DaystoPatch

VendorsPlatform

Apple

Apple makes the iPhone, iPad and Mac along with their operating systems (iOS, iPadOS, macOS, watchOS, tvOS, visionOS) and the Safari browser.

Response trend, 6 months
Not enough history
Open now
None
Latest incident
28 Sep 2026
Incidents on record
20 (19 not yet reviewed)

Response to exploited bugs

Not rated. 1 reviewed zero-day on record. A grade needs at least 3.

Fixing privately reported bugs

79 range 74–84rank 1 of 20

Medium confidence, 78 private reports

What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a D−. How grades work

Embed this report card

Why these grades

Every clock starts at the first public report.

  • Response to exploited bugs: not rated. 1 reviewed zero-day in the last 36 months. A grade needs at least 3.
  • First fix after 2 days, for its one reviewed zero-day.
  • Every supported version fixed after 2 days, for its one reviewed zero-day.
  • First advisory after 2 days, for its one reviewed zero-day.
  • Fixing privately reported bugs: B (79). Median 104 days from private report to fix (78 cases, 25 with a vendor fix date). 24 of 78 took longer than ZDI's 120-day deadline. 59 of 78 concern macOS.
  • 17 more exploited incidents await researcher review and are not graded.

Response to exploited bugs: sub-scores

  • Time to first advisory1 zero-day, 2 days
    77
    1 case, low confidence, not used for this vendor
  • Time to first fix1 zero-day, 2 days
    78
    1 case, low confidence, not used for this vendor
  • Time to fix all versions1 zero-day, 2 days
    78
    1 case, low confidence, not used for this vendor
  • OpennessNo machine-readable advisory feed listed. 1 of 1 zero-day with a dated revision history. 1 of 1 advisories said the bug was exploited. 1 of 1 fixed zero-day with a public fix date for every version. 1 of 1 zero-day not fixed within a day had an advisory or mitigation within 72 hours.
    52
    4 cases, low confidence, not used for this vendor

Fixing privately reported bugs: sub-score

  • Private fix speedMedian 104 days from private report to fix (78 cases, 25 with a vendor fix date)
    79B
    78 cases, medium confidence, weight 100%

Response fingerprint

Median of 1 graded zero-days. Vendor statement 2d, first fix 2d, all versions 2d.

Compressed time scale

Counts toward the response grade 1

  1. 10 Dec 2025WebKit/ANGLE flaws exploited against targeted iPhone users, publicly flagged by Google two days before Apple's fix
Not graded 19: n-days, unreviewed timelines and end-of-life products
  1. 28 Sep 2026Apple Multiple Products Out-of-Bounds Write VulnerabilityNot graded: unreviewed
  2. 6 Aug 2026Apple macOS Improper Authentication VulnerabilityNot graded: unreviewed
  3. 11 Feb 2026Apple Multiple Buffer Overflow VulnerabilityNot graded: unreviewed
  4. 12 Dec 2025Apple Multiple Products Improper Locking VulnerabilityNot graded: unreviewed
  5. 12 Dec 2025Apple Multiple Products Classic Buffer Overflow VulnerabilityNot graded: unreviewed
  6. 5 Nov 2025Apple Multiple products Use-After-Free VulnerabilityNot graded: unreviewed
  7. 20 Aug 2025Apple iOS, iPadOS, and macOS Out-of-Bounds Write VulnerabilityNot graded: unreviewed
  8. 29 Jul 2025Apple Multiple Products Buffer Overflow VulnerabilityNot graded: unreviewed
  9. 16 Apr 2025Apple Multiple Products Arbitrary Read and Write VulnerabilityNot graded: unreviewed
  10. 16 Apr 2025Apple Multiple Products Memory Corruption VulnerabilityNot graded: unreviewed
  11. 11 Mar 2025Apple Multiple Products WebKit Out-of-Bounds Write VulnerabilityNot graded: unreviewed
  12. 10 Feb 2025Apple iOS and iPadOS Incorrect Authorization VulnerabilityNot graded: unreviewed
  13. 10 Feb 2025Apple Multiple Products Unspecified VulnerabilityNot graded: unreviewed
  14. 27 Jan 2025Apple Multiple Products Use-After-Free VulnerabilityNot graded: unreviewed
  15. 19 Nov 2024Apple Multiple Products Cross-Site Scripting (XSS) VulnerabilityNot graded: unreviewed
  16. 19 Nov 2024Apple Multiple Products Code Execution VulnerabilityNot graded: unreviewed
  17. 10 Jan 2024Apple iOS and iPadOS Use-After-Free VulnerabilityNot graded: unreviewed
  18. 14 Aug 2023Apple Multiple Products Unspecified VulnerabilityNot graded: unreviewed
  19. 24 Aug 2021Apple Multiple Products Integer Overflow or Wraparound VulnerabilityNot graded: unreviewed
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Open, no fix
  • Open, partly fixed
  • Fixed when disclosed
  • Date only, no time of day

