CVE Vulnerability Catalog

This issue was addressed with improved checks. The issue affects macOS Golden Gate 27.2 and macOS Tahoe 26.7.2. An app may be able to bypass Gatekeeper checks.

A race condition was addressed with additional validation. The issue affects macOS Golden Gate 27.2, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2. An app may be able to modify protected parts of the file system.

A logging issue was addressed with improved data redaction. An app may be able to access sensitive user data.

An out-of-bounds read was addressed with improved bounds checking. Processing a maliciously crafted file may disclose process memory.

A logic issue was addressed with improved checks. An app may bypass Gatekeeper checks.

An out-of-bounds read was addressed with improved bounds checking. The issue affects iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, and visionOS 27.2. Processing a maliciously crafted file may lead to denial-of-service or disclosure of memory contents.

A race condition was addressed with improved handling of symbolic links. The issue affects macOS Golden Gate 27.2, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2. An app may be able to modify protected parts of the file system.

An out-of-bounds write was addressed with improved bounds checking. The issue affects iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, and visionOS 27.2. Processing a maliciously crafted video file may lead to unexpected app termination.

An out-of-bounds write was addressed with improved input validation. An app may be able to cause unexpected system termination or corrupt process memory. The issue is fixed in iOS 26.7.2, iPadOS 26.7.2, iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, and visionOS 27.2.

A stack overflow was addressed with improved input validation. The issue affects iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, and visionOS 27.2. Processing a maliciously crafted message may lead to denial-of-service.

An out-of-bounds read was addressed with improved bounds checking. The issue affects iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, and visionOS 27.2. Processing a maliciously crafted file may lead to unexpected app termination.

Some externally supplied values stored by the device may be rendered in the web interface without sufficient output encoding. An attacker who can influence one of these values could cause script execution in the browser of a user who views an affected page. Exploitation requires an attacker to influence a stored value and a user to view a page that renders it.

An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be accessed remotely by an unauthenticated attacker with network access to the web interface. The accessible resources do not expose credentials or provide administrative functionality, but may include non-public device content, such as screen-saver content or assets used by the web interface.

A denial-of-service vulnerability has been identified in the Miracast over Infrastructure Connection Establishment (MICE) service. An unauthenticated attacker with network access to the MICE service could consume available connection capacity, preventing legitimate users from establishing MICE-based Miracast connections while the condition persists. MICE is disabled by default and must be explicitly enabled; Miracast P2P is not affected.

The jose library accepts ECDSA (ES256, ES256K, ES384, and ES512) JWS signatures of a non-canonical length. When verifying an ECDSA signature, jose_jwk_kty_ec:verify/4 splits the raw signature in half by its actual byte length instead of enforcing the fixed length required by RFC 7518 §3.4, then decodes each half ignoring leading zero bytes. An attacker holding one valid token can prepend leading zero bytes to each of the R and S halves to produce many distinct signature byte strings that verify against the same key (signature malleability).

Inefficient Algorithmic Complexity in erlang-jose allows an unauthenticated remote attacker to cause a CPU-exhaustion denial of service by submitting a crafted RSA JSON Web Key. When an application parses an untrusted JWK through the public jose_jwk:from_binary/1 or jose_jwk:from_map/1 API, an RSA private key that supplies d, e, and n but omits all Chinese Remainder Theorem parameters is routed into convert_sfm_to_crt/1, which tries to recover the missing primes by factoring the modulus. When the modulus cannot be split into two factors, the search loop performs a modular exponentiation over the attacker-sized modulus on every iteration and never succeeds.

Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key through a timing side channel in the pure-Erlang Curve25519 fallback. The pure-Erlang X25519 implementation performs scalar multiplication over the secret private key using a recursive Montgomery ladder whose execution time depends on the secret scalar, making public entry points (e.g., scalarmult/2, x25519/2) timing-dependent on the private key. This issue affects jose from 1.10.0 before 1.11.13.

jose_jwk:shared_secret/2 (exposed in Elixir as JOSE.JWK.shared_secret/2) derives an ECDH shared secret from two JWKs. Its first function clause only matches when both JWKs carry the same key type (kty) module, and its fallback clause re-invokes itself as shared_secret(from(YourJWK), from(MyJWK)). Because from/1 returns an already-parsed jose_jwk record unchanged, passing two JWKs whose key types differ makes the fallback clause re-enter with identical arguments, producing an unbounded tail-recursive loop that never returns and never crashes.

Improper Handling of Highly Compressed Data (Data Amplification) in potatosalad jose (erlang-jose) allows a remote attacker to exhaust a node's memory with a small crafted JWE token. The jose_jwe_zip:uncompress/2 function decompresses the DEFLATE-compressed plaintext of a JWE carrying the optional zip: DEF header by calling zlib:inflate/2 on the entire attacker-controlled stream, with no bound on output size or inflation ratio. Raw DEFLATE reaches ratios around 1000:1 on highly repetitive input, so a few-kilobyte token inflates to hundreds of megabytes or gigabytes in a single call.

The pure-Erlang RSAES-PKCS1-v1_5 decryption in the jose_jwa_pkcs1 module is a Bleichenbacher padding oracle. eme_pkcs1_decode/2 returns the recovered message when a decrypted block has valid PKCS#1 v1.5 padding and returns a distinct error result otherwise, and rsaes_pkcs1_decrypt/2 additionally returns {error, {badsize, _}} when the length check fails. The implementation applies no implicit-rejection countermeasure (RFC 8017 §7.2.2), so a one-bit padding-conformance signal leaks to the caller. Because the underlying modular exponentiation in dp/2 is a raw, non-blinded crypto:mod_pow/3, the padding check also stays distinguishable by timing even when an application normalizes every failure to a single error value.