{"id":"CVE-2026-28864","kind":"vulnerability","aliases":["CVE-2026-28864"],"related":[],"title":"This issue was addressed with improved permissions checking","description":"About the security content of macOS Tahoe 26.7.2 - Apple Support\n\n# About the security content of macOS Tahoe 26.7.2\n\nThis document describes the security content of macOS Tahoe 26.7.2.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## macOS Tahoe 26.7.2\n\nReleased October 26, 2026\n\n### Accelerate Framework\n\nAvailable for: macOS Tahoe\n\nImpact: Processing a maliciously crafted image may lead to unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-86971: an anonymous researcher\n\n### Accounts\n\nAvailable for: macOS Tahoe\n\nImpact: A malicious application may be able to bypass Privacy preferences\n\nDescription: A logging issue was addressed with improved data redaction.\n\nCVE-2026-113898: Bhaswanth Chigurupati\n\n### AirPort\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to read sensitive location information\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-112551: Nguyen Duc Anh of Noventiq, Sindre Sorhus\n\n### APFS\n\nAvailable for: macOS Tahoe\n\nImpact: Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-84496: 준우 이, Maher Azzouzi, Jonathan Bar Or (@yo_yo_yo_jbo), Marco Schmitt, Nathaniel Oh (@calysteon), Aswin Kumar Gokulakannan, Narendra Singh (@_3P1C), Thanatos Tian (HKPolyU) & wgg with Diffract, Jakob Pammer, an anonymous researcher, Bhuwan Bhetwal, Kwak kiyong (@Pwnkai23) , Song nuri\n\n### APFS\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112525: We Muftihaturrahmah, Aswin Kumar Gokula Kannan, Ruslan Dautov, Peter Malone\n\n### APFS\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112536: Ruslan Dautov, Thomas Guillem, Narendra Singh (@_3P1C), Kwak Kiyong (@Pwnkai23), Song Nuri, Thanatos Tian (HKPolyU) & wgg with Diffract\n\n### App Store\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to bypass network restrictions\n\nDescription: This issue was addressed with improved checks.\n\nCVE-2026-112467: Sindre Sorhus\n\n### App Store\n\nAvailable for: macOS Tahoe\n\nImpact: A remote attacker may be able to break out of the WebContent sandbox\n\nDescription: This issue was addressed with improved input validation.\n\nCVE-2026-112690: Claudio Bozzato and Francesco Benvenuto of Cisco Talos\n\n### Apple Intelligence\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-86920: Johan Wahyudi\n\n### Apple Neural Engine\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-84595: tamdao\n\n### Apple Neural Engine\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112696: Jaeyeong Lee\n\n### AppleAVD\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112416: an anonymous researcher, Meta Red Team X - Nik Tsytsarkin, Narendra Singh (@_3P1C), Hcamael and 章鱼哥@aipy (aipyaipy.com), Dohyeon An @PILAB Technology, Inc\n\n### AppleAVD\n\nImpact: An app may be able to cause unexpected system termination or corrupt process memory\n\nDescription: An out-of-bounds write was addressed with improved input validation.\n\nCVE-2026-112415: Rahul Raj, Hcamael and 章鱼哥@aipy (aipyaipy.com)\n\n### AppleAVD\n\nImpact: A malicious app may be able to break out of its sandbox\n\nDescription: An information leakage was addressed with additional validation.\n\nCVE-2026-112704: Josh Maine of Calif.io\n\n### AppleMobileFileIntegrity\n\nImpact: A malicious app may be able to read or write to protected files\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-112539: Claudio Bozzato and Francesco Benvenuto of Cisco Talos\n\n### AppleRAID\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-112531: Chanwit Muenprakoddee (ChemIndy)\n\n### Archive Utility\n\nImpact: An attacker with root privileges may be able to access protected user data\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-86939: Lance Cain - Senior Security Researcher at SpecterOps Inc.\n\n### ArchiveService\n\nImpact: An app may bypass Gatekeeper checks\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-86937: YingMuo (@YingMuo) of DEVCORE Research Team, Paul Montgomery (@nullevent)\n\n### ArchiveService\n\nImpact: Processing a maliciously crafted file may bypass Gatekeeper checks\n\nDescription: A logic issue was addressed with improved checks.\n\nCVE-2026-112568: an anonymous researcher\n\n### Audio\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112546: lunar815, Nathaniel Oh (@calysteon), Piotr Jerzy Duszynski, an anonymous researcher, Surej Sekhar, r3pwnx (@r3pwnx), Lily Cohl (@GenericCoding)\n\n### Audio\n\nImpact: An app may be able to access sensitive user data\n\nDescription: This issue was addressed with additional entitlement checks.\n\nCVE-2026-112675: Lakshay Sharma (MrW0r57), Abodi Dawoud\n\n### AVEVideoEncoder\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112705: Marco Schmitt, Andrey Chernykh, Josh Maine of Calif.io\n\n### AVEVideoEncoder\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved input validation.