Apple iOS, iPadOS, and macOS known exploited vulnerabilities, ranked
CISA lists 11 Apple iOS, iPadOS, and macOS CVEs as exploited in the wild. 0 were added in the last 12 months and 0 are known to be used in ransomware. The table ranks all of them by EPSS, FIRST's estimate of the chance a CVE is exploited in the next 30 days, so the first rows are the ones to patch first.
Patch these first
- CVE-2023-41064: EPSS 53.4%, added 2023-09-11
- CVE-2025-43300: EPSS 32.5%, added 2025-08-21
- CVE-2023-28206: EPSS 23.2%, added 2023-04-10
- CVE-2022-22620: EPSS 16.3%, added 2022-02-11
- CVE-2021-30858: EPSS 13.4%, added 2021-11-03
All 11 Apple iOS, iPadOS, and macOS CVEs in CISA KEV, by EPSS
| # | CVE | Flaw | EPSS | Ransomware | Added | Federal due |
|---|---|---|---|---|---|---|
| 1 | CVE-2023-41064 | iOS, iPadOS, and macOS ImageIO Buffer Overflow | 53.4% | – | 2023-09-11 | 2023-10-02 |
| 2 | CVE-2025-43300 | iOS, iPadOS, and macOS Out-of-Bounds Write | 32.5% | – | 2025-08-21 | 2025-09-11 |
| 3 | CVE-2023-28206 | iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write | 23.2% | – | 2023-04-10 | 2023-05-01 |
| 4 | CVE-2022-22620 | iOS, iPadOS, and macOS Webkit Use-After-Free | 16.3% | – | 2022-02-11 | 2022-02-25 |
| 5 | CVE-2021-30858 | iOS, iPadOS, macOS Use-After-Free | 13.4% | – | 2021-11-03 | 2021-11-17 |
| 6 | CVE-2021-1870 | iOS, iPadOS, and macOS WebKit Remote Code Execution | 7.7% | – | 2021-11-03 | 2021-11-17 |
| 7 | CVE-2021-1871 | iOS, iPadOS, and macOS WebKit Remote Code Execution | 7.0% | – | 2021-11-03 | 2021-11-17 |
| 8 | CVE-2022-32917 | iOS, iPadOS, and macOS Remote Code Execution | 5.6% | – | 2022-09-14 | 2022-10-05 |
| 9 | CVE-2021-30900 | iOS, iPadOS, and macOS Out-of-Bounds Write | 5.2% | – | 2023-03-30 | 2023-04-20 |
| 10 | CVE-2021-30869 | iOS, iPadOS, and macOS Type Confusion | 4.1% | – | 2021-11-03 | 2021-11-17 |
| 11 | CVE-2020-9934 | iOS, iPadOS, and macOS Input Validation | 3.2% | – | 2022-09-08 | 2022-09-29 |
EPSS changes daily; a CVE with a low EPSS that is in KEV is still exploited somewhere. Federal due dates bind US federal civilian agencies; everyone else can use them as a priority hint.
Sources: CISA KEV, FIRST EPSS.
More: all Apple KEV CVEs · other Apple products: Multiple Products · macOS · iOS and iPadOS · iOS · free KEV badge for Apple · all vendors