NCSC-2026-0215 [1.00] [M/H] Vulnerabilities fixed in Apple iOS and iPadOS
Apple has fixed multiple vulnerabilities in iOS and iPadOS. The vulnerabilities include out-of-bounds access, use-after-free, memory handling errors, insufficient input validation, type confusion, double free, stack overflow, race conditions, and path handling issues. These errors can lead to unexpected crashes of processes, memory corruption, unauthorized access to sensitive data such as clipboard content and kernel state, and bypassing sandbox restrictions. Malicious actors can exploit these vulnerabilities by providing specially crafted web content or applications that trigger the mentioned errors, resulting in process instability, system termination, or data leaks. The vulnerabilities have been resolved through improved bounds checking, input validation, memory management, state management, and security controls in the affected software components.
CSIRTS triage
- What
- Multiple vulnerabilities can lead to crashes, memory corruption, and unauthorized access to sensitive data.
- Who is affected
- Users of iOS and iPadOS devices.
- Urgency
- Remediation is urgent due to the potential for exploitation and data leaks.
- Action
- Update to the latest version of iOS and iPadOS.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch iOS and iPadOS
Get an email when a new iOS and iPadOS advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0215
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-289790.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-398680.96% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 58% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-398720.25% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 17% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-436630.25% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 17% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-436760.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-436990.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-437000.24% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 16% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-437010.50% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 41% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-437030.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 34% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-437040.38% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all EPSS-scored CVEs.
Referenced CVEs
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[NEW] [high] Apple macOS, iOS and iPadOS: Multiple vulnerabilitiescert-bund
- medium[NEW] [medium] WebKitGTK: Multiple vulnerabilitiescert-bund
- unknownNCSC-2026-0319 [1.00] [M/H] Vulnerabilities resolved in Apple iOS and iPadOSncsc-nl
- unknownApple Products Multiple Vulnerabilitieshkcert
- unknownMultiple vulnerabilities in Apple products (August 18, 2026)cert-fr-avis
- high[NEW] [high] Apple macOS (Tahoe, Sonoma, and Sequoia): Multiple vulnerabilitiescert-bund
- medium[NEW] [medium] Apple Safari: Multiple vulnerabilitiescert-bund
- medium[NEW] [medium] Apple iOS and iPadOS: Multiple vulnerabilitiescert-bund
- unknownNCSC-2026-0267 [1.00] [M/H] Vulnerabilities fixed in Apple MacOSncsc-nl
- unknownNCSC-2026-0266 [1.00] [M/H] Vulnerabilities fixed in Apple iOS and iPadOSncsc-nl
- unknownApple Products Multiple Vulnerabilitieshkcert
- unknownMultiple vulnerabilities in Apple products (July 28, 2026)cert-fr-avis
Recent advisories for Apple iOS and
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- high[NEW] [high] Apple macOS, iOS and iPadOS: Multiple vulnerabilitiescert-bund · 2026-08-25
- unknownNCSC-2026-0319 [1.00] [M/H] Vulnerabilities resolved in Apple iOS and iPadOSncsc-nl · 2026-08-20
- medium[NEW] [medium] Apple iOS and iPadOS: Multiple vulnerabilitiescert-bund · 2026-07-28
- unknownNCSC-2026-0266 [1.00] [M/H] Vulnerabilities fixed in Apple iOS and iPadOSncsc-nl · 2026-07-28
- criticalexploitedCVE-2023-41974: Apple iOS and iPadOS Use-After-Free Vulnerabilitycisa-kev · 2026-03-05
- criticalexploitedCVE-2025-43300: Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerabilitycisa-kev · 2025-08-21
More from NCSC-NL Advisories
- unknownNCSC-2026-0303 [1.01] [M/H] Vulnerabilities patched in GitLab by GitLab Inc.2026-08-25
- unknownNCSC-2026-0326 [1.00] [M/H] Vulnerabilities patched in Keycloak2026-08-25
- unknownNCSC-2026-0325 [1.00] [M/H] Vulnerabilities patched in Atlassian products2026-08-24
- unknownNCSC-2026-0324 [1.00] [M/H] Vulnerability fixed in Zimbra Collaboration Suite2026-08-23
- unknownNCSC-2026-0323 [1.00] [M/H] Vulnerabilities fixed in Cisco Secure Workload2026-08-21