\n\nCVE-2026-112689: Franco Belman at Blackwing Intelligence\n\n### AVEVideoEncoder\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112470: Hcamael and 章鱼哥@aipy (aipyaipy.com)\n\nCVE-2026-112468: Hcamael and 章鱼哥@aipy (aipyaipy.com)\n\nCVE-2026-112469: Hcamael and 章鱼哥@aipy (aipyaipy.com)\n\n### AVEVideoEncoder\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\nCVE-2026-112466: Hcamael and 章鱼哥@aipy (aipyaipy.com)\n\n### Bluetooth\n\nImpact: An attacker in physical proximity may be able to cause a denial-of-service\n\nDescription: A null pointer dereference was addressed with improved validation.\n\nCVE-2026-112566: Chris Bailey - Short Circuit\n\n### BOM\n\nImpact: A maliciously crafted ZIP archive may bypass Gatekeeper checks\n\nDescription: A file quarantine bypass was addressed with additional checks.\n\nCVE-2026-84610: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs, Murray Mike\n\n### BOM\n\nImpact: Processing a maliciously crafted file may lead to heap corruption\n\nDescription: An out-of-bounds write issue was addressed with improved input validation.\n\nCVE-2026-112670: Bhaswanth Chigurupati\n\n### BOM\n\nAvailable for: macOS Tahoe\n\nImpact: A maliciously crafted ZIP archive may bypass Gatekeeper checks\n\nDescription: The issue was addressed with improved checks.\n\nCVE-2026-112672: 준우 이, Pasquale Scola\n\n### Calendar\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to access sensitive user data\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-112678: Neon, Niels Hofmans, Mustafa Calap (@ordinal0, dbg.re)\n\n### Carbon Core\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to access sensitive user data\n\nDescription: A logging issue was addressed with improved data redaction.\n\nCVE-2026-84528: zenith\n\n### Carbon Core\n\nImpact: An app may bypass Gatekeeper checks\n\nDescription: A file quarantine bypass was addressed with additional checks.\n\nCVE-2026-86941: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### CloudKit\n\nAvailable for: macOS Tahoe\n\nImpact: A malicious app may be able to gain root privileges\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-86896: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### ColorSync\n\nImpact: Processing a maliciously crafted file may disclose process memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112429: Mateusz Jurczyk of Google Project Zero\n\n### Compression\n\nImpact: An app may be able to disclose kernel memory\n\nDescription: A memory initialization issue was addressed with improved memory handling.\n\nCVE-2026-113910: Tucker Willenborg\n\n### configd\n\nImpact: An app may be able to gain root privileges\n\nDescription: A parsing issue in the handling of directory paths was addressed with improved path validation.\n\nCVE-2026-112545: Frederick Kaludis (Coiffeur0x90), Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### Control Center\n\nImpact: A malicious application may be able to bypass Privacy preferences\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-112462: DEVADATH V L, Junyeong Lee (jylab.github.io), Weeraphat Srisutham, Yejun Kim, an anonymous researcher, Zwei Tasse Kaffee, Lakshay Sharma (MrW0r57)\n\n### copyfile\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to modify protected parts of the file system\n\nDescription: This issue was addressed with improved handling of symlinks.\n\nCVE-2026-86966: Jihwan Yoon\n\n### Core Image\n\nImpact: Processing a maliciously crafted image may lead to unexpected process termination\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-112471: Meta Red Team X - Nik Tsytsarkin\n\n### CoreAudio\n\nImpact: An app may be able to cause unexpected system termination or corrupt process memory\n\nDescription: A race condition was addressed with improved locking.\n\nCVE-2026-112708: Nathaniel Oh (@calysteon)\n\n### CoreAudio\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds write was addressed with improved input validation.\n\nCVE-2026-86969: Meta Red Team X - Nik Tsytsarkin\n\n### CoreAudio\n\nImpact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n\nCVE-2026-113912: an anonymous researcher, 章鱼哥@aipy (aipyaipy.com), Roman Zabicki, Anna Groza (@pwnlambda) of Calif.io\n\n### CoreAudio\n\nImpact: An app may be able to cause unexpected system termination or corrupt process memory\n\nDescription: A buffer overflow issue was addressed with improved memory handling.\n\nCVE-2026-113907: Meta Red Team X - Nik Tsytsarkin\n\n### CoreAudio\n\nImpact: An attacker in radio range may be able to cause unexpected system termination\n\nDescription: A heap buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-112638: Altin Gashi, Përparim Mjeku, Altin Gashi\n\n### CoreAudio\n\nImpact: Processing a maliciously crafted audio file may lead to memory corruption\n\nDescription: A buffer overflow was addr","summary":"Apple's macOS Tahoe 26.7.2 security release fixes a large batch of flaws across system components, including kernel memory corruption, sandbox escapes, and Gatekeeper bypasses. An attacker who gets a crafted file or a malicious app onto a Mac could run code, escape restrictions, or read protected data.","severity":"high","cvss":3.