MACOS · CVE-2026-28849 · Infrastructure
FIX → 15.7.8 · 14.8.8
A maliciously crafted ZIP archive can get past Gatekeeper, the macOS check that screens downloaded software. An attacker who gets a user to open such an archive can run software that macOS would otherwise have blocked or warned about.
first public Jul 27, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Macs running macOS Sequoia before 15.7.8 are exposed. The risk comes from opening a downloaded ZIP archive, so anyone who handles files from untrusted sources is in scope. Machines already on 15.7.8 or later are not affected.
Not affected if already-on-15.7.8
Who cares apple, apple-devices, macos, vendor-advisory
sw_vers -productVersion on the Mac; a version below 15.7.8 on macOS Sequoia is exposed.Upgrade to 15.7.8 · 14.8.8
15.7.8About the security content of macOS Sequoia 15.7.8 - Apple Support
This document describes the security content of macOS Sequoia 15.7.8.
For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.
Apple security documents reference vulnerabilities by CVE-ID when possible.
For more information about security, see the Apple Product Security page.
Released July 27, 2026
Available for: macOS Sequoia
Impact: An app may be able to gain root privileges
Description: A parsing issue in the handling of directory paths was addressed with improved path validation.
CVE-2026-43749: Adam Franke, Trung Nguyen (@everping) of CyStack, Ashish Kunwar
Available for: macOS Sequoia
Impact: A malicious application may be able to bypass Privacy preferences
Description: An authorization issue was addressed with improved state management.
CVE-2026-65404: 이재영, Vinay Kumar Rasala (Xplo8E) from Appknox, Stuart Wallace, Arni Hardarson (Neonix Security)
Entry added September 14, 2026
Available for: macOS Sequoia
Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Description: A buffer overflow was addressed with improved bounds checking.
CVE-2026-64767: Dave G.
Available for: macOS Sequoia
Impact: Connecting to a malicious afpfs server may lead to kernel memory corruption
Description: A buffer overflow was addressed with improved bounds checking.
CVE-2026-43815: Dave G.
Entry added September 14, 2026
Impact: A remote attacker may be able to cause a denial-of-service
Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2026-23918: Bartlomiej Dmitruk of striga.ai, Stanislaw Strzalkowski of isec.pl
Entry updated September 14, 2026
Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64695: Narendra Singh (@_3P1C), Peter Malone
Entry updated September 14, 2026
Impact: An app may be able to access sensitive user data
CVE-2026-43801: Rahul Raj
Description: A race condition was addressed with improved state handling.
CVE-2026-43781: Pinak Oza
Impact: A malicious app may be able to break out of its sandbox
Description: An authorization issue was addressed with improved state management.
CVE-2026-64737: Robert Mindo
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-43748: Vladislav Shevchenko (Positive Technologies), an anonymous researcher, tamdao, Franco Belman at Blackwing Intelligence
Entry updated September 14, 2026
Impact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution
Description: A buffer overflow was addressed with improved bounds checking.
CVE-2026-43776: Peter Malone, Nicolas Rabrenovic, Irvin Wang, Rishabh Jain (rjcyber) of cyberplanet
Entry updated September 14, 2026
Impact: A local user may be able to read kernel memory
Description: A buffer overflow was addressed with improved bounds checking.
CVE-2026-43681: impost0r (ret2plt), David Ige - Beryllium Security
Impact: Mounting a malicious disk image may cause unexpected system termination
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-43761: lokerxx, Narendra Singh (@_3P1C), Lyutoon, Jordy Zomer (@pwningsystems), Richard Zana, George Stergiopoulos, InfoSec lab, Athens University of Economics and Business, Greece, Aswin Kumar Gokulakannan
Entry added September 14, 2026
Impact: A malicious application may be able to bypass Privacy preferences
CVE-2026-43672: 이재영
Impact: An app may be able to read files outside of its sandbox
Description: A permissions issue was addressed by removing the vulnerable code.
CVE-2026-43763: Pavan Nallamothu, Jared Reyes
Impact: An app may be able to break out of its sandbox
CVE-2026-64702: John Lussier
Impact: An app may be able to cause a denial-of-service
CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)
Impact: An app may be able to execute arbitrary code with kernel privileges
Description: A buffer overflow was addressed with improved size validation.
CVE-2026-64747: Franco Belman at Blackwing Intelligence
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds read was addressed with improved bounds checking.
CVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun
Impact: An app may be able to delete files for which it does not have permission
CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab
Impact: A maliciously crafted ZIP archive may bypass Gatekeeper checks
CVE-2026-28849: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
Impact: An app may be able to cause unexpected system termination or read kernel memory
CVE-2026-64698: Richard Zana, Peter Malone, Nathaniel Oh (@calysteon), an anonymous researcher
Impact: Processing a maliciously crafted contact may leak sensitive data
CVE-2026-64734: Daniel Williams
CVE-2026-43756: 이재영
Impact: An app may be able to gain root privileges
Description: A race condition was addressed with improved state handling.
CVE-2026-43693: Gergely Kalman (@gergely_kalman)
CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative
Impact: Processing an audio stream in a maliciously crafted media file may terminate the process
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-43744: ret2happy, Mathis Mansière, an anonymous researcher
Entry updated September 14, 2026
Impact: A remote attacker may be able to cause unexpected system termination
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-43803: Rahul Raj
CVE-2026-43775: Csaba Fitzl (@theevilbit) of Iru
Impact: Processing a maliciously crafted video file may lead to unexpected app termination
CVE-2026-43711: James Duffy (@0x4A616D657344)
Impact: Processing a maliciously crafted file may lead to unexpected app termination
CVE-2026-28936: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
Available for: macOS Sequoia
Impact: Processing a maliciously crafted asset catalog may result in disclosure of process memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43738: Peter Malone
Available for: macOS Sequoia
Impact: An app may be able to cause a denial of service
Description: A buffer overflow was addressed with improved bounds checking.
CVE-2026-84489: stratan (@5tratan), Peter Malone
Entry added September 14, 2026
Available for: macOS Sequoia
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-43802: an anonymous researcher
Available for: macOS Sequoia
Impact: An app may be able to leak sensitive user information
Description: A privacy issue was addressed by removing sensit
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.