VYPR
Published Aug 17, 2026· Updated Aug 18, 2026· 1 source

Apple iOS: 25 Vulnerabilities Patched in Same-Day Disclosure Batch

Key findings • Apple patched 25 vulnerabilities in iOS and iPadOS on August 17, 2026, affecting system stability and memory integrity. • Multiple WebKit vulnerabilities were addressed, includ…

Key findings

  • Apple patched 25 vulnerabilities in iOS and iPadOS on August 17, 2026, affecting system stability and memory integrity.
  • Multiple WebKit vulnerabilities were addressed, including memory corruption, use-after-free, and out-of-bounds read issues.
  • Vulnerabilities could lead to arbitrary code execution, system termination, sensitive data leakage, and network traffic interception.
  • The disclosed vulnerabilities had not been exploited in the wild prior to their patching, according to SANS ISC.
  • Affected versions include iOS 26.6.1 and iPadOS 26.6.1, with some fixes also in iOS 18.7.10 and iPadOS 18.7.10.

Apple Inc. released a significant security update on August 17, 2026, addressing a batch of 25 vulnerabilities across iOS and iPadOS. The vulnerabilities, disclosed on the same day, span various components and impact system stability, memory integrity, and potentially allow for arbitrary code execution and sensitive data leakage. The affected versions include iOS 26.6.1 and iPadOS 26.6.1, with some CVEs also patched in iOS 18.7.10 and iPadOS 18.7.10, and macOS Tahoe 26.6.2.

Several vulnerabilities stem from issues within WebKit, Apple's browser engine. These include memory corruption vulnerabilities (CVE-2026-65331, CVE-2026-65333, CVE-2026-65334, CVE-2026-65335, CVE-2026-65336, CVE-2026-65337, CVE-2026-65338, CVE-2026-65339, CVE-2026-65340, CVE-2026-65341, CVE-2026-64779, CVE-2026-64781, CVE-2026-64782, CVE-2026-64784, CVE-2026-64788), use-after-free issues (CVE-2026-65343, CVE-2026-64787), and out-of-bounds read vulnerabilities (CVE-2026-65349). Processing maliciously crafted web content or images could lead to unexpected crashes, system termination, or memory corruption.

Other vulnerabilities include an integer overflow (CVE-2026-65346) that could lead to arbitrary code execution, an out-of-bounds read that could allow an app to read kernel memory (CVE-2026-65349), and a logic issue that could enable sensitive user information leakage (CVE-2026-65339). Additionally, an authentication bypass vulnerability (CVE-2026-65329) in IPSec could allow an attacker to intercept network traffic. A denial-of-service vulnerability (CVE-2026-65347) was also addressed.

The SANS Internet Storm Center noted that while Apple released updates for iOS, iPadOS, and macOS, fixing a total of 108 vulnerabilities, none of the disclosed vulnerabilities had been exploited in the wild prior to their release. The majority of the patched vulnerabilities affected iOS 18 specifically.

The fixes were implemented through improved input validation, memory management, state management, bounds checking, and other security enhancements. Users are strongly advised to update their devices to the latest available versions to mitigate these risks. The comprehensive nature of this batch highlights the importance of timely patching for maintaining the security and integrity of Apple's operating systems.

The batch includes the following CVEs: CVE-2026-65349, CVE-2026-65347, CVE-2026-65346, CVE-2026-65343, CVE-2026-65341, CVE-2026-65340, CVE-2026-65339, CVE-2026-65338, CVE-2026-65337, CVE-2026-65336, CVE-2026-65335, CVE-2026-65334, CVE-2026-65333, CVE-2026-65332, CVE-2026-65331, CVE-2026-65330, CVE-2026-65329, CVE-2026-64788, CVE-2026-64787, CVE-2026-64784, CVE-2026-64782, CVE-2026-64781, CVE-2026-64780, CVE-2026-64779, CVE-2026-64778.

Synthesized by Vypr AI