One row per exploited incident, newest first. A tick at the start means a fix existed when the bug went public.

Exploited incidents

20 in 24 months, 0 with known ransomware use, 100% exploited before a fix

First reportIncidentCVSSSilenceFirst fixAll fixedStatusGrade
28 Sep 2026Apple Multiple Products Out-of-Bounds Write VulnerabilityCVE-2026-869508.8same daysame daysame dayFixedNot graded: unreviewed
6 Aug 2026Apple macOS Improper Authentication VulnerabilityCVE-2026-654009.8same daysame daysame dayFixedNot graded: unreviewed
11 Feb 2026Apple Multiple Buffer Overflow VulnerabilityCVE-2026-207007.8same daysame daysame dayFixedNot graded: unreviewed
12 Dec 2025Apple Multiple Products Improper Locking VulnerabilityCVE-2025-435107.8same daysame daysame dayFixedNot graded: unreviewed
12 Dec 2025Apple Multiple Products Classic Buffer Overflow VulnerabilityCVE-2025-435205.5same daysame daysame dayFixedNot graded: unreviewed
10 Dec 2025WebKit/ANGLE flaws exploited against targeted iPhone users, publicly flagged by Google two days before Apple's fixCVE-2025-43529, CVE-2025-141748.82d2d2dFixedCounts toward grade
5 Nov 2025Apple Multiple products Use-After-Free VulnerabilityCVE-2023-430008.8–not datednot datedFixedNot graded: unreviewed
20 Aug 2025Apple iOS, iPadOS, and macOS Out-of-Bounds Write VulnerabilityCVE-2025-4330010.0same daysame daysame dayFixedNot graded: unreviewed
29 Jul 2025Apple Multiple Products Buffer Overflow VulnerabilityCVE-2025-312778.8same daysame daysame dayFixedNot graded: unreviewed
16 Apr 2025Apple Multiple Products Arbitrary Read and Write VulnerabilityCVE-2025-312019.8same daysame daysame dayFixedNot graded: unreviewed
16 Apr 2025Apple Multiple Products Memory Corruption VulnerabilityCVE-2025-312009.8same daysame daysame dayFixedNot graded: unreviewed
11 Mar 2025Apple Multiple Products WebKit Out-of-Bounds Write VulnerabilityCVE-2025-2420110.0same daysame daysame dayFixedNot graded: unreviewed
Show 8 more incidents
First reportIncidentCVSSSilenceFirst fixAll fixedStatusGrade
10 Feb 2025Apple iOS and iPadOS Incorrect Authorization VulnerabilityCVE-2025-242006.1same daysame daysame dayFixedNot graded: unreviewed
10 Feb 2025Apple Multiple Products Unspecified VulnerabilityCVE-2025-432004.2same daysame daysame dayFixedNot graded: unreviewed
27 Jan 2025Apple Multiple Products Use-After-Free VulnerabilityCVE-2025-2408510.0same daysame daysame dayFixedNot graded: unreviewed
19 Nov 2024Apple Multiple Products Cross-Site Scripting (XSS) VulnerabilityCVE-2024-443096.3same daysame daysame dayFixedNot graded: unreviewed
19 Nov 2024Apple Multiple Products Code Execution VulnerabilityCVE-2024-443088.8same daysame daysame dayFixedNot graded: unreviewed
10 Jan 2024Apple iOS and iPadOS Use-After-Free VulnerabilityCVE-2023-419747.8–not datednot datedFixedNot graded: unreviewed
14 Aug 2023Apple Multiple Products Unspecified VulnerabilityCVE-2022-485038.8–not datednot datedUnknownNot graded: unreviewed
24 Aug 2021Apple Multiple Products Integer Overflow or Wraparound VulnerabilityCVE-2021-309528.8–not datednot datedUnknownNot graded: unreviewed

