Latest vulnerabilities for "apple webkit"

oss-sec[Advisory] WebKit/iOS 26.2: Gigacage Boundary Violation via Logic Flaw enabling OOB Access

[CVE Pending] WebKit JSC Integer Overflow – OOB Write via Gigacage (iOS 26.2) --------------------------------------------------------------------Full advisory, PoC, and logs: [https://github.com/JGoyd/0day-GigaCage-Webkit] -------------------------------------------------------------------- 1. Executive Summary

A critical vulnerability exists in the WebKit JavaScriptCore (JSC) engine. Integer overflow in memory offset calculations for ArrayBuffer, TypedArray, and WebAssembly enables out-of-bounds (OOB) memory access. Gigacage currently mitigates this via process termination, but the underlying logic flaw could be used for remote code execution if combined with a mitigation bypass.

-------------------------------------------------------------------- 2. Environment Details

OS: iOS 26.2 (Build 23C55) WebKit: 8623.1.14.10.9 Crash: EXCGUARD (Namespace 31: Gigacage Primitive Partition) Offset: 0xADD7476C Device: iPhone 15,3 (iPhone 14 Pro Max) UUID: af25fa78-ae3e-3bf4-b320-4404d3a36a77

-------------------------------------------------------------------- 3. Technical Analysis (CWE-190)

Vulnerability occurs during offset calculation for TypedArray and DataView. If 'index elementSize' wraps at the 32-bit boundary, the overflowed value can pass initial bounds checks. When added to the Gigacage base pointer, this can exceed the 16GB boundary, triggering a guard violation.

The flaw is also reachable via the WebAssembly JIT, which may elide bounds checks; wraparound in 32-bit arithmetic permits unsanitized JITed memory access.

-------------------------------------------------------------------- 4. Proof of Concept (PoC)

JavaScript (DataView vector):

const buffer = new ArrayBuffer(1024); const view = new DataView(buffer); // 0xFFFFFFFE + 4 wraps at 32-bits view.setUint32(0xFFFFFFFE, 0x41414141);

WebAssembly (JIT vector):

;; (i32.add (i32.const 0xFFFFFFFF) (i32.const 0x5)) wraps to 0x4 (i32.load offset=0)

Reproduction Steps:

1. Host PoC HTML on HTTPS server. 2. Access with Mobile Safari on iOS 26.2. 3. Observe termination of WebContent process. 4. Confirm offset 0xADD7476C in crash log.

-------------------------------------------------------------------- 5. Remediation

Implement checked arithmetic in the following components:

- Source/JavaScriptCore/runtime/JSArrayBufferView.cpp - Source/JavaScriptCore/runtime/JSDataView.cpp

Proposed fix:

sizet byteOffset; if (builtinmuloverflow(staticcast<sizet>(index), melementSize, &byteOffset)) { return throwOverflowError(); }

-------------------------------------------------------------------- 6. Supporting Evidence

Consistent crash offset and namespace 31 violation found in:

ExcUserFaultMobileSafari-2025-12-25-131432.ips ExcUserFaultSafariViewService-2025-12-25-062945.ips

-------------------------------------------------------------------- 7. Disclosure

Apple Security is being notified at the same time as this public mailing list post, as they are CC'd on this email. This is not a coordinated disclosure; notification to Apple and the broadercommunity is occurring simultaneously. -------------------------------------------------------------------- 8. Legal Disclaimer

Provided for authorized security research only. Unauthorized use is prohibited and may be unlawful.

--------------------------------------------------------------------

Thank you, Joseph Goydish II

First published (updated )

https://seclists.org/oss-sec/2025/q4/292

The RegisterApple, Google forced to issue emergency 0-day patches

Exploited

Zeroday

First published (updated )

News

The Register

Fortinet FortiOSDouble free in cache management

Risk 90

Severity

8.8

Zeroday

Double Free

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C

A double free in Fortinet FortiOS versions 7.0.0 through 7.0.5, FortiPAM version 1.0.0 through 1.0.3, 1.1.0 through 1.1.1 allows attacker to execute unauthorized code or commands via specifically crafted request.

1 / 2

Remedy

Please upgrade to FortiOS version 7.2.0 or above Please upgrade to FortiOS version 7.0.6 or above Please upgrade to FortiOS version 6.4.15 or above Please upgrade to FortiPAM version 1.2.0 or above Please upgrade to FortiPAM version 1.1.2 or above

First published (updated )

CVE-2023-41678

Qualcomm Multiple ChipsetsUse After Free in DSP Services

Risk 91

Severity

7.8

Exploited

Zeroday

Use After Free

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption in DSP Services during a remote call from HLOS to DSP.

1 / 2

First published (updated )

CVE-2023-33063

Qualcomm Multiple ChipsetsUse of Out-of-range Pointer Offset in Graphics

Risk 94

Severity

8.4

Exploited

Zeroday

Buffer Overflow

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption while submitting a large list of sync points in an AUX command to the IOCTLKGSLGPUAUXCOMMAND.

1 / 2

First published (updated )

CVE-2023-33106

Qualcomm Multiple ChipsetsInteger Overflow or Wraparound in Graphics Linux

Risk 94

Severity

8.4

Exploited

Zeroday

Integer Overflow

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.

1 / 2

First published (updated )

CVE-2023-33107

ThinuTech Thinu-cmsThinuTech ThinuCMS author_posts.php cross site scripting

Risk 55

Severity

6.1

Zeroday

XSS

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A vulnerability has been found in ThinuTech ThinuCMS 1.5 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /authorposts.php. The manipulation of the argument author with the input g6g12<script>alert(1)</script>o8sdm leads to cross site scripting. The attack can be launched remotely. The identifier VDB-233293 was assigned to this vulnerability.

First published (updated )

CVE-2023-3541

Apple tvOSBuffer Overflow

Risk 79

Severity

8.8

Buffer Overflow

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2 is affected. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. tvOS before 11.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

1 / 3

Source: Launchpad

First published (updated )

Trending

Versions

Remedy

Company

Resources

Contact