support.apple.com/en-us/149039"
},
{
"published_at": "2026-09-14",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 149038",
"url": "https://support.apple.com/en-us/149038"
},
{
"published_at": "2026-09-14",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 149040",
"url": "https://support.apple.com/en-us/149040"
},
{
"published_at": "2026-09-14",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 149043",
"url": "https://support.apple.com/en-us/149043"
},
{
"published_at": "2026-09-14",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 149037",
"url": "https://support.apple.com/en-us/149037"
}
]
}
CERTFR-2026-AVI-0355
Vulnerability from certfr_avis - Published: 2026-03-25 - Updated: 2026-03-25
De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Apple | iOS | iOS versions antérieures à 26.4 | ||
| Apple | iPadOS | iPadOS versions antérieures à 26.4 | ||
| Apple | iPadOS | iPadOS versions antérieures à 18.7.7 | ||
| Apple | Xcode | Xcode versions antérieures à 26.4 | ||
| Apple | visionOS | visionOS versions antérieures à 26.4 | ||
| Apple | watchOS | watchOS versions antérieures à 26.4 | ||
| Apple | macOS | macOS Tahoe versions antérieures à 26.4 | ||
| Apple | macOS | macOS Sonoma versions antérieures à 14.8.5 | ||
| Apple | Safari | Safari versions antérieures à 26.4 | ||
| Apple | macOS | macOS Sequoia versions antérieures à 15.7.5 | ||
| Apple | tvOS | tvOS versions antérieures à 26.4 | ||
| Apple | iOS | iOS versions antérieures à 18.7.7 |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "iOS versions ant\u00e9rieures \u00e0 26.4",
"product": {
"name": "iOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iPadOS versions ant\u00e9rieures \u00e0 26.4",
"product": {
"name": "iPadOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iPadOS versions ant\u00e9rieures \u00e0 18.7.7",
"product": {
"name": "iPadOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Xcode versions ant\u00e9rieures \u00e0 26.4",
"product": {
"name": "Xcode",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "visionOS versions ant\u00e9rieures \u00e0 26.4",
"product": {
"name": "visionOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "watchOS versions ant\u00e9rieures \u00e0 26.4",
"product": {
"name": "watchOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS Tahoe versions ant\u00e9rieures \u00e0 26.4",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS Sonoma versions ant\u00e9rieures \u00e0 14.8.5",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Safari versions ant\u00e9rieures \u00e0 26.4",
"product": {
"name": "Safari",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS Sequoia versions ant\u00e9rieures \u00e0 15.7.5",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "tvOS versions ant\u00e9rieures \u00e0 26.4",
"product": {
"name": "tvOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iOS versions ant\u00e9rieures \u00e0 18.7.7",
"product": {
"name": "iOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-20684",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20684"
},
{
"name": "CVE-2026-28875",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28875"
},
{
"name": "CVE-2026-28862",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28862"
},
{
"name": "CVE-2026-20698",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20698"
},
{
"name": "CVE-2025-59775",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59775"
},
{
"name": "CVE-2026-20664",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20664"
},
{
"name": "CVE-2026-20692",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20692"
},
{
"name": "CVE-2025-43376",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43376"
},
{
"name": "CVE-2026-28879",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28879"
},
{
"name": "CVE-2026-28834",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28834"
},
{
"name": "CVE-2026-28882",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28882"
},
{
"name": "CVE-2026-20631",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20631"
},
{
"name": "CVE-2025-55753",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-55753"
},
{
"name": "CVE-2026-28874",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28874"
},
{
"name": "CVE-2026-20665",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20665"
},
{
"name": "CVE-2026-28822",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28822"
},
{
"name": "CVE-2026-28827",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28827"
},
{
"name": "CVE-2026-28892",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28892"
},
{
"name": "CVE-2026-28895",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28895"
},
{
"name": "CVE-2026-28837",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28837"
},
{
"name": "CVE-2026-28878",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28878"
},
{
"name": "CVE-2026-28823",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28823"
},
{
"name": "CVE-2026-28845",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28845"
},
{
"name": "CVE-2026-28826",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28826"
},
{
"name": "CVE-2026-28886",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28886"
},
{
"name": "CVE-2026-28880",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28880"
},
{
"name": "CVE-2025-66200",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66200"
},
{
"name": "CVE-2026-20687",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20687"
},
{
"name": "CVE-2026-28866",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28866"
},
{
"name": "CVE-2026-20697",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20697"
},
{
"name": "CVE-2026-28863",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28863"
},
{
"name": "CVE-2026-28817",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28817"
},
{
"name": "CVE-2026-20637",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20637"
},
{
"name": "CVE-2026-20607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20607"
},
{
"name": "CVE-2026-28889",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28889"
},
{
"name": "CVE-2025-64505",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-64505"
},
{
"name": "CVE-2026-28824",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28824"
},
{
"name": "CVE-2026-28844",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28844"
},
{
"name": "CVE-2026-20632",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20632"
},
{
"name": "CVE-2026-20668",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20668"
},
{
"name": "CVE-2026-28888",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28888"
},
{
"name": "CVE-2026-28852",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28852"
},
{
"name": "CVE-2026-28829",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28829"
},
{
"name": "CVE-2025-65082",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-65082"
},
{
"name": "CVE-2026-28861",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28861"
},
{
"name": "CVE-2026-28894",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28894"
},
{
"name": "CVE-2026-28828",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28828"
},
{
"name": "CVE-2025-58098",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58098"
},
{
"name": "CVE-2026-28871",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28871"
},
{
"name": "CVE-2026-20688",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20688"
},
{
"name": "CVE-2026-20699",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20699"
},
{
"name": "CVE-2026-28831",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28831"
},
{
"name": "CVE-2026-28859",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28859"
},
{
"name": "CVE-2026-20694",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20694"
},
{
"name": "CVE-2026-20633",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20633"
},
{
"name": "CVE-2026-20657",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20657"
},
{
"name": "CVE-2026-28890",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28890"
},
{
"name": "CVE-2026-20651",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20651"
},
{
"name": "CVE-2026-20701",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20701"
},
{
"name": "CVE-2026-28816",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28816"
},
{
"name": "CVE-2026-28877",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28877"
},
{
"name": "CVE-2025-14524",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14524"
},
{
"name": "CVE-2026-20691",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20691"
},
{
"name": "CVE-2026-28820",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28820"
},
{
"name": "CVE-2026-28838",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28838"
},
{
"name": "CVE-2026-28842",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28842"
},
{
"name": "CVE-2025-43534",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43534"
},
{
"name": "CVE-2026-28825",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28825"
},
{
"name": "CVE-2026-28865",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28865"
},
{
"name": "CVE-2026-20660",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20660"
},
{
"name": "CVE-2026-28857",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28857"
},
{
"name": "CVE-2026-20639",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20639"
},
{
"name": "CVE-2026-20643",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20643"
},
{
"name": "CVE-2026-28818",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28818"
},
{
"name": "CVE-2026-20690",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20690"
},
{
"name": "CVE-2026-20693",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20693"
},
{
"name": "CVE-2026-28833",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28833"
},
{
"name": "CVE-2026-28876",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28876"
},
{
"name": "CVE-2026-20695",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20695"
},
{
"name": "CVE-2026-28856",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28856"
},
{
"name": "CVE-2026-28891",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28891"
},
{
"name": "CVE-2026-28868",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28868"
},
{
"name": "CVE-2026-28841",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28841"
},
{
"name": "CVE-2026-28821",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28821"
},
{
"name": "CVE-2026-28835",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28835"
},
{
"name": "CVE-2026-28839",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28839"
},
{
"name": "CVE-2026-28867",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28867"
},
{
"name": "CVE-2026-28864",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28864"
},
{
"name": "CVE-2026-28832",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28832"
},
{
"name": "CVE-2026-28858",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28858"
},
{
"name": "CVE-2026-28870",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28870"
