iOS/iPadOS 18.7.9 Security Update: Multiple CVEs in Accounts, Kernel, Networking

iOS 18.7.9 and iPadOS 18.7.9 Security Content Summary Vulnerability Overview Apple has released security updates for iOS 18.7.9 and iPadOS 18.7.9, addressing multiple security vulnerabilities. These vulnerabilities affect various system components, including Accounts, APFS, App Intents, Audio, Calendar, Calling Framework, CoreServices, FileProvider, GeoServices, ImageIO, IOHIDFamily, IOKit, Kernel, LaunchServices, libxpc, Mail Drafts, mDNSResponder, Model I/O, and Networking. Affected Devices Affected Devices: iPhone XS, iPhone XS Max, iPhone XR, iPad (7th generation) Vulnerability Types: - Unauthorized access to sensitive user data - Unexpected system termination - Sandbox escape - Memory handling issues - Resource exhaustion - Denial of service (DoS) - Buffer overflow - Integer overflow - Race conditions - Information disclosure - Privilege escalation - Kernel memory leak - Malicious file handling - Exploitation by remote attackers Remediation Update System: Users should update to iOS 18.7.9 and iPadOS 18.7.9 as soon as possible to mitigate these vulnerabilities. Specific Fixes: - Improved state management - Enhanced boundary checks - Added input validation - Improved memory handling - Strengthened data renaming mechanisms - Enhanced permission management - Added additional verification steps Vulnerability Details Accounts: CVE-2026-28877, Unauthorized access to sensitive user data APFS: CVE-2026-28959, Unexpected system termination App Intents: CVE-2026-28995, Sandbox escape Audio: CVE-2026-39869, Memory handling issues Calendar: CVE-2026-28872, Resource exhaustion Calling Framework: CVE-2026-28894, Denial of service (DoS) CoreServices: CVE-2026-28936, Unexpected system termination FileProvider: CVE-2026-43659, Unauthorized access to sensitive user data GeoServices: CVE-2026-28870, Information disclosure ImageIO: CVE-2026-28977, Unexpected system termination IOHIDFamily: CVE-2026-28992, Unexpected system termination IOKit: CVE-2026-28969, Unexpected system termination Kernel: Multiple CVEs, including kernel memory leaks, privilege escalation, and malicious file handling LaunchServices: CVE-2026-28983, Denial of service (DoS) libxpc: CVE-2026-28882, Enumeration of installed user applications Mail Drafts: CVE-2026-28929, Remote image display mDNSResponder: Multiple CVEs, including denial of service (DoS) and memory handling issues Model I/O: CVE-2026-28940, Process memory corruption Networking: CVE-2026-28906, IP address tracking POC Code or Exploitation Code No specific POC (Proof of Concept) code or exploitation code is included in this page.

Goal Reached Thanks to every supporter — we hit 100%!

iOS/iPadOS 18.7.9 Security Update: Multiple CVEs in Accounts, Kernel, Networking