Apple Patches 329 Security Flaws, Including a Camera Access Bug

Apple today released a broad set of system updates that close a large number of security vulnerabilities. According to the company's security releases page, the updates for iOS, iPadOS, macOS, watchOS, tvOS, visionOS and Safari together address 329 unique flaws.

Because many of the bugs affect more than one operating system, the combined count of CVE entries reaches 1,265. Apple routinely adds new entries to published security bulletins or updates existing ones after the fact, so these figures may grow in the coming days.

Notable fixes: camera, Apple Intelligence and Siri

One of the most striking fixes is for a problem in the CoreMedia component. Tracked as CVE-2026-86990, the flaw could allow a malicious app to access the camera on an iPhone, iPad, Mac or Apple Vision Pro without the user's permission.

Another significant entry involves Apple Intelligence. CVE-2026-86987 could have allowed a remote attacker to reach sensitive user data on supported iPhone and iPad models. On macOS Tahoe, CVE-2026-43736, a bug in Siri, could let an app access sensitive user data.

The WebKit patching wave continues

The updates also close several WebKit vulnerabilities that could allow arbitrary code execution through specially crafted web content. Apple has been patching WebKit heavily in recent months, partly because AI tools are increasingly being used to find security flaws. In today's releases, Apple credited AI tools and research teams for discovering several of the bugs.

Earlier this year, the company also shipped multiple updates to close, on older devices, the flaws used by exploit kits called Coruna and DarkSword. Those kits used WebKit vulnerabilities as part of attack chains to compromise iPhones running older versions of iOS.

Fixes extended to older releases

Today's updates also bring a previously released CoreGraphics fix to devices running iOS 18 and iPadOS 18. The bug, CVE-2026-86950, could lead to arbitrary code execution through a specially crafted file.

Apple first addressed the issue in updates released last month and warned that it may have been exploited in an extremely sophisticated attack against specific individuals running versions of iOS before iOS 27. Full details of each update's security content are available on Apple's security releases page, and users are advised to install the relevant updates on their devices.