CVE-2019-15126: Apple iPadOS

Low severity, CVSS 3.1. EPSS: 7.3% chance of exploitation in the next 30 days.

An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic, a different vulnerability than CVE-2019-9500, CVE-2019-9501, CVE-2019-9502, and CVE-2019-9503.

Affected products

• Apple iPadOS: before 13.2 (fixed in 13.2)
• Apple iPhone OS: before 13.2 (fixed in 13.2)
• Apple Mac OS X: before 10.15.1 (fixed in 10.15.1)
• Broadcom BCM43012 Firmware: affected versions not specified
• Broadcom BCM43013 Firmware: affected versions not specified
• Broadcom BCM4356 Firmware: affected versions not specified
• Broadcom BCM43752 Firmware: affected versions not specified
• Broadcom BCM4375 Firmware: affected versions not specified
• Broadcom BCM4389 Firmware: affected versions not specified

Published 2020-02-05. Last modified 2026-06-17.