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"apple ipados","fixed":["18.7.7"],"affected":"< 18.7.7","ecosystem":"vendor"},{"name":"apple ipados","fixed":["26.4"],"affected":">= 26.0, < 26.4","ecosystem":"vendor"},{"name":"apple iphone os","fixed":["18.7.7"],"affected":"< 18.7.7","ecosystem":"vendor"},{"name":"apple iphone os","fixed":["26.4"],"affected":">= 26.0, < 26.4","ecosystem":"vendor"},{"name":"apple macos","fixed":["14.8.5"],"affected":">= 14.0, < 14.8.5","ecosystem":"vendor"},{"name":"apple macos","fixed":["15.7.5"],"affected":">= 15.0, < 15.7.5","ecosystem":"vendor"},{"name":"apple macos","fixed":["26.4"],"affected":">= 26.0, < 26.4","ecosystem":"vendor"},{"name":"apple visionos","fixed":["26.4"],"affected":"< 26.4","ecosystem":"vendor"},{"name":"apple watchos","fixed":["26.4"],"affected":"< 26.4","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apple","macos","macos-tahoe","vendor","vendor-advisory"],"not_affected_if":["already-on-26.7.2"],"how_to_check":"- Check the installed version under Apple menu > About This Mac, or run `sw_vers -productVersion` in Terminal.\n- Compare the result against `26.7.2` or later for macOS Tahoe.","fix":"- macOS Tahoe: update to `26.7.2` or later, per the Apple advisory.","status":"open","published_at":"2026-03-25T01:17:10+00:00","first_seen_at":"2026-11-04T05:22:24+00:00","triaged_at":"2026-11-04T05:23:25+00:00","updated_at":"2026-11-04T05:46:44+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-11-04T05:23:25Z","model":"claude-haiku-5-5","output":{"fix":"- macOS Tahoe: update to `26.7.2` or later, per the Apple advisory.","reach":"local","title":"Apple macOS Tahoe 26.7.2: many kernel and app flaws patched","impact":"high","summary":"Apple's macOS Tahoe 26.7.2 security release fixes a large batch of flaws across system components, including kernel memory corruption, sandbox escapes, and Gatekeeper bypasses. An attacker who gets a crafted file or a malicious app onto a Mac could run code, escape restrictions, or read protected data.","audience":"everyone","category":"vendor","nicknames":[],"who_cares":["macos","apple","macos-tahoe"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Attackers gain root, corrupt kernel memory, or bypass Gatekeeper and privacy controls","analyst_note":"Confirm per-CVE reach and user interaction from the Apple advisory at https://support.apple.com/en-us/149522 and whether any item is exploited in the wild.","how_to_check":"- Check the installed version under Apple menu > About This Mac, or run `sw_vers -productVersion` in Terminal.\n- Compare the result against `26.7.2` or later for macOS Tahoe.","plain_action":"Update your Mac to macOS Tahoe 26.7.2: System Settings > General > Software Update.","needs_analyst":true,"not_affected_if":["already-on-26.7.2"],"who_is_affected":"Any Mac running macOS Tahoe before 26.7.2 is exposed, since the flaws are in core system components rather than optional features. Many of the bugs need a malicious app or a crafted file to trigger, so the risk is highest on machines that open untrusted files or run third-party software.","user_interaction":"unknown","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.001222,"input_tokens":8929,"output_tokens":658,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112416':667C '-112467':497C '-112525':405C '-112536':452C '-112551':284C '-112690':531C '-112696':634C '-113898':253C '-2026':10A,13A,220C,252C,283C,328C,404C,451C,496C,530C,564C,597C,633C,666C '-28864':11A,14A '-84496':329C '-84595':598C '-86920':565C '-86971':221C '2026':186C '26':185C '26.7.2':48B,99C,109C,119C,182C '3p1c':351C,459C 'abl':236C,266C,380C,426C,482C,512C,547C,576C,608C 'acceler':187C 'access':549C 'account':225C 'across':57B 'address':4A,214C,246C,277C,322C,398C,445C,491C,524C,558C,591C,627C,660C 'advisori':43B 'airport':256C 'anh':287C 'anonym':223C,361C,669C 'apf':292C,370C,416C 'app':79B,203C,263C,377C,423C,471C,479C,500C,544C,573C,605C,649C 'appl':35B,44B,100C,121C,128C,154C,158C,176C,540C,568C,600C 'apple':15A,17A,19A,22A,25A,27A,29A,31A,33A 'appleavd':637C 'applic':233C 'aswin':346C,408C 'attack':70B,509C 'author':274C,555C 'avail':147C,189C,226C,257C,293C,371C,417C,473C,502C 'azzouzi':333C 'bar':335C 'batch':54B 'benvenuto':536C 'bhaswanth':254C 'bhetwal':364C 'bhuwan':363C 'bound':210C,217C,318C,325C,395C,401C,441C,448C,587C,594C,623C,630C,656C,663C 'bozzato':533C 'break':514C 'bypass':68B,238C,484C 'calysteon':345C 'caus':305C,382C,428C,578C,610C 'check':8A,218C,326C,402C,449C,494C,595C,631C,664C 'chigurupati':255C 'cisco':538C 'claudio':532C 'code':85B 'compon':59B 'confirm':134C 'content':95C,105C,115C 'corrupt':63B,310C,615C 'could':83B 