Private reports

Median 105 days, 31% over 120 days, 0 published unpatched

Bugs reported privately to Apple by ZDI or Project Zero.

One tick per graded report. Counts to the vendor's fix when its date is known, else to publication. Taller ticks were published before a fix existed.
PublishedAdvisoryProductDays from report to fix or to publication. Tick: ZDI's 120-day deadline.Patch at publication
24 Aug 2026ZDI-26-610CVE-2026-64715Safari33to vendor fix, 18 Aug 2026Yes
29 Jul 2026ZDI-26-491CVE-2026-43673macOS95to vendor fix, 27 Jul 2026Yes
29 Jul 2026ZDI-26-494CVE-2026-43729macOS109to vendor fix, 27 Jul 2026Yes
29 Jul 2026ZDI-26-493CVE-2026-43733macOS117to vendor fix, 27 Jul 2026Yes
29 Jul 2026ZDI-26-315, ZDI-26-492CVE-2026-28941, CVE-2026-43780macOS158to vendor fix, 27 Jul 2026Yes
12 May 2026ZDI-26-313CVE-2026-28847Safari47to publicationYes
12 May 2026ZDI-26-231, ZDI-26-311, ZDI-26-312CVE-2026-20695, CVE-2026-28918, CVE-2026-28955macOS; Safari68to publicationYes
12 May 2026ZDI-26-314CVE-2026-28940macOS89to publicationYes
30 Mar 2026ZDI-26-230CVE-2026-20690macOS80to publicationYes
10 Mar 2026ZDI-26-173CVE-2026-20611macOS84to publicationYes
Show all 78 private reports
PublishedAdvisoryProductDays from report to fix or to publication. Tick: ZDI's 120-day deadline.Patch at publication
10 Mar 2026ZDI-26-174CVE-2026-20675macOS68to vendor fix, 11 Feb 2026Yes
10 Mar 2026ZDI-26-176CVE-2026-20616macOS111to publicationYes
10 Mar 2026ZDI-26-175CVE-2026-20634macOS98to vendor fix, 11 Feb 2026Yes
3 Feb 2026ZDI-25-1126, ZDI-26-057CVE-2025-43501, CVE-2025-46298Safari111to publicationYes
3 Feb 2026ZDI-26-056CVE-2025-43283macOS154to publicationYes
17 Dec 2025ZDI-25-1127CVE-2025-43541Safari98to publicationYes
13 Nov 2025ZDI-25-1011CVE-2025-43432Safari70to publicationYes
13 Nov 2025ZDI-25-1010CVE-2025-43457Safari79to publicationYes
13 Nov 2025ZDI-25-1007CVE-2025-43438Safari86to publicationYes
13 Nov 2025ZDI-25-1008CVE-2025-43380macOS91to publicationYes
13 Nov 2025ZDI-25-1002, ZDI-25-1003, ZDI-25-1004, ZDI-25-1009CVE-2025-43383, CVE-2025-43384, CVE-2025-43385, CVE-2025-43386macOS98to publicationYes
13 Nov 2025ZDI-25-1006CVE-2025-43445macOS107to publicationYes
13 Nov 2025ZDI-25-1005CVE-2025-43401macOS128to publicationYes
18 Sep 2025ZDI-25-901CVE-2025-43368Safari58to publicationYes
18 Sep 2025ZDI-25-900CVE-2025-43346macOS89to vendor fix, 15 Sep 2025Yes
18 Sep 2025ZDI-25-899CVE-2025-43349macOS98to publicationYes