},
{
"name": "CVE-2026-28893",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28893"
},
{
"name": "CVE-2026-28881",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28881"
}
],
"initial_release_date": "2026-03-25T00:00:00",
"last_revision_date": "2026-03-25T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0355",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-03-25T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Apple. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Apple",
"vendor_advisories": [
{
"published_at": "2026-03-24",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 126793",
"url": "https://support.apple.com/en-us/126793"
},
{
"published_at": "2026-03-24",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 126794",
"url": "https://support.apple.com/en-us/126794"
},
{
"published_at": "2026-03-24",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 126798",
"url": "https://support.apple.com/en-us/126798"
},
{
"published_at": "2026-03-24",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 126800",
"url": "https://support.apple.com/en-us/126800"
},
{
"published_at": "2026-03-24",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 126796",
"url": "https://support.apple.com/en-us/126796"
},
{
"published_at": "2026-03-24",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 126792",
"url": "https://support.apple.com/en-us/126792"
},
{
"published_at": "2026-03-24",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 126795",
"url": "https://support.apple.com/en-us/126795"
},
{
"published_at": "2026-03-24",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 126799",
"url": "https://support.apple.com/en-us/126799"
},
{
"published_at": "2026-03-24",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 126797",
"url": "https://support.apple.com/en-us/126797"
},
{
"published_at": "2026-03-24",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 126801",
"url": "https://support.apple.com/en-us/126801"
}
]
}
CERTFR-2025-AVI-0961
Vulnerability from certfr_avis - Published: 2025-11-04 - Updated: 2025-11-04
De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Apple | macOS | macOS Tahoe versions antérieures à 26.1 | ||
| Apple | iPadOS | iPadOS versions antérieures à 26.1 | ||
| Apple | macOS | macOS Sequoia versions antérieures à 15.7.2 | ||
| Apple | Safari | Safari versions antérieures à 26.1 | ||
| Apple | Xcode | Xcode versions antérieures à 26.1 | ||
| Apple | watchOS | watchOS versions antérieures à 26.1 | ||
| Apple | iOS | iOS versions antérieures à 26.1 | ||
| Apple | tvOS | tvOS versions antérieures à 26.1 | ||
| Apple | macOS | macOS Sonoma versions antérieures à 14.8.2 | ||
| Apple | visionOS | visionOS versions antérieures à 26.1 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "macOS Tahoe versions ant\u00e9rieures \u00e0 26.1",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iPadOS versions ant\u00e9rieures \u00e0 26.1",
"product": {
"name": "iPadOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS Sequoia versions ant\u00e9rieures \u00e0 15.7.2",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Safari versions ant\u00e9rieures \u00e0 26.1",
"product": {
"name": "Safari",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Xcode versions ant\u00e9rieures \u00e0 26.1",
"product": {
"name": "Xcode",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "watchOS versions ant\u00e9rieures \u00e0 26.1",
"product": {
"name": "watchOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iOS versions ant\u00e9rieures \u00e0 26.1",
"product": {
"name": "iOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "tvOS versions ant\u00e9rieures \u00e0 26.1",
"product": {
"name": "tvOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS Sonoma versions ant\u00e9rieures \u00e0 14.8.2",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "visionOS versions ant\u00e9rieures \u00e0 26.1",
"product": {
"name": "visionOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-43292",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43292"
},
{
"name": "CVE-2025-43505",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43505"
},
{
"name": "CVE-2025-43432",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43432"
},
{
"name": "CVE-2025-43372",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43372"
},
{
"name": "CVE-2025-43426",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43426"
},
{
"name": "CVE-2025-43480",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43480"
},
{
"name": "CVE-2025-43449",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43449"
},
{
"name": "CVE-2025-43348",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43348"
},
{
"name": "CVE-2025-43351",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43351"
},
{
"name": "CVE-2025-43373",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43373"
},
{
"name": "CVE-2025-43441",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43441"
},
{
"name": "CVE-2025-43443",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43443"
},
{
"name": "CVE-2025-43476",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43476"
},
{
"name": "CVE-2025-30465",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30465"
},
{
"name": "CVE-2025-43448",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43448"
},
{
"name": "CVE-2025-43497",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43497"
},
{
"name": "CVE-2025-43446",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43446"
},
{
"name": "CVE-2025-43500",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43500"
},
{
"name": "CVE-2025-43431",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43431"
},
{
"name": "CVE-2025-43452",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43452"
},
{
"name": "CVE-2025-43504",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43504"
},
{
"name": "CVE-2025-43467",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43467"
},
{
"name": "CVE-2025-43496",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43496"
},
{
"name": "CVE-2025-43420",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43420"
},
{
"name": "CVE-2025-43450",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43450"
},
{
"name": "CVE-2025-43406",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43406"
},
{
"name": "CVE-2025-43402",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43402"
},
{
"name": "CVE-2025-43384",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43384"
},
{
"name": "CVE-2025-43434",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43434"
},
{
"name": "CVE-2025-43422",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43422"
},
{
"name": "CVE-2025-43503",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43503"
},
{
"name": "CVE-2025-43502",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43502"
},
{
"name": "CVE-2025-43440",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43440"
},
{
"name": "CVE-2024-43398",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43398"
},
{
"name": "CVE-2025-43427",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43427"
},
{
"name": "CVE-2025-43394",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43394"
},
{
"name": "CVE-2025-43335",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43335"
},
{
"name": "CVE-2025-43458",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43458"
},
{
"name": "CVE-2025-43411",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43411"
},
{
"name": "CVE-2025-43469",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43469"
},
{
"name": "CVE-2025-43498",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43498"
},
{
"name": "CVE-2025-43424",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43424"
},
{
"name": "CVE-2025-43423",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43423"
},
{
"name": "CVE-2025-43472",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43472"
},
{
"name": "CVE-2025-43459",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43459"
},
{
"name": "CVE-2025-43392",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43392"
},
{
"name": "CVE-2025-43462",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43462"
},
{
"name": "CVE-2025-43401",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43401"
},
{
"name": "CVE-2025-43386",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43386"
},
{
"name": "CVE-2025-43493",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43493"
},
{
"name": "CVE-2025-43481",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43481"
},
{
"name": "CVE-2025-43405",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43405"
},
{
"name": "CVE-2025-43506",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43506"
},
{
"name": "CVE-2025-43322",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43322"
},
{
"name": "CVE-2025-32462",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32462"
},
{
"name": "CVE-2025-43400",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43400"
},
{
"name": "CVE-2025-43468",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43468"
},
{
"name": "CVE-2025-43395",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43395"
},
{
"name": "CVE-2025-43421",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43421"
},
{
"name": "CVE-2025-43435",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43435"
},
{
"name": "CVE-2025-43464",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43464"
},
{
"name": "CVE-2025-43442",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43442"
},
{
"name": "CVE-2025-43377",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43377"
},
{
"name": "CVE-2025-43438",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43438"
},
{
"name": "CVE-2025-43460",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43460"
},
{
"name": "CVE-2025-43429",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43429"
},
{
"name": "CVE-2025-43407",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43407"
},
{
"name": "CVE-2025-43334",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43334"
},
{
"name": "CVE-2025-43414",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43414"
},
{
"name": "CVE-2025-43385",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43385"
},
{
"name": "CVE-2025-43444",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43444"
},
{
"name": "CVE-2025-43404",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43404"
},
{
"name": "CVE-2025-43495",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43495"
},
{
"name": "CVE-2025-43465",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43465"
},
{
"name": "CVE-2025-43461",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43461"
},
{
"name": "CVE-2025-43294",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43294"
},
{
"name": "CVE-2025-43390",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43390"
},
{
"name": "CVE-2025-43499",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43499"
},
{
"name": "CVE-2025-43350",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43350"
},
{
"name": "CVE-2025-43391",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43391"
},
{
"name": "CVE-2025-43378",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43378"
},
{
"name": "CVE-2025-43473",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43473"
},
{
"name": "CVE-2025-43445",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43445"
},
{
"name": "CVE-2025-43338",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43338"
},
{
"name": "CVE-2025-43409",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43409"
},
{
"name": "CVE-2025-43399",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43399"
},
{
"name": "CVE-2025-43383",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43383"
},
{
"name": "CVE-2025-43474",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43474"
},
{
"name": "CVE-2025-43471",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43471"
},
{
"name": "CVE-2025-43387",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43387"
},
{
"name": "CVE-2025-43479",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43479"
},
{
"name": "CVE-2025-43447",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43447"
},
{
"name": "CVE-2025-43477",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43477"
},
{
"name": "CVE-2025-43413",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43413"
},
{
"name": "CVE-2025-43507",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43507"
},
{
"name": "CVE-2025-43336",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43336"
},
{
"name": "CVE-2025-43433",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43433"
},
{
"name": "CVE-2025-43430",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43430"
},
{
"name": "CVE-2025-43337",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43337"
},
{
"name": "CVE-2025-43380",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43380"
},
{
"name": "CVE-2025-43397",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43397"
},
{
"name": "CVE-2025-43455",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43455"
},
{
"name": "CVE-2025-53906",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-53906"
},
{
"name": "CVE-2025-43412",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43412"
},
{
"name": "CVE-2025-43388",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43388"
},
{
"name": "CVE-2025-43396",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43396"
},
{
"name": "CVE-2025-43454",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43454"
},
{
"name": "CVE-2025-43439",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43439"
},
{
"name": "CVE-2025-43381",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43381"
},
{
"name": "CVE-2025-43382",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43382"
},
{
"name": "CVE-2025-43466",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43466"
},
{
"name": "CVE-2025-43364",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43364"
},
{
"name": "CVE-2025-43393",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43393"
},
{
"name": "CVE-2025-43389",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43389"
},
{
"name": "CVE-2025-43457",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43457"
},
{
"name": "CVE-2025-43361",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43361"
},
{
"name": "CVE-2025-43398",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43398"
},
{
"name": "CVE-2025-31199",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31199"
},
{
"name": "CVE-2025-43408",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43408"
},
{
"name": "CVE-2025-43379",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43379"
},
{
"name": "CVE-2025-6442",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6442"
},
{
"name": "CVE-2025-43425",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43425"
},
{
"name": "CVE-2025-43478",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43478"
},
{
"name": "CVE-2025-43436",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43436"
},
{
"name": "CVE-2024-49761",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49761"
},
{
"name": "CVE-2025-43463",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43463"
}
],
"initial_release_date": "2025-11-04T00:00:00",
"last_revision_date": "2025-11-04T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0961",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-11-04T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Apple. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Apple",
"vendor_advisories": [
{
"published_at": "2025-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125639",
"url": "https://support.apple.com/en-us/125639"
},
{
"published_at": "2025-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125640",
"url": "https://support.apple.com/en-us/125640"
},
{
"published_at": "2025-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125634",
"url": "https://support.apple.com/en-us/125634"
},
{
"published_at": "2025-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125632",
"url": "https://support.apple.com/en-us/125632"
},
{
"published_at": "2025-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125638",
"url": "https://support.apple.com/en-us/125638"
},
{
"published_at": "2025-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125635",
"url": "https://support.apple.com/en-us/125635"
},
{
"published_at": "2025-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125641",
"url": "https://support.apple.com/en-us/125641"
},
{
"published_at": "2025-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125636",
"url": "https://support.apple.com/en-us/125636"
},
{
"published_at": "2025-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125637",
"url": "https://support.apple.com/en-us/125637"
}
]
}
CERTFR-2025-AVI-0791
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.
Apple indique que la vulnérabilité CVE-2025-43300 est activement exploitée.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Apple | iOS | iOS versions 15.x antérieures à 15.8.5 | ||
| Apple | iOS | iOS versions 16.x antérieures à 16.7.12 | ||
| Apple | iOS | iOS versions 18.x antérieures à 18.7 | ||
| Apple | iOS | iOS versions antérieures à 26 | ||
| Apple | iPadOS | iPadOS versions 15.x antérieures à 15.8.5 | ||
| Apple | iPadOS | iPadOS versions 16.x antérieures à 16.7.12 | ||
| Apple | iPadOS | iPadOS versions 18.x antérieures à 18.7 | ||
| Apple | iPadOS | iPadOS versions antérieures à 26 | ||
| Apple | macOS | macOS Sequoia versions antérieures à 15.7 | ||
| Apple | macOS | macOS Sonoma versions antérieures à 14.8 | ||
| Apple | macOS | macOS Tahoe versions antérieures à 26 | ||
| Apple | Safari | Safari versions antérieures à 26 | ||
| Apple | tvOS | tvOS versions antérieures à 26 | ||
| Apple | visionOS | visionOS versions antérieures à 26 | ||
| Apple | watchOS | watchOS versions antérieures à 26 | ||
| Apple | Xcode | Xcode versions antérieures à 26 |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "iOS versions 15.x ant\u00e9rieures \u00e0 15.8.5",
"product": {
"name": "iOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iOS versions 16.x ant\u00e9rieures \u00e0 16.7.12",
"product": {
"name": "iOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iOS versions 18.x ant\u00e9rieures \u00e0 18.7",
"product": {
"name": "iOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iOS versions ant\u00e9rieures \u00e0 26",
"product": {
"name": "iOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iPadOS versions 15.x ant\u00e9rieures \u00e0 15.8.5",
"product": {
"name": "iPadOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iPadOS versions 16.x ant\u00e9rieures \u00e0 16.7.12",
"product": {
"name": "iPadOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iPadOS versions 18.x ant\u00e9rieures \u00e0 18.7",
"product": {
"name": "iPadOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iPadOS versions ant\u00e9rieures \u00e0 26",
"product": {
"name": "iPadOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS Sequoia versions ant\u00e9rieures \u00e0 15.7",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS Sonoma versions ant\u00e9rieures \u00e0 14.8",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS Tahoe versions ant\u00e9rieures \u00e0 26",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Safari versions ant\u00e9rieures \u00e0 26",
"product": {
"name": "Safari",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "tvOS versions ant\u00e9rieures \u00e0 26",
"product": {
"name": "tvOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "visionOS versions ant\u00e9rieures \u00e0 26",
"product": {
"name": "visionOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "watchOS versions ant\u00e9rieures \u00e0 26",
"product": {
"name": "watchOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Xcode versions ant\u00e9rieures \u00e0 26",
"product": {
"name": "Xcode",
"vendor": {
"name": "Apple",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-43292",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43292"
},
{
"name": "CVE-2025-43372",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43372"
},
{
"name": "CVE-2025-43332",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43332"
},
{
"name": "CVE-2025-31270",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31270"
},
{
"name": "CVE-2025-43362",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43362"
},
{
"name": "CVE-2025-43319",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43319"
},
{
"name": "CVE-2025-43340",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43340"
},
{
"name": "CVE-2025-43327",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43327"
},
{
"name": "CVE-2025-30468",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30468"
},
{
"name": "CVE-2025-43359",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43359"
},
{
"name": "CVE-2025-43262",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43262"
},
{
"name": "CVE-2024-27280",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27280"
},
{
"name": "CVE-2025-31269",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31269"
},
{
"name": "CVE-2025-43354",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43354"
},
{
"name": "CVE-2025-43326",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43326"
},
{
"name": "CVE-2025-43204",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43204"
},
{
"name": "CVE-2025-43273",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43273"
},
{
"name": "CVE-2025-43347",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43347"
},
{
"name": "CVE-2025-43302",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43302"
},
{
"name": "CVE-2025-43321",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43321"
},
{
"name": "CVE-2025-31254",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31254"
},
{
"name": "CVE-2025-43299",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43299"
},
{
"name": "CVE-2025-43316",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43316"
},
{
"name": "CVE-2025-43263",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43263"