'craft':74B,197C,301C,642C 'custom':126C 'cve':9A,12A,165C,219C,251C,282C,327C,403C,450C,495C,529C,563C,596C,632C,665C 'cve-id':164C 'data':91B,249C,552C 'dautov':413C,454C 'describ':112C 'descript':205C,241C,272C,313C,390C,436C,487C,520C,553C,582C,618C,651C 'diffract':357C,470C 'disclos':131C 'discuss':132C 'disk':302C 'document':111C,160C 'doesn':129C 'duc':286C 'engin':570C,602C 'escap':65B,86B 'file':75B,644C 'fix':51B 'flaw':56B 'framework':188C 'francesco':535C 'gatekeep':67B 'get':72B 'gokula':410C 'gokulakannan':348C 'guillem':456C 'hkpolyu':354C,467C 'id':166C 'imag':198C,303C 'impact':193C,230C,261C,297C,375C,421C,477C,506C,542C,571C,603C,638C 'improv':6A,216C,248C,279C,324C,400C,447C,493C,526C,560C,593C,629C,662C 'includ':60B 'inform':171C,271C 'input':527C 'intellig':541C 'investig':139C 'ipados':16A,18A 'iphone':20A,23A 'issu':2A,136C,212C,244C,275C,320C,443C,489C,522C,556C,589C,625C,658C 'jaeyeong':635C 'jakob':358C 'jbo':340C 'johan':566C 'jonathan':334C 'kannan':411C 'kernel':61B,311C,388C,434C,616C 'kiyong':366C,461C 'kumar':347C,409C 'kwak':365C,460C 'larg':53B 'lead':200C,646C 'lee':636C 'list':151C 'locat':270C 'log':243C 'mac':82B 'maco':36B,38B,46B,97C,107C,117C,180C,191C,228C,259C,295C,373C,419C,475C,504C 'macos':26A,28A,30A 'macos-taho':37B 'maher':332C 'malici':78B,196C,232C,300C,641C 'malon':415C 'manag':281C,562C 'marco':341C 'may':199C,234C,264C,304C,378C,424C,480C,510C,545C,574C,606C,645C 'memori':62B,312C,389C,435C,617C 'meta':671C 'mount':298C 'muftihaturrahmah':407C 'narendra':349C,457C,677C 'nathaniel':343C 'network':485C 'neural':569C,601C 'nguyen':285C 'nik':675C 'noventiq':289C 'nuri':369C,464C 'occur':141C 'octob':184C 'oh':344C 'onto':80B 'os':21A,24A 'out-of-bound':207C,315C,392C,438C,584C,620C,653C 'page':157C,179C 'pammer':359C 'patch':143C 'permiss':7A 'peter':414C 'possibl':168C 'prefer':240C 'privaci':239C 'process':194C,639C 'product':177C 'protect':90B,127C 'pwnkai23':367C,462C 'read':89B,268C,387C,396C 'recent':148C 'red':672C 'redact':250C 'refer':161C 'releas':50B,145C,149C,156C,183C 'remot':508C 'research':224C,362C,670C 'restrict':87B,486C 'run':84B 'ruslan':412C,453C 'sandbox':64B,519C 'schmitt':342C 'secur':49B,94C,104C,114C,122C,135C,155C,159C,173C,178C 'see':174C 'sensit':269C,550C 'sindr':290C,498C 'singh':350C,458C,678C 'song':368C,463C 'sorhus':291C,499C 'state':280C,561C 'store':472C,501C 'support':101C 'system':58B,307C,384C,430C,580C,612C 'taho':39B,47B,98C,108C,118C,181C,192C,229C,260C,296C,374C,420C,476C,505C 'talo':539C 'tamdao':599C 'team':673C 'termin':204C,308C,385C,431C,581C,613C,650C 'thanato':352C,465C 'thoma':455C 'tian':353C,466C 'tsytsarkin':676C 'unexpect':202C,306C,383C,429C,579C,611C,648C 'updat':123C 'user':551C 'valid':528C 'vendor':40B,42B 'vendor-advisori':41B 'video':643C 'visionos':32A 'vulner':162C 'wahyudi':567C 'watchos':34A 'webcont':518C 'wgg':355C,468C 'write':211C,319C,433C,442C,588C,624C,657C 'x':674C 'yo':337C,338C,339C '이':331C '준우':330C","nicknames":[],"mitigations":[],"who_affected":"Any Mac running macOS Tahoe before 26.7.2 is exposed, since the flaws are in core system components rather than optional features. Many of the bugs need a malicious app or a crafted file to trigger, so the risk is highest on machines that open untrusted files or run third-party software.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update your Mac to macOS Tahoe 26.7.2: System Settings > General > Software Update.","pkeys":["appleipados","appleiphoneos","applemacos","applevisionos","applewatchos","ipados","iphoneos","macos","visionos","watchos"],"ptokens":["apple","ipados","iphone","macos","os","visionos","watchos"],"labels":["apple","high","macos","macostahoe","vendor","vendoradvisory"],"campaign_type":null,"first_public_at":"2026-03-25T01:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"lab","external_id":"https://support.apple.com/en-us/149522#CVE-2026-28864","url":"https://support.apple.com/en-us/149522","severity":null,"published_at":"2026-10-26T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-11-04T05:22:24+00:00","fetched_at":"2026-11-04T05:22:24+00:00","note":"Apple: About the security content of macOS Tahoe 26.7.2 - Apple Support"},{"source":"lab","external_id":"https://support.apple.com/en-us/149523#CVE-2026-28864","url":"https://support.apple.com/en-us/149523","severity":null,"published_at":"2026-10-26T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-11-04T05:22:24+00:00","fetched_at":"2026-11-04T05:22:24+00:00","note":"Apple: About the security content of macOS Sequoia 15.8.2 - Apple Support"},{"source":"nvd","external_id":"CVE-2026-28864","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28864","severity":null,"published_at":"2026-03-25T01:17:10+00:00","modified_at":"2026-10-26T21:18:20+00:00","first_seen_at":"2026-11-04T05:46:44+00:00","fetched_at":"2026-11-04T05:46:44+00:00","note":null}],"documents":[{"id":14117,"url":"https://support.apple.com/en-us/149523","title":"Apple: About the security content of macOS Sequoia 15.8.2 - Apple Support","kind":"advisory","source":"lab","publisher":"vendor","text":"About the security content of macOS Sequoia 15.8.2 - Apple Support\n\n# About the security content of macOS Sequoia 15.8.2\n\nThis document describes the security content of macOS Sequoia 15.8.2.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## macOS Sequoia 15.8.2\n\nReleased October 26, 2026\n\n### Accelerate\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause a denial-of-service\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-28991: Seiji Sakurai (@HeapSmasher)\n\n### Accelerate Framework\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted image may lead to unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-86971: an anonymous researcher\n\n### Accounts\n\nAvailable for: macOS Sequoia\n\nImpact: A malicious application may be able to bypass Privacy preferences\n\nDescription: A logging issue was addressed with improved data redaction.\n\nCVE-2026-113898: Bhaswanth Chigurupati\n\n### afpfs\n\nAvailable for: macOS Sequoia\n\nImpact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-64767: Dave G.\n\n### APFS\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112525: We Muftihaturrahmah, Aswin Kumar Gokula Kannan, Ruslan Dautov, Peter Malone\n\n### APFS\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112536: Ruslan Dautov, Thomas Guillem, Narendra Singh (@_3P1C), Kwak Kiyong (@Pwnkai23), Song Nuri, Thanatos Tian (HKPolyU) & wgg with Diffract\n\n### App Store\n\nAvailable for: macOS Sequoia\n\nImpact: A remote attacker may be able to break out of the WebContent sandbox\n\nDescription: This issue was addressed with improved input validation.\n\nCVE-2026-112690: Claudio Bozzato and Francesco Benvenuto of Cisco Talos\n\n### Apple Intelligence\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-86920: Johan Wahyudi\n\n### Apple Neural Engine\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-84595: tamdao\n\n### Apple Neural Engine\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112696: Jaeyeong Lee\n\n### AppleAVD\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112416: an anonymous researcher, Meta Red Team X - Nik Tsytsarkin, Narendra Singh (@_3P1C), Hcamael and 章鱼哥@aipy (aipyaipy.com), Dohyeon An @PILAB Technology, Inc\n\n### AppleAVD\n\nImpact: An app may be able to cause unexpected system termination or corrupt process memory\n\nDescription: An out-of-bounds write was addressed with improved input validation.\n\nCVE-2026-112415: Rahul Raj, Hcamael and 章鱼哥@aipy (aipyaipy.com)\n\n### AppleAVD\n\nImpact: A malicious app may be able to break out of its sandbox\n\nDescription: An information leakage was addressed with additional validation.\n\nCVE-2026-112704: Josh Maine of Calif.io\n\n### AppleMobileFileIntegrity\n\nImpact: A malicious app may be able to read or write to protected files\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-112539: Claudio Bozzato and Francesco Benvenuto of Cisco Talos\n\n### AppleRAID\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-112531: Chanwit Muenprakoddee (ChemIndy)\n\n### ArchiveService\n\nImpact: An app may bypass Gatekeeper checks\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-86937: YingMuo (@YingMuo) of DEVCORE Research Team, Paul Montgomery (@nullevent)\n\n### ArchiveService\n\nImpact: Processing a maliciously crafted file may bypass Gatekeeper checks\n\nDescription: A logic issue was addressed with improved checks.\n\nCVE-2026-112568: an anonymous researcher\n\n### Audio\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112546: lunar815, Nathaniel Oh (@calysteon), Piotr Jerzy Duszynski, an anonymous researcher, Surej Sekhar, r3pwnx (@r3pwnx), Lily Cohl (@GenericCoding)\n\n### Audio\n\nImpact: An app may be able to access sensitive user data\n\nDescription: This issue was addressed with additional entitlement checks.\n\nCVE-2026-112675: Lakshay Sharma (MrW0r57), Abodi Dawoud\n\n### AVEVideoEncoder\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112705: Marco Schmitt, Andrey Chernykh, Josh Maine of Calif.io\n\n### AVEVideoEncoder\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved input validation.\n\nCVE-2026-112689: Franco Belman at Blackwing Intelligence\n\n### AVEVideoEncoder\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112470: Hcamael and 章鱼哥@aipy (aipyaipy.com)\n\nCVE-2026-112468: Hcamael and 章鱼哥@aipy (aipyaipy.com)\n\nCVE-2026-112469: Hcamael and 章鱼哥@aipy (aipyaipy.com)\n\n### AVEVideoEncoder\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\nCVE-2026-112466: Hcamael and 章鱼哥@aipy (aipyaipy.com)\n\n### BOM\n\nImpact: A maliciously crafted ZIP archive may bypass Gatekeeper checks\n\nDescription: A file quarantine bypass was addressed with additional checks.\n\nCVE-2026-84610: Murray Mike, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### BOM\n\nImpact: Processing a maliciously crafted file may lead to heap corruption\n\nDescription: An out-of-bounds write issue was addressed with improved input validation.\n\nCVE-2026-112670: Bhaswanth Chigurupati\n\n### BOM\n\nImpact: A maliciously crafted ZIP archive may bypass Gatekeeper checks\n\nDescription: The issue was addressed with improved checks.\n\nCVE-2026-112672: 준우 이, Pasquale Scola\n\n### Calendar\n\nImpact: An app may be able to access sensitive user data\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-112678: Neon, Niels Hofmans, Mustafa Calap (@ordinal0, dbg.re)\n\n### Carbon Core\n\nImpact: An app may be able to access sensitive user data\n\nDescription: A logging issue was addressed with improved data redaction.\n\nCVE-2026-84528: zenith\n\n### Carbon Core\n\nAvailable for: macOS Sequoia\n\nImpact: An app may bypass Gatekeeper checks\n\nDescription: A file quarantine bypass was addressed with additional checks.\n\nCVE-2026-86941: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### CloudKit\n\nAvailable for: macOS Sequoia\n\nImpact: A malicious app may be able to gain root privileges\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-86896: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### ColorSync\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted file may disclose process memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112429: Mateusz Jurczyk of Google Project Zero\n\n### Compression\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to disclose kernel memory\n\nDescription: A memory initialization issue was addressed with improved memory handling.\n\nCVE-2026-113910: Tucker Willenborg\n\n### configd\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to gain root privileges\n\nDescription: A parsing issue in the handling of directory paths was addressed with improved path validation.\n\nCVE-2026-112545: Frederick Kaludis (Coiffeur0x90), Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### Control Center\n\nImpact: A malicious application may be able to bypass Privacy preferences\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-112462: DEVADATH V L, Junyeong Lee (jylab.github.io), Weeraphat Srisutham, Yejun Kim, an anonymous researcher, Zwei Tasse Kaffee, Lakshay Sharma (MrW0r57)\n\n### copyfile\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to modify protected parts of the file system\n\nDescription: This issue was addressed with improved handling of symlinks.\n\nCVE-2026-86966: Jihwan Yoon\n\n### Core Image\n\nImpact: Processing a maliciously crafted image may lead to unexpected process termination\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-112471: Meta Red Team X - Nik Tsytsarkin\n\n### CoreAudio\n\nImpact: An app may be able to cause unexpected system termination or corrupt process memory\n\nDescription: A race condition was addressed with improved locking.\n\nCVE-2026-112708: Nathaniel Oh (@calysteon)\n\n### CoreAudio\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds write was addressed with improved input validation.\n\nCVE-2026-86969: Meta Red Team X - Nik Tsytsarkin\n\n### CoreAudio\n\nImpact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n\nDescription: An out-of-bounds access issue was addressed with improved bounds checking.\n\nCVE-2026-113912: an anonymous researcher, 章鱼哥@aipy (aipyaipy.com), Roman Zabicki, Anna Groza (@pwnlambda) of Calif.io\n\n### CoreAudio\n\nImpact: An app may be able to cause unexpected system termination or corrupt process memory\n\nDescription: A buffer overflow issue was addressed with improved memory handling.\n\nCVE-2026-113907: Meta Red Team X - Nik Tsytsarkin\n\n### CoreAudio\n\nImpact: An attacker in radio range may be able to cause unexpected system termination\n\nDescription: A heap buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-112638: Altin Gashi, Përparim Mjeku, Altin Gashi\n\n### CoreGraphics\n\nImpact: Processing a maliciously crafted PDF file may lead to memory corruption\n\nCVE-2026-112610: Meta Red Team X - Nik Tsytsarkin\n\nCVE-2026-112611: f4&Zhiniang Peng with HUST, Aobo Wang (@M4x_1997), Xiang Chen, Jakob Pammer, Anna Groza (@pwnlambda) of Calif.io, Piotr Jerzy Duszynski, an anonymous researcher\n\n### CoreMedia\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-86992: Niels Hofmans\n\n### CoreMedia\n\nImpact: Parsing a file may lead to an unexpected app termination or arbitrary code execution\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2026-112688: 정우 하 (@0xfa11babe), Chris Bailey - Short Circuit\n\n### CoreServicesUIAgent\n\nImpact: A maliciously crafted disk image may bypass Gatekeeper checks\n\nCVE-2026-65368: an anonymous researcher\n\n### CoreText\n\nImpact: Processing a maliciously crafted font may result in the disclosure of process memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112656: Nurihan Kim (HanTul) working with TrendAI Zero Day Initiative\n\n### CUPS\n\nImpact: An app with App Sandbox restrictions may be able to escape the sandbox and execute code with root privileges\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-84545: Jurre van Bergen - Threatnotify, Mathis Mansière, 章鱼哥@aipy (aipyaipy.com）, Redon Gashi (Sentry)\n\n### CUPS\n\nImpact: A local attacker may be able to elevate their privileges\n\nCVE-2026-65327: Sanny Mitra\n\n### CVMS\n\nImpact: An app may be able to gain root privileges\n\nCVE-2026-112530: Alfredo Pesoli (@__rev) of Bynar.io, Claudio Bozzato and Francesco Benvenuto of Cisco Talos\n\n### DesktopServices\n\nImpact: An app may bypass Gatekeeper checks\n\nCVE-2026-112428: Koh M. Nakagawa (@tsunek0h) of FFRI Security, Inc., Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### Directory Utility\n\nImpact: An app may be able to modify protected parts of the file system\n\nCVE-2026-112483: Csaba Fitzl (@theevilbit) of Iru, Lyutoon\n\n### Disk Images\n\nImpact: An app may be able to cause a denial-of-service\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-112502: Narendra Singh (@_3P1C)\n\n### DiskArbitration\n\nImpact: An app may be able to break out of its sandbox\n\nCVE-2026-112570: Andrey Chernykh (BypassLabs.ai), Keisuke Hosoda\n\n### dyld\n\nImpact: An attacker with memory write capability may be able to bypass pointer authentication codes and run arbitrary code\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-86958: oxsignal\n\n### dyld\n\nImpact: An app may be able to bypass sandbox restrictions\n\nCVE-2026-112534: an anonymous researcher\n\n### FileProvider\n\nCVE-2026-113896: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, R4mbb\n\n### FontParser\n\nImpact: Processing a maliciously crafted font may result in the disclosure of process memory\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\nCVE-2026-86970: Hcamael and 章鱼哥@aipy (aipyaipy.com)\n\n### FontParser\n\nImpact: Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112683: Hcamael and 章鱼哥@aipy (aipyaipy.com)\n\n### FontParser\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted font may result in the disclosure of process memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112642: Meta Red Team X - Nik Tsytsarkin\n\n### Game Center\n\nAvailable for: macOS Sequoia\n\nImpact: A user may be able to view sensitive user information\n\nDescription: A logging issue was addressed with improved data redaction.\n\nCVE-2026-20649: Asaf Cohen\n\n### GPU Drivers\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112593: f00l (@PPPF00L) and 3ndy1(@_3ndy1)\n\n### Grapher\n\nImpact: Processing a maliciously crafted file may lead to arbitrary code execution\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-86929: Anand (anandsreekumar.com)\n\n### Heimdal\n\nImpact: A remote attacker may cause an unexpected process termination\n\nDescription: A double free issue was addressed with improved memory management.\n\nCVE-2026-112410: Piotr Jerzy Duszynski\n\n### Heimdal\n\nImpact: An app may be able to cause a denial-of-service\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-86942: He Wei (ギカク)\n\n### Help Viewer\n\nImpact: An app may be able to access user-sensitive data\n\nDescription: This issue was addressed with improved handling of symlinks.\n\nCVE-2026-112523: powerprove, Michael Benich, Niels Hofmans, Christian Niel Angel of Protectiv IT Security Inc. (protectiv.ph), Lyutoon, Seung Je Seong, R4mbb, Wojciech Regula of SecuRing (wojciechregula.blog)\n\n### HFS\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112424: Peter Malone\n\n### HFS\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112475: Aswin Kumar Gokulakannan, Minseok Kim, Dave G., Thanatos Tian (HKPolyU) & wgg & xmr, Marco Schmitt\n\n### HFS\n\nImpact: Processing a maliciously crafted file may lead to heap corruption\n\nCVE-2026-112456: Jihwan Yoon, Yash Pandya, Parth Raval\n\n### iCloud\n\nCVE-2026-112647: Sattyam Yadav, onetwo, Christian Niel Angel of Protectiv IT Security Inc. (protectiv.ph), Robert Tran, Merrick Hare\n\n### ImageIO\n\nCVE-2026-64750: Mateusz Jurczyk of Google Project Zero, Eddy Tsalolikhin, Johann Rehberger\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may result in disclosure of process memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112561: Meta Red Team X - Nik Tsytsarkin\n\nCVE-2026-112560: Wout van der Ploeg (woutvanderploeg.nl)\n\nCVE-2026-112627: Mateusz Jurczyk of Google Project Zero\n\n### ImageIO\n\nCVE-2026-112571: sh3rlock (김보겸)\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may lead to unexpected app termination\n\nCVE-2026-86954: Mateusz Jurczyk of Google Project Zero\n\nCVE-2026-112629: Mateusz Jurczyk of Google Project Zero\n\nCVE-2026-112634: Mateusz Jurczyk of Google Project Zero\n\n### ImageIO\n\nDescription: An uninitialized memory issue was addressed with improved memory handling.