28 Aug 2025ZDI-25-674, ZDI-25-675, ZDI-25-682, ZDI-25-684, ZDI-25-685, ZDI-25-687, ZDI-25-878CVE-2025-31280, CVE-2025-31281, CVE-2025-43224, CVE-2025-43255, CVE-2025-43264, CVE-2025-43284macOS116to vendor fix, 29 Jul 2025Yes
14 Aug 2025ZDI-25-677, ZDI-25-678, ZDI-25-846CVE-2025-31281, CVE-2025-43218, CVE-2025-43239macOS95to vendor fix, 29 Jul 2025Yes
11 Aug 2025ZDI-25-825macOS62to vendor fix, 31 Mar 2025Yes
30 Jul 2025ZDI-25-299, ZDI-25-300, ZDI-25-728CVE-2025-31208, CVE-2025-31209, CVE-2025-31239macOS48to vendor fix, 12 May 2025Yes
30 Jul 2025ZDI-25-020, ZDI-25-021, ZDI-25-727macOS112to vendor fix, 9 Jan 2025Yes
29 Jul 2025ZDI-25-709CVE-2025-43214Safari49to publicationYes
29 Jul 2025ZDI-25-673CVE-2025-43209Safari54to publicationYes
29 Jul 2025ZDI-25-681CVE-2025-43210macOS61to publicationYes
29 Jul 2025ZDI-25-680CVE-2025-43186macOS67to publicationYes
29 Jul 2025ZDI-25-679, ZDI-25-683, ZDI-25-689CVE-2025-31281, CVE-2025-43215, CVE-2025-43264macOS88to publicationYes
29 Jul 2025ZDI-25-676, ZDI-25-688CVE-2025-31281, CVE-2025-43219macOS104to publicationYes
29 Jul 2025ZDI-25-686, ZDI-25-690, ZDI-25-691CVE-2025-43221, CVE-2025-43224macOS112to publicationYes
24 Jun 2025ZDI-25-301, ZDI-25-302, ZDI-25-303, ZDI-25-418CVE-2025-24222, CVE-2025-31196, CVE-2025-31238, CVE-2025-31239Safari; macOS110to publicationYes
21 May 2025ZDI-25-298CVE-2025-31233macOS40to vendor fix, 12 May 2025Yes
21 May 2025ZDI-25-304CVE-2025-31251macOS80to vendor fix, 12 May 2025Yes
21 May 2025ZDI-25-194, ZDI-25-305CVE-2025-24256, CVE-2025-31219macOS; XNU kernel88to vendor fix, 12 May 2025Yes
1 Apr 2025ZDI-25-190, ZDI-25-191, ZDI-25-192CVE-2025-24190, CVE-2025-24211, CVE-2025-24230macOS52to vendor fix, 31 Mar 2025Yes
1 Apr 2025ZDI-25-188, ZDI-25-189CVE-2025-24243, CVE-2025-24244macOS81to vendor fix, 31 Mar 2025Yes
1 Apr 2025ZDI-25-193CVE-2025-24182macOS82to vendor fix, 31 Mar 2025Yes
1 Apr 2025ZDI-25-195CVE-2025-24210macOS102to vendor fix, 31 Mar 2025Yes
1 Apr 2025ZDI-25-167, ZDI-25-196CVE-2025-24139, CVE-2025-24185macOS133to vendor fix, 18 Mar 2025Yes
18 Mar 2025ZDI-25-164CVE-2025-24149SceneKit125to publicationYes
18 Mar 2025ZDI-25-165CVE-2024-54499macOS131to publicationYes
18 Mar 2025ZDI-25-168, ZDI-25-172CVE-2025-24123, CVE-2025-24124macOS138to publicationYes
18 Mar 2025ZDI-25-170CVE-2024-54501macOS154to publicationYes
18 Mar 2025ZDI-25-171CVE-2024-54500macOS161to publicationYes
18 Mar 2025ZDI-25-169CVE-2024-54497macOS166to publicationYes
18 Mar 2025ZDI-25-017, ZDI-25-018, ZDI-25-019, ZDI-25-166CVE-2024-54486macOS189to publicationYes
24 Feb 2025ZDI-25-093CVE-2024-27834Safari12to publicationYes