},
{
"name": "CVE-2025-31255",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31255"
},
{
"name": "CVE-2025-43375",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43375"
},
{
"name": "CVE-2025-6965",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6965"
},
{
"name": "CVE-2025-43355",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43355"
},
{
"name": "CVE-2025-43207",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43207"
},
{
"name": "CVE-2025-43285",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43285"
},
{
"name": "CVE-2025-43370",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43370"
},
{
"name": "CVE-2025-43312",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43312"
},
{
"name": "CVE-2025-43317",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43317"
},
{
"name": "CVE-2025-31271",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31271"
},
{
"name": "CVE-2025-43208",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43208"
},
{
"name": "CVE-2025-43283",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43283"
},
{
"name": "CVE-2025-48384",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48384"
},
{
"name": "CVE-2025-43277",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43277"
},
{
"name": "CVE-2025-43325",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43325"
},
{
"name": "CVE-2025-43231",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43231"
},
{
"name": "CVE-2025-24197",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24197"
},
{
"name": "CVE-2025-43358",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43358"
},
{
"name": "CVE-2025-43328",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43328"
},
{
"name": "CVE-2025-43368",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43368"
},
{
"name": "CVE-2025-43315",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43315"
},
{
"name": "CVE-2025-43331",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43331"
},
{
"name": "CVE-2025-43310",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43310"
},
{
"name": "CVE-2025-43333",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43333"
},
{
"name": "CVE-2025-43203",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43203"
},
{
"name": "CVE-2025-43307",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43307"
},
{
"name": "CVE-2025-43297",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43297"
},
{
"name": "CVE-2025-43190",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43190"
},
{
"name": "CVE-2025-24088",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24088"
},
{
"name": "CVE-2025-43293",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43293"
},
{
"name": "CVE-2025-43343",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43343"
},
{
"name": "CVE-2025-43294",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43294"
},
{
"name": "CVE-2025-43286",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43286"
},
{
"name": "CVE-2025-43353",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43353"
},
{
"name": "CVE-2025-43356",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43356"
},
{
"name": "CVE-2025-43330",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43330"
},
{
"name": "CVE-2025-43272",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43272"
},
{
"name": "CVE-2025-31259",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31259"
},
{
"name": "CVE-2025-31268",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31268"
},
{
"name": "CVE-2025-43366",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43366"
},
{
"name": "CVE-2025-43298",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43298"
},
{
"name": "CVE-2025-43369",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43369"
},
{
"name": "CVE-2025-43308",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43308"
},
{
"name": "CVE-2025-43346",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43346"
},
{
"name": "CVE-2025-40909",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40909"
},
{
"name": "CVE-2025-43337",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43337"
},
{
"name": "CVE-2025-24133",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24133"
},
{
"name": "CVE-2025-43279",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43279"
},
{
"name": "CVE-2025-43314",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43314"
},
{
"name": "CVE-2025-43300",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43300"
},
{
"name": "CVE-2025-43342",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43342"
},
{
"name": "CVE-2025-43349",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43349"
},
{
"name": "CVE-2025-43341",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43341"
},
{
"name": "CVE-2025-43301",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43301"
},
{
"name": "CVE-2025-43318",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43318"
},
{
"name": "CVE-2025-43344",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43344"
},
{
"name": "CVE-2025-43311",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43311"
},
{
"name": "CVE-2025-43287",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43287"
},
{
"name": "CVE-2025-43303",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43303"
},
{
"name": "CVE-2025-43304",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43304"
},
{
"name": "CVE-2025-43291",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43291"
},
{
"name": "CVE-2025-43329",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43329"
},
{
"name": "CVE-2025-43357",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43357"
},
{
"name": "CVE-2025-43367",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43367"
},
{
"name": "CVE-2025-43371",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43371"
},
{
"name": "CVE-2025-43295",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43295"
},
{
"name": "CVE-2025-43305",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43305"
}
],
"links": [],
"reference": "CERTFR-2025-AVI-0791",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-09-16T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Apple. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n\nApple indique que la vuln\u00e9rabilit\u00e9 CVE-2025-43300 est activement exploit\u00e9e.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Apple",
"vendor_advisories": [
{
"published_at": "2025-09-15",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125112",
"url": "https://support.apple.com/en-us/125112"
},
{
"published_at": "2025-09-15",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125116",
"url": "https://support.apple.com/en-us/125116"
},
{
"published_at": "2025-09-15",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125110",
"url": "https://support.apple.com/en-us/125110"
},
{
"published_at": "2025-09-15",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125115",
"url": "https://support.apple.com/en-us/125115"
},
{
"published_at": "2025-09-15",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125141",
"url": "https://support.apple.com/en-us/125141"
},
{
"published_at": "2025-09-15",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125117",
"url": "https://support.apple.com/en-us/125117"
},
{
"published_at": "2025-09-15",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125114",
"url": "https://support.apple.com/en-us/125114"
},
{
"published_at": "2025-09-15",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125108",
"url": "https://support.apple.com/en-us/125108"
},
{
"published_at": "2025-09-15",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125111",
"url": "https://support.apple.com/en-us/125111"
},
{
"published_at": "2025-09-15",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125109",
"url": "https://support.apple.com/en-us/125109"
},
{
"published_at": "2025-09-15",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125142",
"url": "https://support.apple.com/en-us/125142"
},
{
"published_at": "2025-09-15",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125113",
"url": "https://support.apple.com/en-us/125113"
}
]
}
CVE-2026-65393 (GCVE-0-2026-65393)
Vulnerability from nvd – Published: 2026-09-14 20:51 – Updated: 2026-09-15 18:02
VLAI
EPSS
VEX
Summary
A permissions issue was addressed with improved validation. This issue is fixed in Xcode 27, macOS Golden Gate 27. An app may be able to access user-sensitive data.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 18:01 UTC
CWE
- An app may be able to access user-sensitive data
- CWE-863 - Incorrect Authorization
Assigner
References
2 references
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-65393",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T18:01:31.031063Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T18:02:34.819Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Xcode",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A permissions issue was addressed with improved validation. This issue is fixed in Xcode 27, macOS Golden Gate 27. An app may be able to access user-sensitive data."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to access user-sensitive data",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:51:43.443Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/149035"
},
{
"url": "https://support.apple.com/en-us/149040"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-65393",
"datePublished": "2026-09-14T20:51:43.443Z",
"dateReserved": "2026-07-22T00:46:44.573Z",
"dateUpdated": "2026-09-15T18:02:34.819Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-28890 (GCVE-0-2026-28890)
Vulnerability from nvd – Published: 2026-03-25 00:32 – Updated: 2026-04-02 18:24
VLAI
EPSS
VEX
Summary
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 26.4. An app may be able to cause unexpected system termination.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-25 17:57 UTC
CWE
- An app may be able to cause unexpected system termination
- CWE-125 - Out-of-bounds Read
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-28890",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-25T17:57:34.890568Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T18:07:48.200Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Xcode",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 26.4. An app may be able to cause unexpected system termination."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to cause unexpected system termination",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:24:17.212Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/126801"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-28890",
"datePublished": "2026-03-25T00:32:51.440Z",
"dateReserved": "2026-03-03T16:36:03.980Z",
"dateUpdated": "2026-04-02T18:24:17.212Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-28889 (GCVE-0-2026-28889)
Vulnerability from nvd – Published: 2026-03-25 00:31 – Updated: 2026-04-02 18:11
VLAI
EPSS
VEX
Summary
A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 26.4. An app may be able to read arbitrary files as root.
