NCSC-NL lists 150+ Apple iOS/iPadOS flaws patched
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
Apple fixed well over a hundred iOS/iPadOS vulnerabilities including several rated 8.8, covering memory corruption, sandbox escape and auth bypass issues; no active exploitation reported.
The Dutch National Cyber Security Centre (NCSC-NL) published a consolidated advisory covering a large batch of vulnerabilities fixed in Apple iOS and iPadOS. The flaws span a wide range of weakness classes — out-of-bounds read/write, use-after-free, integer overflow, type confusion, race conditions, improper authorization checks, and insufficient symbolic-link validation — affecting components involved in parsing images, video, audio, fonts and PDF files, as well as web content rendering and system services such as Keychain, Bluetooth, and Thread networking.
Exploitation vectors described include delivery of specially crafted files, network traffic, or web content, as well as scenarios requiring local device access. Depending on the specific flaw, successful exploitation could result in unauthorized access to sensitive user data, memory corruption, application or system crashes, privilege escalation, sandbox escapes, or denial of service. The advisory does not indicate that any of these vulnerabilities have been exploited in the wild, nor does it provide proof-of-concept details.
Several of the listed CVEs carry high CVSS v3 base scores of 8.8, indicating potential for significant impact (e.g. remote code execution or privilege escalation) if chained with other access. One included CVE (CVE-2019-5598) is a much older issue, suggesting re-inclusion or a backport fix. Defenders should prioritize deploying the latest iOS/iPadOS updates across managed fleets, particularly for devices handling untrusted media, documents, or web content, and treat this as a routine but broad patch cycle rather than an active incident.
Mentioned in this report
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0456.html
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 14,286 reports from 144 sources, 610 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs