Apple patches 140+ iOS/iPadOS vulnerabilities

NCSC-NL flags an Apple security update fixing over 140 iOS/iPadOS vulnerabilities, including a critical CVE-2026-65414 (CVSS 9.8); no in-the-wild exploitation reported.

The Dutch National Cyber Security Centre (NCSC-NL) published an advisory summarizing Apple's latest security update for iOS and iPadOS, which addresses a very large batch of vulnerabilities (well over 140 CVEs) spanning path traversal, cross-site scripting, stack-based buffer overflow, out-of-bounds read/write, race conditions, use-after-free, improper resource shutdown, external control of critical state data, and missing authorization issues. These flaws sit across core OS components including file handling, memory management, authentication processes, and web content rendering.

According to the advisory, successful exploitation could let an attacker gain unauthorized access to user data, cause application or system crashes, read or corrupt kernel memory, escalate privileges, bypass sandbox restrictions, or manipulate network traffic. Some issues could expose sensitive information such as Wi-Fi passwords, device identifiers, and user location data. The most severe entry, CVE-2026-65414, carries a CVSS v3 score of 9.8, with several others (CVE-2026-43686, CVE-2026-43715, CVE-2026-65415) rated 8.1–8.8. NCSC-NL does not indicate any of these vulnerabilities are being actively exploited in the wild; this is a routine, if unusually large, vendor patch release. Apple has issued fixes via improved validation, stricter access controls, better memory/state management, and removal of vulnerable code paths. Defenders should prioritize deployment of the latest iOS/iPadOS updates across managed fleets, particularly for the highest-CVSS entries, and track for any subsequent in-the-wild exploitation reporting.

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0370.html