|
Reference:
CVE-2026-84571
|
Out-of-bounds write in asset catalog compression type 6 decoding
CoreUI
|
State: Fixed
iOS / macOS 27
|
|
Reference:
CVE-2026-84546
|
Out-of-bounds read in tangent generation
Quick Look / SceneKit
|
State: Fixed
iOS / macOS 27
|
|
Reference:
CVE-2026-84532
|
Out-of-bounds read in USD skeletal skinning joint-index remapping
CoreRealityIO
|
State: Fixed
iOS / macOS 27
|
|
Reference:
CVE-2026-84526
|
Out-of-bounds write in compressed SCNSkinner archive decoding
SceneKit
|
State: Fixed
iOS / macOS 27
|
|
Reference:
CVE-2026-84511
|
Out-of-bounds write in type 2 compressed AppIcon image decoding
CoreUI
|
State: Fixed
iOS / macOS 27
|
|
Reference:
CVE-2026-84489
|
Out-of-bounds write in app icon asset catalog ATE image decoding
CoreUI
|
State: Fixed
iOS / macOS 27
|
|
Reference:
CVE-2026-84487
|
Out-of-bounds read in ASTC texture payload loading
SceneKit
|
State: Fixed
iOS / macOS 27
|
|
Reference:
CVE-2026-28966
|
Out-of-bounds write in USD subdivision crease parsing
CoreRealityIO
|
State: Fixed
iOS / macOS 27
|
|
Reference:
-
|
Out-of-bounds write in legacy vCalendar parameter parsing
Calendar
|
State: Fixed
iOS / macOS 27
|
|
Reference:
-
|
Out-of-bounds write from an unchecked NAN Data Cluster record index
AppleBCMWLAN DriverKit
|
State: Fixed
iOS / macOS 27
|
|
Reference:
CVE-2026-64772
|
Out-of-bounds write in glTF JOINTS accessor import
ModelIO / libusd_ms
|
State: Fixed
iOS / macOS 26.6
|
|
Reference:
CVE-2026-64763
|
Out-of-bounds write in variable-topology geometry deformer source expansion
SceneKit
|
State: Fixed
iOS / macOS 26.6
|
|
Reference:
CVE-2026-64765
|
Out-of-bounds write in keyframe animation accessor deserialization
SceneKit
|
State: Fixed
iOS / macOS 26.6
|
|
Reference:
CVE-2026-64764
|
Out-of-bounds read in compressed SCNMorpher AnimCodec adjacency parsing
SceneKit
|
State: Fixed
iOS / macOS 26.6
|
|
Reference:
CVE-2026-64766
|
Out-of-bounds write in SCNParticleSystem stream allocation
Quick Look / SceneKit
|
State: Fixed
iOS / macOS 26.6
|
|
Reference:
CVE-2026-64770
|
Out-of-bounds write in USD Skel blend-shape point-index handling
libusd_ms
|
State: Fixed
iOS / macOS 26.6
|
|
Reference:
CVE-2026-64768
|
Out-of-bounds read in PointInstancer protoIndices rendering
libusd_ms
|
State: Fixed
iOS / macOS 26.6
|
|
Reference:
CVE-2026-64769
|
Out-of-bounds read in GeomSubset face-index parsing
libusd_ms
|
State: Fixed
iOS / macOS 26.6
|
|
Reference:
CVE-2026-64774
|
Out-of-bounds write in USD NURBS patch topology construction
libusd_ms
|
State: Fixed
iOS / macOS 26.6
|
|
Reference:
CVE-2026-43726
|
Use-after-free in WebKit
WebKit · Bug 313857
|
State: Fixed
iOS 26.5.2
|
|
Reference:
CVE-2026-43663
|
Memory handling issue in WebKit
WebKit · Bug 312781
|
State: Fixed
iOS 26.5.2
|
|
Reference:
CVE-2026-43707
|
Memory corruption in WebKit
WebKit · Bug 315951
|
State: Fixed
iOS 26.5.2
|