Severity
6.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-25 19:13 UTC
CWE
- An app may be able to read arbitrary files as root
- CWE-269 - Improper Privilege Management
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-28889",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-25T19:13:27.975044Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T19:13:30.883Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Xcode",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 26.4. An app may be able to read arbitrary files as root."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to read arbitrary files as root",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:11:05.556Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/126801"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-28889",
"datePublished": "2026-03-25T00:31:44.560Z",
"dateReserved": "2026-03-03T16:36:03.980Z",
"dateUpdated": "2026-04-02T18:11:05.556Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-31186 (GCVE-0-2025-31186)
Vulnerability from nvd – Published: 2026-01-16 17:06 – Updated: 2026-04-02 18:24
VLAI
EPSS
VEX
Summary
A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 16.3. An app may be able to bypass Privacy preferences.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-16 18:26 UTC
CWE
- An app may be able to bypass Privacy preferences
- CWE-284 - Improper Access Control
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-31186",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-16T18:26:21.212263Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-16T18:28:37.081Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Xcode",
"vendor": "Apple",
"versions": [
{
"lessThan": "16.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 16.3. An app may be able to bypass Privacy preferences."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to bypass Privacy preferences",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:24:28.343Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/122380"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2025-31186",
"datePublished": "2026-01-16T17:06:10.519Z",
"dateReserved": "2025-03-27T16:13:58.311Z",
"dateUpdated": "2026-04-02T18:24:28.343Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-43505 (GCVE-0-2025-43505)
Vulnerability from nvd – Published: 2025-11-04 01:16 – Updated: 2026-04-02 18:17
VLAI
EPSS
VEX
Summary
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Xcode 26.1. Processing a maliciously crafted file may lead to heap corruption.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-11-05 04:55 UTC
CWE
- Processing a maliciously crafted file may lead to heap corruption
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-43505",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-05T04:55:22.307825Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T17:47:34.381Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Xcode",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Xcode 26.1. Processing a maliciously crafted file may lead to heap corruption."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Processing a maliciously crafted file may lead to heap corruption",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:17:54.767Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/125641"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2025-43505",
"datePublished": "2025-11-04T01:16:46.705Z",
"dateReserved": "2025-04-16T15:27:21.193Z",
"dateUpdated": "2026-04-02T18:17:54.767Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-43504 (GCVE-0-2025-43504)
Vulnerability from nvd – Published: 2025-11-04 01:17 – Updated: 2026-04-02 18:22
VLAI
EPSS
VEX
Summary
A buffer overflow was addressed with improved bounds checking. This issue is fixed in Xcode 26.1. A user in a privileged network position may be able to cause a denial-of-service.
Severity
4.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-11-04 13:07 UTC
CWE
- A user in a privileged network position may be able to cause a denial-of-service
- CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-43504",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-04T13:07:16.935477Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-04T13:07:19.240Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Xcode",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A buffer overflow was addressed with improved bounds checking. This issue is fixed in Xcode 26.1. A user in a privileged network position may be able to cause a denial-of-service."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "A user in a privileged network position may be able to cause a denial-of-service",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:22:09.762Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/125641"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2025-43504",
"datePublished": "2025-11-04T01:17:21.026Z",
"dateReserved": "2025-04-16T15:27:21.193Z",
"dateUpdated": "2026-04-02T18:22:09.762Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-43375 (GCVE-0-2025-43375)
Vulnerability from nvd – Published: 2025-09-15 22:35 – Updated: 2026-04-02 18:21
VLAI
EPSS
VEX
Summary
The issue was addressed with improved checks. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-16 13:36 UTC
CWE
- Processing an overly large path value may crash a process
- CWE-20 - Improper Input Validation
Assigner
References
2 references
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-43375",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-16T13:36:48.222793Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-16T17:24:28.516Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T18:12:52.650Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2025/Sep/60"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Xcode",
"vendor": "Apple",
"versions": [
{
"lessThan": "26",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The issue was addressed with improved checks. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Processing an overly large path value may crash a process",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:21:11.160Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/125117"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2025-43375",
"datePublished": "2025-09-15T22:35:27.230Z",
"dateReserved": "2025-04-16T15:24:37.115Z",
"dateUpdated": "2026-04-02T18:21:11.160Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-43371 (GCVE-0-2025-43371)
Vulnerability from nvd – Published: 2025-09-15 22:34 – Updated: 2026-04-02 18:11
VLAI
EPSS
VEX
Summary
This issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to break out of its sandbox.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-16 13:40 UTC
CWE
- An app may be able to break out of its sandbox
- CWE-284 - Improper Access Control
Assigner
References
2 references
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-43371",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-16T13:40:41.659342Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-16T17:26:58.156Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T18:12:47.005Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2025/Sep/60"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Xcode",
"vendor": "Apple",
"versions": [
{
"lessThan": "26",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "This issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to break out of its sandbox."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to break out of its sandbox",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:11:08.283Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/125117"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2025-43371",
"datePublished": "2025-09-15T22:34:35.897Z",
"dateReserved": "2025-04-16T15:24:37.114Z",
"dateUpdated": "2026-04-02T18:11:08.283Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-43370 (GCVE-0-2025-43370)
Vulnerability from nvd – Published: 2025-09-15 22:34 – Updated: 2026-04-02 18:08
VLAI
EPSS
VEX
Summary
A path handling issue was addressed with improved validation. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process.
Severity
4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-16 15:01 UTC
CWE
- Processing an overly large path value may crash a process
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
2 references
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-43370",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-16T15:01:11.182130Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-16T15:02:24.169Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T18:12:46.055Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2025/Sep/60"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Xcode",
"vendor": "Apple",
"versions": [
{
"lessThan": "26",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A path handling issue was addressed with improved validation. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Processing an overly large path value may crash a process",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:08:15.385Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/125117"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2025-43370",
"datePublished": "2025-09-15T22:34:21.797Z",
"dateReserved": "2025-04-16T15:24:37.114Z",
"dateUpdated": "2026-04-02T18:08:15.385Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-43263 (GCVE-0-2025-43263)
Vulnerability from nvd – Published: 2025-09-15 22:34 – Updated: 2026-04-02 18:11
VLAI
EPSS
VEX
Summary
The issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to read and write files outside of its sandbox.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-16 13:40 UTC
CWE
- An app may be able to read and write files outside of its sandbox
- CWE-284 - Improper Access Control
Assigner
References
2 references
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-43263",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-16T13:40:33.815609Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-16T17:26:52.323Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T18:09:50.030Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2025/Sep/60"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Xcode",
"vendor": "Apple",
"versions": [
{
"lessThan": "26",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to read and write files outside of its sandbox."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to read and write files outside of its sandbox",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:11:14.679Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/125117"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2025-43263",
"datePublished": "2025-09-15T22:34:36.899Z",
"dateReserved": "2025-04-16T15:24:37.099Z",
"dateUpdated": "2026-04-02T18:11:14.679Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-48384 (GCVE-0-2025-48384)
Vulnerability from nvd – Published: 2025-07-08 18:23 – Updated: 2026-02-26 17:51Title
Git allows arbitrary code execution through broken config quoting
Summary
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.
