Technology · Apple
Apple watchOS vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 386 vulnerabilities in Apple watchOS: 8 in the last 7 days and 170 in the last 90 days, 69 of them critical and 63 exploited in the wild. The most recent, CVE-2026-113970, was published on 9 November 2026. 66 vulnerabilities in the last four weeks, down 20% on the four before (82). 1 critical against 5, 1 exploited in the wild against 0.
- Last 7 days
- 8
- Last 90 days
- 170
- Critical, all time
- 69
- Exploited in the wild
- 63
About Apple watchOS
Apple's operating system for smartwatches and wearable devices.
Latest Apple watchOS vulnerabilities
- CVE-2026-113970: Apple Bluetooth use-after-free vulnerabilityhighCVSS 8.8
- CVE-2026-113969: Apple iOS, iPadOS, macOS, and related platforms rate limit bypass in AirPlay pairinginfoEPSS 0.2%
- CVE-2026-113968: Apple iOS and iPadOS Bluetooth pairing code rate limit bypassmediumCVSS 5.4EPSS 0.3%
- CVE-2026-113965: Apple iOS/iPadOS Bluetooth pairing bypassmediumCVSS 5.4EPSS 0.3%
- CVE-2026-113964: Apple iOS and iPadOS Bluetooth pairing rate limit bypass in CoreUtilsmediumCVSS 5.4EPSS 0.3%
- CVE-2026-113963: Apple App Intents authorization issue in iOS, iPadOS, visionOS, watchOSmediumCVSS 5.5EPSS 0.1%
- CVE-2026-113961: Apple Messages authorization bypass in iMessage group chathighCVSS 7.5EPSS 0.6%
- CVE-2026-113960: Apple Messages message history disclosure in group chatsinfoEPSS 0.2%
- CVE-2024-27834: Apple iOS, iPadOS, macOS, Safari, tvOS, watchOS pointer authentication bypasscriticalexploited in the wildEPSS 0.6%
- CVE-2026-86992: Apple AppleAVD out-of-bounds write in video processinginfo
- CVE-2026-86988: Apple iOS image processing memory disclosureinfo
- CVE-2026-86972: Apple iOS and iPadOS buffer overflow in audio processinginfo
- CVE-2026-86970: Apple iOS out-of-bounds read in font processinginfo
- CVE-2026-86964: Apple iOS null pointer dereference in input validationinfo
- CVE-2026-86954: Apple iOS out-of-bounds read in image processinginfo
- CVE-2026-84599: Apple iOS kernel memory corruptioninfo
- CVE-2026-84495: Apple iOS use-after-free in kernel memory managementinfo
- CVE-2026-65350: Apple iOS use-after-free in kernel memory managementinfo
- CVE-2026-113950: Apple iOS font processing out-of-bounds writeinfo
- CVE-2026-113915: Apple iOS and iPadOS race condition privilege escalationinfo
- CVE-2026-113910: Apple iOS memory initialization issueinfo
- CVE-2026-113907: Apple iOS buffer overflow in memory handlinginfo
- CVE-2026-113904: Apple Safari use-after-free in web content handlinginfo
- CVE-2026-113898: Apple iOS and iPadOS logging issue in Accounts frameworkinfo
- CVE-2026-112706: Apple iOS and iPadOS permissions issue in multiple frameworksinfo
Most severe Apple watchOS vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2025-43300: Apple iOS, iPadOS, and macOS out-of-bounds write in Image I/Ocriticalexploited in the wildCVSS 10EPSS 4.5%
- CVE-2025-24201: Apple Multiple Products WebKit Out-of-Bounds Write Vulnerabilitycriticalexploited in the wildCVSS 10
- CVE-2025-24085: Apple Multiple Products Use-After-Free Vulnerabilitycriticalexploited in the wildCVSS 10
- CVE-2025-31200: Apple Multiple Products Memory Corruption Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2025-43529: Apple WebKit use-after-free in multiple productscriticalexploited in the wildCVSS 8.8EPSS 8.8%
- CVE-2025-31277: Apple Multiple Products memory corruption in web content processingcriticalexploited in the wildCVSS 8.8EPSS 1.5%
- CVE-2021-30952: Apple Multiple Products integer overflow in WebKit content processingcriticalexploited in the wildCVSS 8.8EPSS 0.9%
- CVE-2022-48503: Apple Multiple Products code execution in JavaScriptCorecriticalexploited in the wildCVSS 8.8EPSS 0.2%
- CVE-2023-37450: Apple Multiple Products WebKit Code Execution Vulnerabilitycriticalexploited in the wildCVSS 8.8
- CVE-2023-32373: Apple Multiple Products WebKit Use-After-Free Vulnerabilitycriticalexploited in the wildCVSS 8.8
Vulnerabilities per week
66 vulnerabilities in the last four weeks, down 20% on the four before (82). 1 critical against 5, 1 exploited in the wild against 0. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 14 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 82 | 5 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 8 | 0 | |
| 26 Oct 2026 | 57 | 0 | |
| 2 Nov 2026 | 1 | 1 | |
| 9 Nov 2026 | 8 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Apple watchOS vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/watchos)<a href="https://junglewise.ai/threats/technologies/watchos"><img src="https://junglewise.ai/threats/technologies/watchos/badge.svg" alt="Apple watchOS vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/watchos.json, and this page as text at https://junglewise.ai/threats/technologies/watchos.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Apple watchOS vulnerabilities", https://junglewise.ai/threats/technologies/watchos, 12 November 2026.