CVE-2015-7068: Apple iPhone OS

High severity, CVSS 7.8. EPSS: 4.2% chance of exploitation in the next 30 days.

IOKit SCSI in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via an app that provides an unspecified userclient type.

Affected products

• Apple iPhone OS: before 9.2 (fixed in 9.2)
• Apple Mac OS X: before 10.11.2 (fixed in 10.11.2)
• Apple tvOS: before 9.1 (fixed in 9.1)
• Apple watchOS: before 2.1 (fixed in 2.1)

Published 2015-12-11. Last modified 2026-06-17.