Severity
8.1 (High)
SSVC
Exploitation: active
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-08-26 03:55 UTC
CWE
Assigner
References
5 references
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-48384",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-26T03:55:23.181071Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2025-08-25",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48384"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T17:51:05.174Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48384"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-08-25T00:00:00.000Z",
"value": "CVE-2025-48384 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T21:11:00.255Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00003.html"
},
{
"url": "http://seclists.org/fulldisclosure/2025/Sep/60"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/07/08/4"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "git",
"vendor": "git",
"versions": [
{
"status": "affected",
"version": "\u003c 2.43.7"
},
{
"status": "affected",
"version": "\u003e= 2.44.0-rc0, \u003c 2.44.4"
},
{
"status": "affected",
"version": "\u003e= 2.45.0-rc0, \u003c 2.45.4"
},
{
"status": "affected",
"version": "\u003e= 2.46.0-rc0, \u003c 2.46.4"
},
{
"status": "affected",
"version": "\u003e= 2.47.0-rc0, \u003c 2.47.3"
},
{
"status": "affected",
"version": "\u003e= 2.48.0-rc0, \u003c 2.48.2"
},
{
"status": "affected",
"version": "\u003e= 2.49.0-rc0, \u003c 2.49.1"
},
{
"status": "affected",
"version": "\u003e= 2.50.0-rc0, \u003c 2.50.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-436",
"description": "CWE-436: Interpretation Conflict",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-08T18:23:48.710Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9"
}
],
"source": {
"advisory": "GHSA-vwqx-4fm8-6qc9",
"discovery": "UNKNOWN"
},
"title": "Git allows arbitrary code execution through broken config quoting"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-48384",
"datePublished": "2025-07-08T18:23:48.710Z",
"dateReserved": "2025-05-19T15:46:00.397Z",
"dateUpdated": "2026-02-26T17:51:05.174Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-30441 (GCVE-0-2025-30441)
Vulnerability from nvd – Published: 2025-03-31 22:23 – Updated: 2026-04-02 18:18
VLAI
EPSS
VEX
Summary
This issue was addressed through improved state management. This issue is fixed in Xcode 16.3. An app may be able to overwrite arbitrary files.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-01 20:44 UTC
CWE
- An app may be able to overwrite arbitrary files
- CWE-787 - Out-of-bounds Write
Assigner
References
2 references
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-30441",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-01T20:44:42.442262Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-01T20:45:25.420Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T21:14:47.381Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2025/Apr/3"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Xcode",
"vendor": "Apple",
"versions": [
{
"lessThan": "16.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "This issue was addressed through improved state management. This issue is fixed in Xcode 16.3. An app may be able to overwrite arbitrary files."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to overwrite arbitrary files",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:18:49.719Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/122380"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2025-30441",
"datePublished": "2025-03-31T22:23:27.966Z",
"dateReserved": "2025-03-22T00:04:43.717Z",
"dateUpdated": "2026-04-02T18:18:49.719Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-24226 (GCVE-0-2025-24226)
Vulnerability from nvd – Published: 2025-03-31 22:23 – Updated: 2026-04-02 18:14
VLAI
EPSS
VEX
Summary
The issue was addressed with improved checks. This issue is fixed in Xcode 16.3. A malicious app may be able to access private information.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-01 14:18 UTC
CWE
- A malicious app may be able to access private information
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
2 references
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-24226",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-01T14:18:32.896619Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-01T14:19:17.199Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T21:09:10.790Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2025/Apr/3"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Xcode",
"vendor": "Apple",
"versions": [
{
"lessThan": "16.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The issue was addressed with improved checks. This issue is fixed in Xcode 16.3. A malicious app may be able to access private information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "A malicious app may be able to access private information",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:14:27.956Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/122380"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2025-24226",
"datePublished": "2025-03-31T22:23:04.994Z",
"dateReserved": "2025-01-17T00:00:45.005Z",
"dateUpdated": "2026-04-02T18:14:27.956Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65393 (GCVE-0-2026-65393)
Vulnerability from cvelistv5 – Published: 2026-09-14 20:51 – Updated: 2026-09-15 18:02
VLAI
EPSS
VEX
Summary
A permissions issue was addressed with improved validation. This issue is fixed in Xcode 27, macOS Golden Gate 27. An app may be able to access user-sensitive data.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 18:01 UTC
CWE
- An app may be able to access user-sensitive data
- CWE-863 - Incorrect Authorization
Assigner
References
2 references
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-65393",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T18:01:31.031063Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T18:02:34.819Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Xcode",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A permissions issue was addressed with improved validation. This issue is fixed in Xcode 27, macOS Golden Gate 27. An app may be able to access user-sensitive data."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to access user-sensitive data",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:51:43.443Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/149035"
},
{
"url": "https://support.apple.com/en-us/149040"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-65393",
"datePublished": "2026-09-14T20:51:43.443Z",
"dateReserved": "2026-07-22T00:46:44.573Z",
"dateUpdated": "2026-09-15T18:02:34.819Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-28890 (GCVE-0-2026-28890)
Vulnerability from cvelistv5 – Published: 2026-03-25 00:32 – Updated: 2026-04-02 18:24
VLAI
EPSS
VEX
Summary
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 26.4. An app may be able to cause unexpected system termination.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-25 17:57 UTC
CWE
- An app may be able to cause unexpected system termination
- CWE-125 - Out-of-bounds Read
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-28890",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-25T17:57:34.890568Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T18:07:48.200Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Xcode",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 26.4. An app may be able to cause unexpected system termination."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to cause unexpected system termination",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:24:17.212Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/126801"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-28890",
"datePublished": "2026-03-25T00:32:51.440Z",
"dateReserved": "2026-03-03T16:36:03.980Z",
"dateUpdated": "2026-04-02T18:24:17.212Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-28889 (GCVE-0-2026-28889)
Vulnerability from cvelistv5 – Published: 2026-03-25 00:31 – Updated: 2026-04-02 18:11
VLAI
EPSS
VEX
Summary
A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 26.4. An app may be able to read arbitrary files as root.
Severity
6.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-25 19:13 UTC
CWE
- An app may be able to read arbitrary files as root
- CWE-269 - Improper Privilege Management
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-28889",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-25T19:13:27.975044Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T19:13:30.883Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Xcode",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 26.4. An app may be able to read arbitrary files as root."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to read arbitrary files as root",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:11:05.556Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/126801"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-28889",
"datePublished": "2026-03-25T00:31:44.560Z",
"dateReserved": "2026-03-03T16:36:03.980Z",
"dateUpdated": "2026-04-02T18:11:05.556Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-31186 (GCVE-0-2025-31186)
Vulnerability from cvelistv5 – Published: 2026-01-16 17:06 – Updated: 2026-04-02 18:24
VLAI
EPSS
VEX
Summary
A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 16.3. An app may be able to bypass Privacy preferences.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-16 18:26 UTC
CWE
- An app may be able to bypass Privacy preferences
- CWE-284 - Improper Access Control
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-31186",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-16T18:26:21.212263Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-16T18:28:37.081Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Xcode",
"vendor": "Apple",
"versions": [
{
"lessThan": "16.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 16.3. An app may be able to bypass Privacy preferences."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to bypass Privacy preferences",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:24:28.343Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/122380"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2025-31186",
"datePublished": "2026-01-16T17:06:10.519Z",
"dateReserved": "2025-03-27T16:13:58.311Z",
"dateUpdated": "2026-04-02T18:24:28.343Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-43504 (GCVE-0-2025-43504)
Vulnerability from cvelistv5 – Published: 2025-11-04 01:17 – Updated: 2026-04-02 18:22
VLAI
EPSS
VEX
Summary
A buffer overflow was addressed with improved bounds checking. This issue is fixed in Xcode 26.1. A user in a privileged network position may be able to cause a denial-of-service.
