SB2026021195 - Multiple vulnerabilities in Apple iOS 18 and iPadOS 18
Published: February 11, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 36 secuirty vulnerabilities.
1) Buffer overflow (CVE-ID: CVE-2026-20608)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a boundary error in WebKit when processing HTML content. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
2) State issues (CVE-ID: CVE-2026-20678)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a state management issue in Sandbox Profiles. A local application can access sensitive user data.
3) State Issues (CVE-ID: CVE-2026-20682)
The vulnerability allows a local application to gain access to sensitive information.
the vulnerability exists due to a state issue in Screenshots. A local application can discover deleted notes.
4) Improper limitation of a pathname to a restricted directory ('path traversal') (CVE-ID: CVE-2026-20653)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to incorrect handling of path names in Shortcuts. A local application can trick the victim into opening a specially crafted file and access sensitive user data.
5) Information disclosure (CVE-ID: CVE-2026-20680)
The vulnerability allows a local application to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output in Spotlight. A local application can access sensitive user data.
6) Information disclosure (CVE-ID: CVE-2026-20641)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to excessive data output by StoreKit. A local application can identify what other apps a user has installed.
7) Protection Mechanism Failure (CVE-ID: CVE-2026-20606)
The vulnerability allows a local application to bypass privacy preferences.
The vulnerability exists due to insufficient implementation of security measures in UIKit. A local application can bypass certain Privacy preferences.
8) Memory corruption (CVE-ID: CVE-2026-20605)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in Voice Control. A local application can crash a system process.
9) State issues (CVE-ID: CVE-2026-20661)
The vulnerability allows an attacker with physical access to the system to gain access to sensitive information.
The vulnerability exists due to a state management issue in VoiceOver. An attacker with physical access to the system can view sensitive user information.
10) Buffer overflow (CVE-ID: CVE-2026-20652)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a boundary error in WebKit when processing HTML content. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
11) Improper input validation (CVE-ID: CVE-2026-20656)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to insufficient input validation in Safari. A local application can access a user\'s Safari history.
12) Buffer overflow (CVE-ID: CVE-2026-20644)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a boundary error in WebKit when processing HTML content. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
13) Buffer overflow (CVE-ID: CVE-2026-20635)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a boundary error in WebKit when processing HTML content. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
14) Memory corruption (CVE-ID: CVE-2026-20621)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error in Wi-Fi. A local application can cause unexpected system termination or corrupt kernel memory.
15) Permissions, privileges, and access controls (CVE-ID: CVE-2026-20628)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to improperly imposed security restrictions in Sandbox. A local application can break out of its sandbox.
16) Buffer overflow (CVE-ID: CVE-2025-46305)
The vulnerability allows an attacker to perform a denial of service attack.
The vulnerability exists due to a boundary error in Multi-Touch. An attacker with physical access to device can attach a malicious HID device to the system, trigger memory corruption and perform a denial of service attack.
17) State issues (CVE-ID: CVE-2026-20645)
The vulnerability allows an attacker with physical access to the system to gain access to sensitive information.
The vulnerability exists due to a state management issue in Accessibility. An attacker with physical access to the system can view sensitive user information.
18) Resource exhaustion (CVE-ID: CVE-2025-59375)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger large dynamic memory allocations via a small document and perform a denial of service (DoS) attack.
19) Improper limitation of a pathname to a restricted directory ('path traversal') (CVE-ID: CVE-2026-20660)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to incorrect handling of path names in CFNetwork. A local user can trick the victim into opening a specially crafted file and write arbitrary files.
20) Memory corruption (CVE-ID: CVE-2026-20611)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error in CoreAudio. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination or corrupt process memory.
21) Memory corruption (CVE-ID: CVE-2026-20609)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in CoreMedia. A remote attacker can trick the victim into opening a specially crafted file and perform a denial-of-service or potentially disclose memory contents.
22) Memory corruption (CVE-ID: CVE-2026-20634)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a boundary error in ImageIO. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.
23) Memory corruption (CVE-ID: CVE-2026-20675)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to a boundary error in ImageIO. A local user can trick the victim into opening a specially crafted file and perform disclosure of user information.
24) Man-in-the-Middle (MitM) attack (CVE-ID: CVE-2026-20671)
The vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists due to a logic issue in the OS kernel. A remote attacker on the local network can intercept network traffic.
25) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-20663)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to LaunchServices writes information about installed apps into log files. A local application can enumerate a user's installed apps.
26) State issues (CVE-ID: CVE-2026-20655)
The vulnerability allows an attacker with physical access to the system to gain access to sensitive information.
The vulnerability exists due to a state management issue in Live Captions. An attacker with physical access to the system can view sensitive user information.
27) Buffer overflow (CVE-ID: CVE-2025-46304)
The vulnerability allows an attacker to perform a denial of service attack.
The vulnerability exists due to a boundary error in Multi-Touch. An attacker with physical access to device can attach a malicious HID device to the system, trigger memory corruption and perform a denial of service attack.
28) Protection Mechanism Failure (CVE-ID: CVE-2026-20673)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient implementation of security measures in Mail. Turning off the "Load remote content in messages" may not apply to all mail previews, leading to information exposure.
29) Race condition (CVE-ID: CVE-2026-20677)
The vulnerability allows a local user to bypass implemented security restrictions.
The vulnerability exists due to a race condition in Messages when handling symbolic links in shortcuts. A local user can bypass sandbox restrictions.
30) Out-of-bounds write (CVE-ID: CVE-2026-20616)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to an out-of-bounds write in Model I/O. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.
31) Buffer overflow (CVE-ID: CVE-2025-43533)
The vulnerability allows an attacker to perform a denial of service attack.
The vulnerability exists due to a boundary error in Multi-Touch. An attacker with physical access to device can attach a malicious HID device to the system, trigger memory corruption and perform a denial of service attack.
32) Buffer overflow (CVE-ID: CVE-2025-46300)
The vulnerability allows an attacker to perform a denial of service attack.
The vulnerability exists due to a boundary error in Multi-Touch. An attacker with physical access to device can attach a malicious HID device to the system, trigger memory corruption and perform a denial of service attack.
33) Buffer overflow (CVE-ID: CVE-2025-46301)
The vulnerability allows an attacker to perform a denial of service attack.
The vulnerability exists due to a boundary error in Multi-Touch. An attacker with physical access to device can attach a malicious HID device to the system, trigger memory corruption and perform a denial of service attack.
34) Buffer overflow (CVE-ID: CVE-2025-46302)
The vulnerability allows an attacker to perform a denial of service attack.
The vulnerability exists due to a boundary error in Multi-Touch. An attacker with physical access to device can attach a malicious HID device to the system, trigger memory corruption and perform a denial of service attack.
35) Buffer overflow (CVE-ID: CVE-2025-46303)
The vulnerability allows an attacker to perform a denial of service attack.
The vulnerability exists due to a boundary error in Multi-Touch. An attacker with physical access to device can attach a malicious HID device to the system, trigger memory corruption and perform a denial of service attack.
36) Input validation error (CVE-ID: CVE-2025-43537)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to insufficient path validation in Books. A remote attacker can trick the victim into restoring a specially crafted backup and overwrite protected system files.
Remediation
Install update from vendor's website.