CVE-2015-7036: Apple iPhone OS

High severity, CVSS 7.5. EPSS: 39.3% chance of exploitation in the next 30 days.

The fts3_tokenizer function in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a SQL command that triggers an API call with a crafted pointer value in the second argument.

Affected products

• Apple iPhone OS: up to and including 8.3
• Apple Mac OS X: up to and including 10.10.3

Published 2015-11-22. Last modified 2026-06-17.