Severity
4.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-11-04 13:07 UTC
CWE
- A user in a privileged network position may be able to cause a denial-of-service
- CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-43504",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-04T13:07:16.935477Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-04T13:07:19.240Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Xcode",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A buffer overflow was addressed with improved bounds checking. This issue is fixed in Xcode 26.1. A user in a privileged network position may be able to cause a denial-of-service."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "A user in a privileged network position may be able to cause a denial-of-service",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:22:09.762Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/125641"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2025-43504",
"datePublished": "2025-11-04T01:17:21.026Z",
"dateReserved": "2025-04-16T15:27:21.193Z",
"dateUpdated": "2026-04-02T18:22:09.762Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-43505 (GCVE-0-2025-43505)
Vulnerability from cvelistv5 – Published: 2025-11-04 01:16 – Updated: 2026-04-02 18:17
VLAI
EPSS
VEX
Summary
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Xcode 26.1. Processing a maliciously crafted file may lead to heap corruption.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-11-05 04:55 UTC
CWE
- Processing a maliciously crafted file may lead to heap corruption
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-43505",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-05T04:55:22.307825Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T17:47:34.381Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Xcode",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Xcode 26.1. Processing a maliciously crafted file may lead to heap corruption."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Processing a maliciously crafted file may lead to heap corruption",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:17:54.767Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/125641"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2025-43505",
"datePublished": "2025-11-04T01:16:46.705Z",
"dateReserved": "2025-04-16T15:27:21.193Z",
"dateUpdated": "2026-04-02T18:17:54.767Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-43375 (GCVE-0-2025-43375)
Vulnerability from cvelistv5 – Published: 2025-09-15 22:35 – Updated: 2026-04-02 18:21
VLAI
EPSS
VEX
Summary
The issue was addressed with improved checks. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-16 13:36 UTC
CWE
- Processing an overly large path value may crash a process
- CWE-20 - Improper Input Validation
Assigner
References
2 references
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-43375",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-16T13:36:48.222793Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-16T17:24:28.516Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T18:12:52.650Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2025/Sep/60"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Xcode",
"vendor": "Apple",
"versions": [
{
"lessThan": "26",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The issue was addressed with improved checks. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Processing an overly large path value may crash a process",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:21:11.160Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/125117"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2025-43375",
"datePublished": "2025-09-15T22:35:27.230Z",
"dateReserved": "2025-04-16T15:24:37.115Z",
"dateUpdated": "2026-04-02T18:21:11.160Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-43263 (GCVE-0-2025-43263)
Vulnerability from cvelistv5 – Published: 2025-09-15 22:34 – Updated: 2026-04-02 18:11
VLAI
EPSS
VEX
Summary
The issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to read and write files outside of its sandbox.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-16 13:40 UTC
CWE
- An app may be able to read and write files outside of its sandbox
- CWE-284 - Improper Access Control
Assigner
References
2 references
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-43263",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-16T13:40:33.815609Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-16T17:26:52.323Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T18:09:50.030Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2025/Sep/60"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Xcode",
"vendor": "Apple",
"versions": [
{
"lessThan": "26",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to read and write files outside of its sandbox."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to read and write files outside of its sandbox",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:11:14.679Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/125117"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2025-43263",
"datePublished": "2025-09-15T22:34:36.899Z",
"dateReserved": "2025-04-16T15:24:37.099Z",
"dateUpdated": "2026-04-02T18:11:14.679Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-43371 (GCVE-0-2025-43371)
Vulnerability from cvelistv5 – Published: 2025-09-15 22:34 – Updated: 2026-04-02 18:11
VLAI
EPSS
VEX
Summary
This issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to break out of its sandbox.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-16 13:40 UTC
CWE
- An app may be able to break out of its sandbox
- CWE-284 - Improper Access Control
Assigner
References
2 references
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-43371",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-16T13:40:41.659342Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-16T17:26:58.156Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T18:12:47.005Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2025/Sep/60"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Xcode",
"vendor": "Apple",
"versions": [
{
"lessThan": "26",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "This issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to break out of its sandbox."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to break out of its sandbox",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:11:08.283Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/125117"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2025-43371",
"datePublished": "2025-09-15T22:34:35.897Z",
"dateReserved": "2025-04-16T15:24:37.114Z",
"dateUpdated": "2026-04-02T18:11:08.283Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-43370 (GCVE-0-2025-43370)
Vulnerability from cvelistv5 – Published: 2025-09-15 22:34 – Updated: 2026-04-02 18:08
VLAI
EPSS
VEX
Summary
A path handling issue was addressed with improved validation. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process.
Severity
4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-16 15:01 UTC
CWE
- Processing an overly large path value may crash a process
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
2 references
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-43370",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-16T15:01:11.182130Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-16T15:02:24.169Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T18:12:46.055Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2025/Sep/60"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Xcode",
"vendor": "Apple",
"versions": [
{
"lessThan": "26",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A path handling issue was addressed with improved validation. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Processing an overly large path value may crash a process",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:08:15.385Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/125117"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2025-43370",
"datePublished": "2025-09-15T22:34:21.797Z",
"dateReserved": "2025-04-16T15:24:37.114Z",
"dateUpdated": "2026-04-02T18:08:15.385Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-48384 (GCVE-0-2025-48384)
Vulnerability from cvelistv5 – Published: 2025-07-08 18:23 – Updated: 2026-02-26 17:51Title
Git allows arbitrary code execution through broken config quoting
Summary
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.
