Iphone Os
Vendor:
First CVE: Jun 25, 2007 · Active for 19 years
4,511
Total CVEs
More Total CVEs than 100% of tracked products
225.6
Avg CVEs / Year
Higher CVE frequency than 100% of tracked products
6.8
Avg CVSS
Higher Avg CVSS than 39% of tracked products
2.1%
KEV Rate
Higher KEV Rate than 96% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Iphone Os over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jun 25, 2007
19 years ago
Most Recent CVE
Jul 14, 2026
11 days ago
CVE Severity & Scoring
Iphone Os4,511 CVEs
43%
46%
All CVEs352,708 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local1,526 (33.8%)
Network1,740 (38.6%)
Unknown1,056 (23.4%)
Physical144 (3.2%)
Adjacent Network45 (1.0%)
Attack Complexity
Low3,303 (73.2%)
High152 (3.4%)
Unknown1,056 (23.4%)
User Interaction
None1,124 (24.9%)
Unknown1,056 (23.4%)
Required2,331 (51.7%)
Privileges Required
Low381 (8.4%)
High26 (0.6%)
None3,048 (67.6%)
Unknown1,056 (23.4%)
Top CVEs
Signals from CVEs in this product scope (4511 CVEs).
4,511 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2016-4657HIGH WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. | Aug 25, 2016 | 8.8 | 95 | YES | YES |
CVE-2016-0984HIGH Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0 | Feb 10, 2016 | 8.8 | 92 | YES | YES |
CVE-2015-8651HIGH Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adob | Dec 28, 2015 | 8.8 | 92 | YES | NO |
CVE-2014-4404HIGH Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an application that pro | Sep 18, 2014 | 7.8 | 92 | YES | YES |
CVE-2022-2294HIGH Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | Jul 28, 2022 | 8.8 | 91 | YES | NO |
CVE-2021-30860HIGH An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7. | Aug 24, 2021 | 7.8 | 91 | YES | NO |
CVE-2014-0569HIGH Integer overflow in Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and before 11.2.202.411 on Linux, Adobe AIR before 15.0.0.293, Adob | Oct 15, 2014 | 9.3 | 91 | NO | YES |
CVE-2023-5217HIGH Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a cra | Sep 28, 2023 | 8.8 | 87 | YES | NO |
CVE-2016-4656HIGH The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. | Aug 25, 2016 | 7.8 | 87 | YES | YES |
CVE-2025-24085CRITICAL A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS | Jan 27, 2025 | 10.0 | 86 | YES | YES |
Exploit Exposure
Signals from CVEs in this product scope (4511 CVEs).
CISA KEV
96 CVEs
2.1% of CVEs· 96th percentile
Metasploit
19 CVEs
0.4% of CVEs· 96th percentile
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
290 CVEs
6.4% of CVEs· 88th percentile
Social Chatter
Signals from CVEs in this product scope (4511 CVEs).
Media Mentions
Signals from CVEs in this product scope (4511 CVEs).
Top CNAs Publishing CVEs For Iphone Os
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 9.3.5 | 1 | 7.5 | 1.0% | 0 | 0 |
| 9.3.4 | 1 | 7.5 | 1.0% | 0 | 0 |
| 9.3.3 | 2 | 7.7 | 1.2% | 0 | 0 |
| 9.3.2 | 1 | 7.5 | 1.0% | 0 | 0 |
| 9.3.1 | 1 | 7.5 | 1.0% | 0 | 0 |
| 9.3 | 1 | 7.5 | 1.0% | 0 | 0 |
| 9.2.1 | 1 | 7.5 | 1.0% | 0 | 0 |
| 9.2 | 1 | 7.5 | 1.0% | 0 | 0 |
| 9.1 | 1 | 7.5 | 1.0% | 0 | 0 |
| 9.0.2 | 1 | 7.5 | 1.0% | 0 | 0 |
| 9.0.1 | 1 | 7.5 | 1.0% | 0 | 0 |
| 9.0 | 1 | 7.5 | 1.0% | 0 | 0 |
| 8.4.1 | 1 | 7.5 | 1.0% | 0 | 0 |
| 8.3 | 1 | 7.8 | 5.5% | 0 | 0 |
| 8.2 | 2 | 7.7 | 3.3% | 0 | 0 |
| 8.1.3 | 2 | 7.7 | 3.3% | 0 | 0 |
| 8.1.2 | 2 | 7.7 | 3.3% | 0 | 0 |
| 8.1 | 2 | 7.7 | 3.3% | 0 | 0 |
| 8.0.2 | 9 | 6.0 | 1.9% | 0 | 0 |
| 8.0.1 | 9 | 6.0 | 1.9% | 0 | 0 |