APPLE-SA-08-17-2026-1 iOS 26.6.1 and iPadOS 26.6.1

[Apple Product Security via Fulldisclosure <fulldisclosure () seclists org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

APPLE-SA-08-17-2026-1 iOS 26.6.1 and iPadOS 26.6.1

iOS 26.6.1 and iPadOS 26.6.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/148282.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Audio
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to leak sensitive user information
Description: A logic issue was addressed with improved checks.
CVE-2026-65339: Meta Red Team X - Nik Tsytsarkin

ImageIO
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing an image may lead to a denial-of-service
Description: The issue was addressed with improved checks.
CVE-2026-65347: Geonha Lee (@leegn4a)

ImageIO
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing an image may lead to arbitrary code execution
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-65346: Meta Red Team X - Nik Tsytsarkin

IOGPUFamily
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing maliciously crafted web content may lead to memory
corruption
Description: The issue was addressed with improved memory handling.
CVE-2026-64788: f00l (@PPPF00L) and 3ndy1(@_3ndy1) and Minghao
Lin@Y1nkoc and 云散花折, Arjanit Isufi

Kernel
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: A remote attacker may be able to cause unexpected system
termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-65343: Drinor Selmanaj (Sentry), Surya Narayan Kushwaha

Kernel
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to cause unexpected system termination or
read kernel memory
Description: An out-of-bounds read was addressed with improved input
validation.
CVE-2026-65349: an anonymous researcher

Kernel
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-65330: Bhaswanth Chigurupati, Billy Jheng Bing Jhong and Pan
Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.

Telephony
Available for: iPhone 11 and later
Impact: An attacker in a privileged network position may be able to
bypass IPSec authentication and intercept network traffic
Description: An authentication issue was addressed with improved state
management.
CVE-2026-65329: Bedran Karakoc, Tobias Funke, Jacopo Clark, Katharina
Kohls of Ruhr University Bochum

WebKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing maliciously crafted web content may lead to an
unexpected Safari crash
Description: An out-of-bounds access issue was addressed with improved
bounds checking.
WebKit Bugzilla: 317632
CVE-2026-64784: Janggoon Lee of Out of Bounds, OpenAI Codex Security -
Amy Burnett

WebKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing maliciously crafted web content may lead to an
unexpected Safari crash
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 313452
CVE-2026-43795: wwwlk
WebKit Bugzilla: 318348
CVE-2026-65338: OpenAI Codex Security - Amy Burnett

WebKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing maliciously crafted web content may lead to memory
corruption
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 318405
CVE-2026-65341: Henock Habte

WebKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing maliciously crafted web content may lead to an
unexpected Safari crash
Description: A memory corruption vulnerability was addressed with
improved locking.
WebKit Bugzilla: 321480
CVE-2026-64782: Seonwook Kim, Shubham Chaskar, lattice, Josef Korbel

WebKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing maliciously crafted web content may lead to an
unexpected Safari crash
Description: The issue was addressed with improved input validation.
WebKit Bugzilla: 321484
CVE-2026-64781: Thomas Guillem

WebKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing maliciously crafted web content may lead to an
unexpected Safari crash
Description: This issue was addressed through improved state management.
WebKit Bugzilla: 321517
CVE-2026-65351: Niels Hofmans
WebKit Bugzilla: 316996
CVE-2026-65340: Claudio Bozzato and Francesco Benvenuto of Cisco Talos,
Josef Korbel (Citadelo)
WebKit Bugzilla: 317142
CVE-2026-65337: OpenAI Codex Security - Amy Burnett
WebKit Bugzilla: 317349
CVE-2026-65336: Josef Korbel
WebKit Bugzilla: 316723
CVE-2026-65335: OpenAI Codex Security - Amy Burnett
WebKit Bugzilla: 317603
CVE-2026-65333: OpenAI Codex Security - Amy Burnett
WebKit Bugzilla: 317450
CVE-2026-65332: OpenAI Codex Security - Amy Burnett
WebKit Bugzilla: 317611
CVE-2026-65331: OpenAI Codex Security - Amy Burnett

WebKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing maliciously crafted web content may lead to an
unexpected process crash
Description: A use-after-free issue was addressed with improved memory
management.
WebKit Bugzilla: 316347
CVE-2026-64715: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative

WebKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing maliciously crafted web content may lead to an
unexpected Safari crash
Description: The issue was addressed with improved checks.
WebKit Bugzilla: 316918
CVE-2026-64780: OpenAI Codex Security - Amy Burnett

WebKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing maliciously crafted web content may lead to an
unexpected Safari crash
Description: A memory corruption issue was addressed with improved state
management.
WebKit Bugzilla: 316791
CVE-2026-65334: OpenAI Codex Security - Amy Burnett

WebKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing maliciously crafted web content may lead to memory
corruption
Description: A memory corruption issue was addressed with improved
memory handling.
WebKit Bugzilla: 317317
CVE-2026-43794: Dung Do (@_piers2) of Calif.io

WebKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing maliciously crafted web content may lead to an
unexpected process termination
Description: A use-after-free issue was addressed with improved memory
management.
WebKit Bugzilla: 313703
CVE-2026-64787: 杉山 壮太, Shubham Chaskar

WebKit History
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Visiting a maliciously crafted website may leak sensitive data
Description: The issue was addressed with improved checks.
WebKit Bugzilla: 315528
CVE-2026-64778: Mohit Negi

WebKit Storage
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing maliciously crafted web content may lead to an
unexpected Safari crash
Description: A memory corruption vulnerability was addressed with
improved locking.
WebKit Bugzilla: 321485
CVE-2026-64779: Shubham Chaskar, Tommy DeVoss from Braze Security Team
(@thedawgyg)

Additional recognition

Compression
We would like to acknowledge Tommy DeVoss from Braze Security Team
(@thedawgyg) for their assistance.

libcryptex
We would like to acknowledge Ashish Kunwar for their assistance.

WebKit
We would like to acknowledge Henock Habte for their assistance.

This update is available through iTunes and Software Update on your iOS
device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes from
https://www.apple.com/itunes/

iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is presented
to the user when the iOS device is docked. We recommend applying the
update immediately if possible. Selecting Don't Install will present the
option the next time you connect your iOS device.

The automatic update process may take up to a week depending on the day
that iTunes or the device checks for updates. You may manually obtain
the update via the Check for Updates button within iTunes, or the
Software Update on your device.

To check that the iPhone, iPod touch, or iPad has been updated:

* Navigate to Settings * Select General * Select About. The version
after applying this update will be "iOS 26.6.1 and iPadOS 26.6.1".

All information is also posted on the Apple Security Releases
web site: https://support.apple.com/100100.

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmqDg4gACgkQ4Ifiq8DH
7PXPCQ/+M71nd43RWnlc1jxxejtb+yYyqHuzsW4eQb5hEuH7nRbNVFmi9jkMMBdl
oD/KChEUnlZ3UPUZYLJMsVm2dDEHNm1Y9rEWJjXDvyTgaXPzBqPKyadl2Q/gRVf8
dUnTDaOD4ZATIFMMqMV7qKOFzJaU/5baXU6qHvltiXAescg8uiGOOkXqT8ocWWaw
NoY7IySEcJAytib+K/iEZki4Fn+9/epLiZ/PUTXKgNBy9Rk7q1rNxmAKYqp1eEq3
ohStlF2Hvll4kCoer9JBz0mEwkwKcx6TPYp9ad8o6DCVOfQ+6YDEiK/G4sK6JzXk
i0a9YtVAdFTBrM+L7uifpqz4NbMiij+7kXan/xJHIyzA4dDDUfZ9nKtGYhsCqPww
6YwuyMPqjFZgLpeT/eMZt6r0y1NRiEP1xXvqAgVvGz4+GsO8+ZKXQWghUPiMxvJ9
+IvknaYMSauHmz4n9g8ARvhMKEgthaZQtAVvVwos5RjQfnzR198vvB+Ga9cLA8c0
q1Qjui8brdXvtk0My/xbIMj5QDnn6sst/+fv9h9GMZXNGrQtFAL+AyjE1BEzzk44
tdwNsvcxSkfT+lujqGXWdbnyMdErTHCFFF8bx85N2KnzDnGKgVhpbHXSVKQwygOc
cpd5eC0KW8qVrsLLMdXFkwMokc3pT9EZZ18xenAzHN7vqCIIYAk=
=hc7b
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/