CERT-In flags security flaws in Apple devices, warns of data exposure

The Indian Computer Emergency Response Team (CERT-In), under the Ministry of Electronics and Information Technology, issued a high-severity security advisory on Wednesday, warning of multiple vulnerabilities in Apple products. 

 

The flaws could allow attackers to run unauthorised code, gain higher access privileges, access sensitive information or disrupt services on affected devices.

 

CERT-In said the vulnerabilities could also allow attackers to bypass security restrictions and compromise the targeted systems.

 

Which Apple products are affected?

 

According to the advisory, the vulnerabilities affect several Apple operating systems and software versions. These include:

 

• Safari: Versions earlier than 27.2

• macOS Sequoia: Versions earlier than 15.8.2

• macOS Tahoe: Versions earlier than 26.7.2

 

• macOS Golden Gate: Versions earlier than 27.2

• iOS and iPadOS: Versions earlier than 18.7.11

• iOS and iPadOS: Versions earlier than 26.7.2

• iOS and iPadOS: Versions earlier than 27.2

• watchOS: Versions earlier than 27.2

• tvOS: Versions earlier than 27.2

• visionOS: Versions earlier than 27.2

 

The advisory applies to end-user organisations and individuals using affected Apple products.

 

What are the risks?

 

CERT-In said the vulnerabilities stem from several issues, including memory corruption, out-of-bounds read and write errors, use-after-free flaws, buffer overflows, race conditions, type confusion and integer overflows. 

 

The flaws also involve input validation and authorisation issues across various system components, as well as weaknesses in WebKit, the browser engine used by Safari, and media-processing frameworks. An attacker could exploit these vulnerabilities by processing specially crafted web content, files, images, audio, video or fonts. Attacks could also target other vulnerable applications and system components.

 

Successful exploitation could allow attackers to execute arbitrary code, gain elevated privileges, access sensitive information, bypass security mechanisms or cause system crashes and denial-of-service conditions.

 

Who is at risk?

 

The advisory identifies all individuals and organisations using affected Apple products as potential targets. CERT-In has rated the severity of the vulnerabilities as 'high', citing the risk of remote code execution, privilege escalation, information disclosure and security restriction bypass.

 

Similar warnings in the past

 

CERT-In issued a similar high-severity advisory in March this year, warning that vulnerabilities in Apple products could allow attackers to run code remotely, gain access to systems, bypass security restrictions or cause denial-of-service attacks. The advisory flagged iOS and iPadOS versions earlier than 26.4 as affected.

 

The agency has also issued high-severity warnings about vulnerabilities in Google Chrome for desktop and Mozilla products.

 

In December 2025, CERT-In warned that vulnerabilities in Apple’s iPhone, Mac and iPad could allow attackers to run unauthorised code, gain higher access privileges, access sensitive information, bypass security restrictions or disrupt services.

 

Apple also issued security notifications to users worldwide, including in India, in April and December 2025, warning that they might have been targeted by mercenary spyware.