Apple Patches macOS, iOS, iPadOS: 28 Vulnerabilities Fixed
Key Takeaways Apple has released critical security updates for macOS, iOS, and iPadOS. The patches address 28 vulnerabilities, including issues that could lead to arbitrary code execution, kernel...
Key Takeaways
- Apple has released critical security updates for macOS, iOS, and iPadOS.
- The patches address 28 vulnerabilities, including issues that could lead to arbitrary code execution, kernel memory access, denial of service, and sensitive data leakage.
- Affected components include ImageIO, IOGPUFamily, Kernel, Audio, Telephony, WebKit, WebKit History, and WebKit Storage.
- Users are strongly advised to update their devices immediately to macOS Tahoe 26.6.2, iOS 26.6.1, iPadOS 26.6.1, iOS 18.7.10, or iPadOS 18.7.10.
Apple Addresses 28 Vulnerabilities Across Core Operating Systems
Apple has deployed a series of urgent security updates for its macOS, iOS, and iPadOS platforms. The patches, released on August 17, 2026, collectively resolve 28 distinct vulnerabilities that, if exploited, could enable scenarios ranging from data exposure and application crashes to unauthorized kernel memory access and arbitrary code execution.
Table Of Content
The latest updates include macOS Tahoe 26.6.2, iOS 26.6.1, iPadOS 26.6.1, along with specific updates for older devices: iOS 18.7.10 and iPadOS 18.7.10. Apple indicated that these releases incorporate fixes previously rolled out in beta versions of its operating systems.
Consistent with its established security protocols, Apple typically refrains from disclosing comprehensive technical specifics about security flaws until investigations are finalized and the corresponding security updates are widely accessible to users.
Critical Flaws in Media, Web, and Graphics Components
A significant portion of the addressed vulnerabilities impacts components responsible for processing media, web content, and graphics. Among these, an integer overflow (CVE-2026-65346) in ImageIO could permit attackers to execute arbitrary code by processing a specially crafted image. Another ImageIO defect (CVE-2026-65347) was found to potentially trigger a denial-of-service condition when a vulnerable device processes a malicious image.
The updates also target multiple vulnerabilities within IOGPUFamily, Apple’s proprietary graphics framework. The company explicitly warned that maliciously constructed web content could induce memory corruption (CVE-2026-64788) through this component. Other IOGPUFamily flaws (CVE-2026-65343, CVE-2026-65349, CVE-2026-65330) presented risks such as unexpected system termination by remote attackers or unauthorized kernel memory reads by local applications. Such kernel-level vulnerabilities are particularly severe given the kernel’s elevated privileges and its central role in managing core operating system functions.
For older iOS 18.7.10 and iPadOS 18.7.10 releases, a critical kernel buffer overflow issue was rectified. Identified as CVE-2026-65330, this flaw could allow a malicious application to execute arbitrary code with kernel privileges. Apple mitigated this by implementing enhanced size validation.
An Audio logic issue (CVE-2026-65339) was also patched, which could allow an application to leak sensitive user information. This vulnerability affected both macOS Tahoe 26.6.2 and the newer iOS and iPadOS releases, and was resolved through improved checks.
Mobile devices running iOS 18.7.10 and iPadOS 18.7.10 received an Accessibility fix. Apple noted that an attacker with physical access could potentially gain access to sensitive data during iPhone Mirroring, a feature that links an iPhone to a Mac. This issue was resolved through improved state management.
| CVE | Component | Affected release(s) | Impact | Vulnerability type / remediation |
|---|---|---|---|---|
| CVE-2026-65339 | Audio | iOS/iPadOS 26.6.1; macOS Tahoe 26.6.2 | An app may leak sensitive user information | Logic issue; improved checks |
| CVE-2026-65347 | ImageIO | iOS/iPadOS; macOS | Processing an image may cause DoS | Improved checks |
| CVE-2026-65346 | ImageIO | iOS/iPadOS; macOS | Processing an image may enable arbitrary code execution | Integer overflow; improved input validation |
| CVE-2026-64788 | IOGPUFamily | iOS/iPadOS; macOS | Crafted web content may cause memory corruption | Improved memory handling |
| CVE-2026-65343 | Kernel | iOS/iPadOS; macOS | Remote attacker may terminate the system | Use-after-free; improved memory management |
| CVE-2026-65349 | Kernel | iOS/iPadOS; macOS | App may terminate the system or read kernel memory | Out-of-bounds read; improved input validation |
| CVE-2026-65330 | Kernel | iOS/iPadOS; macOS | App may terminate the system or corrupt kernel memory | Improved memory handling |
| CVE-2026-65329 | Telephony | iOS 26.6.1 only; iPhone 11 and later | Privileged network attacker may bypass IPSec authentication and intercept traffic | Authentication issue; improved state management |
| CVE-2026-64784 | WebKit | iOS/iPadOS; macOS | Crafted web content may crash Safari | Out-of-bounds access; improved bounds checking |
| CVE-2026-43795 | WebKit | iOS/iPadOS; macOS | Crafted web content may crash Safari | Improved memory handling |
| CVE-2026-65338 | WebKit | iOS/iPadOS; macOS | Crafted web content may crash Safari | Improved memory handling |
| CVE-2026-65341 | WebKit | iOS/iPadOS; macOS | Crafted web content may cause memory corruption | Improved memory handling |
| CVE-2026-64782 | WebKit | iOS/iPadOS; macOS | Crafted web content may crash Safari | Memory-corruption flaw; improved locking |
| CVE-2026-64781 | WebKit | iOS/iPadOS; macOS | Crafted web content may crash Safari | Improved input validation |
| CVE-2026-65351 | WebKit | iOS/iPadOS; macOS | Crafted web content may crash Safari | Improved state management |
| CVE-2026-65340 | WebKit | iOS/iPadOS; macOS | Crafted web content may crash Safari | Improved state management |
| CVE-2026-65337 | WebKit | iOS/iPadOS; macOS | Crafted web content may crash Safari | Improved state management |
| CVE-2026-65336 | WebKit | iOS/iPadOS; macOS |
No Comment! Be the first one.