24 Feb 2025ZDI-25-092CVE-2024-27833Safari335to publicationYes
20 Jan 2025ZDI-24-1321, ZDI-25-048CVE-2024-27856, CVE-2024-40841macOS; WebKit256to publicationYes
9 Jan 2025ZDI-25-022macOS106to publicationYes
9 Jan 2025ZDI-24-1442, ZDI-25-015, ZDI-25-016CVE-2024-44240, CVE-2024-44302macOS140to publicationYes
31 Oct 2024ZDI-24-1444CVE-2024-44218SceneKit69to vendor fix, 28 Oct 2024Yes
31 Oct 2024ZDI-24-1447, ZDI-24-1448, ZDI-24-1449, ZDI-24-1450, ZDI-24-1451CVE-2024-44279, CVE-2024-44281, CVE-2024-44282, CVE-2024-44283, CVE-2024-44284macOS75to vendor fix, 28 Oct 2024Yes
31 Oct 2024ZDI-24-1445, ZDI-24-1446CVE-2024-44236, CVE-2024-44237macOS80to vendor fix, 28 Oct 2024Yes
31 Oct 2024ZDI-24-1443CVE-2024-44215macOS122to vendor fix, 28 Oct 2024Yes
2 Oct 2024ZDI-24-1282, ZDI-24-1312, ZDI-24-1313CVE-2024-40777, CVE-2024-40784, CVE-2024-40845macOS119to publicationYes
25 Sep 2024ZDI-24-1283CVE-2024-44176macOS50to publicationYes
25 Sep 2024ZDI-24-1286CVE-2024-44161macOS111to publicationYes
25 Sep 2024ZDI-24-1284, ZDI-24-1288CVE-2024-40841, CVE-2024-40846macOS127to publicationYes
25 Sep 2024ZDI-24-1040, ZDI-24-1120, ZDI-24-1276, ZDI-24-1277, ZDI-24-1278, ZDI-24-1279, ZDI-24-1280, ZDI-24-1281, ZDI-24-1285, ZDI-24-1287CVE-2024-27829, CVE-2024-27860, CVE-2024-27861, CVE-2024-27877, CVE-2024-44154, CVE-2024-44160macOS146to publicationYes
23 Aug 2024ZDI-24-1111, ZDI-24-1112, ZDI-24-1113, ZDI-24-1114, ZDI-24-1115, ZDI-24-1116, ZDI-24-1117, ZDI-24-1118, ZDI-24-1119, ZDI-24-1121, ZDI-24-1160, ZDI-24-1179, ZDI-24-1180CVE-2024-27829, CVE-2024-27857, CVE-2024-40789macOS; WebKit114to publicationYes
8 Aug 2024ZDI-24-1107, ZDI-24-1108, ZDI-24-1109, ZDI-24-1110CVE-2024-27857macOS105to publicationYes
8 Aug 2024ZDI-24-1122CVE-2024-27829macOS113to publicationYes
6 Aug 2024ZDI-24-1101CVE-2024-27802macOS230to publicationYes
26 Jul 2024ZDI-24-965CVE-2024-27829macOS140to publicationYes
12 Jun 2024ZDI-24-578, ZDI-24-579CVE-2024-23286, CVE-2024-27836macOS147to publicationYes
25 Apr 2024ZDI-24-404CVE-2024-23264macOS161to publicationYes
11 Mar 2024ZDI-24-283CVE-2024-23257macOS131to publicationYes
26 Feb 2024ZDI-24-207CVE-2023-42902macOS132to publicationYes
26 Feb 2024ZDI-24-206CVE-2023-42888macOS214to publicationYes

Grade history

Response to exploited bugs: score at the end of each month.

Not rated at any point in this period.

Channels

Get Apple's own alerts

What we watch

  • Advisory pageApple security releases

See sources and health for when each was last read.