--- id: "CVE-2026-28836" page: "https://infrastack.ai/live/CVE-2026-28836" kind: "vulnerability" aliases: ["CVE-2026-28836"] title: "apple macos: A correctness issue was addressed with improved checks" severity: "medium" cvss: 6.1 epss: null exploited: false status: "open" category: "infrastructure" products: [{"name": "Find My", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["14.8.8"], "affected": "< 14.8.8", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["apple", "apple-account", "find-my", "infrastructure", "macos", "self-hosted", "vendor-advisory"] not_affected_if: [] published_at: "2026-09-14T21:17:05+00:00" first_seen_at: "2026-11-13T20:39:20+00:00" updated_at: "2026-11-13T21:27:24+00:00" sources: [{"source": "lab", "url": "https://support.apple.com/en-us/128072", "first_seen_at": "2026-11-13T20:39:20+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28836", "first_seen_at": "2026-11-13T21:27:24+00:00"}] exploit_sources: [] --- # apple macos: A correctness issue was addressed with improved checks Link for people: https://infrastack.ai/live/CVE-2026-28836 (this .md is for agents) Apple's advisory for macOS Sonoma 14.8.8 lists CVE-2026-28836 under Find My: an attacker with physical access can silently persist an Apple Account on an erased device. The sources do not say what else the attacker can read or do afterwards. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Find My affected range not listed fixed no fixed version listed - vendor:apple macos affected < 14.8.8 fixed 14.8.8 ## How to check - Compare the installed macOS version against `14.8.8`; anything earlier is listed in the advisory as lacking this fix. ## Fix - macOS Sonoma: move to `14.8.8`, the release that the advisory lists this CVE under. ## Timeline - 2026-11-13T20:39:20+00:00 lab https://support.apple.com/en-us/128072 — Apple: About the security content of macOS Sonoma 14.8.8 - Apple Support - 2026-11-13T21:27:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-28836 ## Documents - [advisory] macOS Sonoma 14.8.8 security content https://support.apple.com/en-us/128072 - [mentions] macOS Sonoma 14.8.8 security content https://support.apple.com/en-us/128072 ## From the sources About the security content of macOS Sonoma 14.8.8 - Apple Support # About the security content of macOS Sonoma 14.8.8 This document describes the security content of macOS Sonoma 14.8.8. ## About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page. Apple security documents reference vulnerabilities by CVE-ID when possible. For more information about security, see the Apple Product Security page. ## macOS Sonoma 14.8.8 Released July 27, 2026 ### Accounts Available for: macOS Sonoma Impact: An app may be able to gain root privileges Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-43749: Adam Franke, Trung Nguyen (@everping) of CyStack, Ashish Kunwar ### Accounts Available for: macOS Sonoma Impact: A malicious application may be able to bypass Privacy preferences Description: An authorization issue was addressed with improved state management. CVE-2026-65404: 이재영, Vinay Kumar Rasala (Xplo8E) from Appknox, Stuart Wallace, Arni Hardarson (Neonix Security) Entry added September 14, 2026 ### afpfs Available for: macOS Sonoma Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-64767: Dave G. ### afpfs Available for: macOS Sonoma Impact: Connecting to a malicious afpfs server may lead to kernel memory corruption Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-43815: Dave G. Entry added September 14, 2026 ### apache Impact: A remote attacker may be able to cause a denial-of-service Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2026-23918: Bartlomiej Dmitruk of striga.ai, Stanislaw Strzalkowski of isec.pl Entry updated September 14, 2026 ### APFS Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64695: Narendra Singh (@_3P1C), Peter Malone Entry updated September 14, 2026 ### App Store Impact: An app may be able to access sensitive user data CVE-2026-43801: Rahul Raj ### Apple Account Description: A race condition was addressed with improved state handling. CVE-2026-43781: Pinak Oza ### Apple Account Impact: A malicious app may be able to break out of its sandbox Description: An authorization issue was addressed with improved state management. CVE-2026-64737: Robert Mindo ### AppleRAID Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-43681: impost0r (ret2plt), David Ige - Beryllium Security ### AppleRAID Impact: Mounting a malicious disk image may cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43761: lokerxx, Narendra Singh (@_3P1C), Lyutoon, Jordy Zomer (@pwningsystems), Richard Zana, George Stergiopoulos, InfoSec lab, Athens University of Economics and Business, Greece, Aswin Kumar Gokulakannan Entry added September 14, 2026 ### Assets Impact: A malicious application may be able to bypass Privacy preferences CVE-2026-43672: 이재영 ### ATS Impact: An app may be able to read files outside of its sandbox Description: A permissions issue was addressed by removing the vulnerable code. CVE-2026-43763: Pavan Nallamothu, Jared Reyes ### Audio Impact: An app may be able to break out of its sandbox CVE-2026-64702: John Lussier ### Audio Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/) ### AVEVideoEncoder Impact: An app may be able to execute arbitrary code with kernel privileges Description: A buffer overflow was addressed with improved size validation. CVE-2026-64747: Franco Belman at Blackwing Intelligence ### AVEVideoEncoder Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun ### BackgroundAssets Impact: An app may be able to delete files for which it does not have permission CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab ### BOM Impact: A maliciously crafted ZIP archive may bypass Gatekeeper checks CVE-2026-28849: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs ### cd9660 Impact: An app may be able to cause unexpected system termination or read kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64698: Richard Zana, Peter Malone, Nathaniel Oh (@calysteon), an anonymous researcher ### Contacts Impact: Processing a maliciously crafted contact may leak sensitive data CVE-2026-64734: Daniel Williams ### Control Center CVE-2026-43756: 이재영 ### Core Services Impact: An app may be able to gain root privileges Description: A race condition was addressed with improved state handling. CVE-2026-43693: Gergely Kalman (@gergely_kalman) ### CoreAudio CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative ### CoreAudio Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43744: ret2happy, Mathis Mansière, an anonymous researcher Entry updated September 14, 2026 ### CoreAudio Impact: A remote attacker may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43803: Rahul Raj ### CoreMedia Impact: Processing a maliciously crafted video file may lead to unexpected app termination CVE-2026-43711: James Duffy (@0x4A616D657344) ### CoreServices Impact: Processing a maliciously crafted file may lead to unexpected app termination CVE-2026-28936: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs ### CoreUI Impact: Processing a maliciously crafted asset catalog may result in disclosure of process memory CVE-2026-43738: Peter Malone ### CoreUI Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-84489: stratan (@5tratan), Peter Malone Entry added September 14, 2026 ### CoreVideo Impact: An app may be able to cause unexpected system termination CVE-2026-43802: an anonymous researcher ### Crash Reporter Impact: An app may be able to leak sensitive user information Description: A privacy issue was addressed by removing sensitive data. CVE-2026-64710: Matthew Schneider ### CUPS Available for: macOS Sonoma Impact: A malicious app may be able to gain root privileges Description: A permissions issue was addressed with additional restrictions. CVE-2026-39875: XBreach.ai, Dallas Dubs, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs, Aaron Grattafiori - NVIDIA AI Red Team ### CUPS Available for: macOS Sonoma Impact: An app may be able to gain root privileges Description: An injection issue was addressed with improved validation. CVE-2026-43698: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs ### curl Available for: macOS Sonoma Impact: Authentication credentials may be sent to a server on another origin Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. ### curl Available for: macOS Sonoma Impact: Multiple issues in curl Descriptio --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_