Severity
8.1 (High)
SSVC
Exploitation: active
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-08-26 03:55 UTC
CWE
Assigner
References
5 references
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-48384",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-26T03:55:23.181071Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2025-08-25",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48384"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T17:51:05.174Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48384"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-08-25T00:00:00.000Z",
"value": "CVE-2025-48384 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T21:11:00.255Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00003.html"
},
{
"url": "http://seclists.org/fulldisclosure/2025/Sep/60"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/07/08/4"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "git",
"vendor": "git",
"versions": [
{
"status": "affected",
"version": "\u003c 2.43.7"
},
{
"status": "affected",
"version": "\u003e= 2.44.0-rc0, \u003c 2.44.4"
},
{
"status": "affected",
"version": "\u003e= 2.45.0-rc0, \u003c 2.45.4"
},
{
"status": "affected",
"version": "\u003e= 2.46.0-rc0, \u003c 2.46.4"
},
{
"status": "affected",
"version": "\u003e= 2.47.0-rc0, \u003c 2.47.3"
},
{
"status": "affected",
"version": "\u003e= 2.48.0-rc0, \u003c 2.48.2"
},
{
"status": "affected",
"version": "\u003e= 2.49.0-rc0, \u003c 2.49.1"
},
{
"status": "affected",
"version": "\u003e= 2.50.0-rc0, \u003c 2.50.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-436",
"description": "CWE-436: Interpretation Conflict",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-08T18:23:48.710Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9"
}
],
"source": {
"advisory": "GHSA-vwqx-4fm8-6qc9",
"discovery": "UNKNOWN"
},
"title": "Git allows arbitrary code execution through broken config quoting"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-48384",
"datePublished": "2025-07-08T18:23:48.710Z",
"dateReserved": "2025-05-19T15:46:00.397Z",
"dateUpdated": "2026-02-26T17:51:05.174Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-30441 (GCVE-0-2025-30441)
Vulnerability from cvelistv5 – Published: 2025-03-31 22:23 – Updated: 2026-04-02 18:18
VLAI
EPSS
VEX
Summary
This issue was addressed through improved state management. This issue is fixed in Xcode 16.3. An app may be able to overwrite arbitrary files.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-01 20:44 UTC
CWE
- An app may be able to overwrite arbitrary files
- CWE-787 - Out-of-bounds Write
Assigner
References
2 references
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-30441",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-01T20:44:42.442262Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-01T20:45:25.420Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T21:14:47.381Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2025/Apr/3"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Xcode",
"vendor": "Apple",
"versions": [
{
"lessThan": "16.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "This issue was addressed through improved state management. This issue is fixed in Xcode 16.3. An app may be able to overwrite arbitrary files."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to overwrite arbitrary files",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:18:49.719Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/122380"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2025-30441",
"datePublished": "2025-03-31T22:23:27.966Z",
"dateReserved": "2025-03-22T00:04:43.717Z",
"dateUpdated": "2026-04-02T18:18:49.719Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0270
Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-11 11:21
VLAI
EPSS
VEX
Title
APPLE-SA-03-24-2026-10 Xcode 26.4
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-03-24-2026-10 Xcode 26.4
Xcode 26.4 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/126801.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
otool
Available for: macOS Tahoe 26.2 and later
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-28890: Nathaniel Oh (@calysteon)
Simulator
Available for: macOS Tahoe 26.2 and later
Impact: An app may be able to read arbitrary files as root
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-28889: Mihai Marin
Additional recognition
Dev Tools
We would like to acknowledge Nathaniel Oh (@calysteon) for their
assistance.
otool
We would like to acknowledge Eddy T for their assistance.
Swift
We would like to acknowledge Banavath Aravind for their assistance.
Xcode 26.4 may be obtained from:
https://developer.apple.com/xcode/downloads/
To check that the Xcode has been updated:
* Select Xcode in the menu bar
* Select About Xcode
* The version after applying this update will be "Xcode 26.4".
All information is also posted on the Apple Security Releases
web site: https://support.apple.com/100100.
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmnDI48ACgkQ4Ifiq8DH
7PUtRg/+K3DU37tAHl9h/wfU7fO6J/I8YhzMGU6tcLK4b/9UG/16/qOwIUVLd9ML
mCrEQY3hevwMyA+ki0HRmE0aiNTtGiFlpxNxhsyo3p6QDMXR4xyPjyFFdOcjUfKI
kDHTg0NoCZWi63+hpGHhP3emCAr9/rDnOwtbUDrl57UaCc05HPydZ40ggNxz9S2/
wh6ZrXPKlQHDBYQcmRV1TkqcdpyCJqNNIG2N+SBH489easlDXfQf5AS1Go3otDbU
MwviuKhN4DDPbcV+SXVJjJR/NQzmWFO5RuFvjkFTh/Z7Xi9HQY1Ytkekwl/LfNDw
OdC1aMu7CxKe4ZmC3fcOEOoriVDXVqORm3fmu1h5e9q/aJgJJy/0Rsu6hvec0yqJ
SJOv+oVAlQalZF23XYDm71vM0GdFS6jXkjAcDyeUIgK4a1xSNCln0fH/TEW4V+2f
plLWU8xirJ2vB+DO8+E6+Kg9WYDr63a8Tr0sNV0J42SwSbk3FLvsStEIgFIcm6HI
9SOyFWp3Jc8bFBmuOjiXFn9IBtkX6FT6TSWdDCIisdeilIcXHLRNa6Iljzn2kGqP
LmdGIbsSlggvy9thXIQ/t0ri2CL22aV6vV1Qjl1UW/i/vTtBA75ydroiyUhvo+If
dbSuto6QwxoTbULDd+lyHgRmJ4irQcOsJerFDI0k7Ju03n0hvdQ=
=YITA
-----END PGP SIGNATURE-----
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
8 references
Relationships
reference
GCVE-1988-2026-0270 (this record)
- related CVE-2026-28889
- related CVE-2026-28890
{
"containers": {
"cna": {
"affected": [
{
"product": "Xcode",
"vendor": "Apple",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-03-24-2026-10 Xcode 26.4\n\nXcode 26.4 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/126801.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\notool\nAvailable for: macOS Tahoe 26.2 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-28890: Nathaniel Oh (@calysteon)\n\nSimulator\nAvailable for: macOS Tahoe 26.2 and later\nImpact: An app may be able to read arbitrary files as root\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28889: Mihai Marin\n\nAdditional recognition\n\nDev Tools\nWe would like to acknowledge Nathaniel Oh (@calysteon) for their\nassistance.\n\notool\nWe would like to acknowledge Eddy T for their assistance.\n\nSwift\nWe would like to acknowledge Banavath Aravind for their assistance.\n\nXcode 26.4 may be obtained from:\n\nhttps://developer.apple.com/xcode/downloads/\n\nTo check that the Xcode has been updated:\n\n* Select Xcode in the menu bar\n* Select About Xcode\n* The version after applying this update will be \"Xcode 26.4\".\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmnDI48ACgkQ4Ifiq8DH\n7PUtRg/+K3DU37tAHl9h/wfU7fO6J/I8YhzMGU6tcLK4b/9UG/16/qOwIUVLd9ML\nmCrEQY3hevwMyA+ki0HRmE0aiNTtGiFlpxNxhsyo3p6QDMXR4xyPjyFFdOcjUfKI\nkDHTg0NoCZWi63+hpGHhP3emCAr9/rDnOwtbUDrl57UaCc05HPydZ40ggNxz9S2/\nwh6ZrXPKlQHDBYQcmRV1TkqcdpyCJqNNIG2N+SBH489easlDXfQf5AS1Go3otDbU\nMwviuKhN4DDPbcV+SXVJjJR/NQzmWFO5RuFvjkFTh/Z7Xi9HQY1Ytkekwl/LfNDw\nOdC1aMu7CxKe4ZmC3fcOEOoriVDXVqORm3fmu1h5e9q/aJgJJy/0Rsu6hvec0yqJ\nSJOv+oVAlQalZF23XYDm71vM0GdFS6jXkjAcDyeUIgK4a1xSNCln0fH/TEW4V+2f\nplLWU8xirJ2vB+DO8+E6+Kg9WYDr63a8Tr0sNV0J42SwSbk3FLvsStEIgFIcm6HI\n9SOyFWp3Jc8bFBmuOjiXFn9IBtkX6FT6TSWdDCIisdeilIcXHLRNa6Iljzn2kGqP\nLmdGIbsSlggvy9thXIQ/t0ri2CL22aV6vV1Qjl1UW/i/vTtBA75ydroiyUhvo+If\ndbSuto6QwxoTbULDd+lyHgRmJ4irQcOsJerFDI0k7Ju03n0hvdQ=\n=YITA\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:21:58Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/25"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Mar/25"
},
{
"url": "https://developer.apple.com/xcode/downloads/"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/126801"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Mar/25"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-03-24-2026-10 Xcode 26.4",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-28889",
"type": "related"
},
{
"destId": "CVE-2026-28890",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0270",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/25",
"automated": true,
"contentSha256": "21d0f7f48fa4cc7406405781627c0cb071ada2d9732289b5217227cb7b51bacf",
"evidenceScore": 6,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/25",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-03-25T00:06:07Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0270"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T08:13:43Z",
"dateUpdated": "2026-09-11T11:21:58Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0270"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}