\n\nCVE-2026-112632: Mateusz Jurczyk of Google Project Zero\n\nCVE-2026-112630: Mateusz Jurczyk of Google Project Zero\n\n### ImageIO\n\nCVE-2026-112625: Mateusz Jurczyk of Google Project Zero\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may lead to unexpected app termination\n\nCVE-2026-112633: Mateusz Jurczyk of Google Project Zero\n\n### IOGPUFamily\n\nCVE-2026-112533: Andrey Chernykh, Sihyun Roh (Compsec, SNU)\n\n### IOHIDFamily\n\nImpact: An attacker may be able to cause unexpected system termination or read kernel memory\n\nCVE-2026-112515: Charles Stevenson, Mathis Mansière, Seung Je Seong\n\n### IOStorageFamily\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112554: Bhuwan Bhetwal, Kwak Kiyong (@Pwnkai23), Song Nuri, Nicolas Seriot, Tommy DeVoss from Braze Security Team (@thedawgyg), Tucker Willenborg, Navapon Premkasem, Aswin Kumar Gokulakannan, Peter Malone, Richard Zana\n\n### IOSurface\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A race condition was addressed with improved locking.\n\nCVE-2026-112477: an anonymous researcher\n\n### Kernel\n\nImpact: An app may be able to cause unexpected changes to copy-on-write memory\n\nDescription: A memory integrity issue was addressed with improved handling of copy-on-write pages.\n\nCVE-2026-112576: Pedro Pinho\n\n### Kernel\n\nImpact: An app may be able to gain root privileges\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-113900: Frederick Kaludis (Coiffeur0x90), YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab, Lakshay Sharma (MrW0r57)/WorstCase Labs., Ashish Kavishwar, Csaba Fitzl (@theevilbit) of Iru and Gergely Kalman (@gergely_kalman)\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A type confusion issue was addressed with improved memory handling.\n\nCVE-2026-112606: Wang Yu\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-112532: Peter Malone\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-112517: Pasquale Scola, Cem Onat Karagun, Wout van der Ploeg (woutvanderploeg.nl), John Lussier, an anonymous researcher\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-112516: an anonymous researcher, greenbynox\n\n### Kernel\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-112698: OpenAI, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nAvailable for: macOS Sequoia\n\nImpact: An attacker may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-112514: Marc Newlin of SkySafe, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., greenbynox\n\n### Kernel\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-84495: Wang Yu\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-65350: Xinru Chi of Pangu Lab, Nebula Security (@nebusecurity), Tim Michaud (@TimGMichaud) of Aginor.ai\n\n### Kernel\n\nImpact: A malicious app may be able to break out of its sandbox\n\nDescription: A race condition was addressed with additional validation.\n\nCVE-2026-112543: f0r of MurphySec\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112476: Arnold Cartagena, Matt Suiche (@msuiche) of Tolmo\n\n### Kernel\n\nImpact: An unprivileged attacker may be able to execute arbitrary code as root\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-112438: Jakob Pammer\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-112501: Cem Onat Karagun\n\n### Kernel\n\nImpact: An app may be able to bypass Privacy preferences\n\nCVE-2026-112624: Jerry L. Knot\n\n### libarchive\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nCVE-2026-112522: Eliya M., Viacheslav Radiukov, Tristan Madani (Talence Security), Robert Tran\n\n### libcryptex\n\nImpact: A malicious app may be able to create files in protected directories\n\nCVE-2026-86945: an anonymous researcher, Andrey Chernykh\n\n### libxpc\n\nImpact: An app may be able to break out of its sandbox\n\nCVE-2026-112497: Claudio Bozzato and Francesco Benvenuto of Cisco Talos\n\n### Mail\n\nImpact: A remote attacker may be able to cause a denial-of-service\n\nCVE-2026-112671: Nathaniel Oh (@calysteon)\n\n### Mail\n\nImpact: Processing a maliciously crafted message may lead to a denial-of-service\n\nDescription: A stack overflow was addressed with improved input validation.\n\nCVE-2026-112414: Daniel Rodríguez, Nathaniel Oh (@calysteon)\n\n### MediaAnalysis\n\nCVE-2026-113915: Abodi Dawoud, Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Ilya Andr (andrd3v) of Positive Technologies, Zhongquan Li (@Guluisacat)\n\n### Metal\n\nImpact: An app may be able to read files outside of its sandbox\n\nCVE-2026-84542: Mustafa Ahmed, an anonymous researcher\n\n### Model I/O\n\nImpact: Processing a maliciously crafted 3D model may lead to memory corruption\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-112565: Musaab Khan (@bxff), Hcamael and 章鱼哥@aipy (aipyaipy.com), Saoud Khalifah, stratan (@5tratan), Niels Hofmans\n\nCVE-2026-112449: ret2happy (@ret2happy)\n\n### Model I/O\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nCVE-2026-112563: stratan (@5tratan)\n\nCVE-2026-112553: stratan (@5tratan)\n\n### Model I/O\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112413: Nathaniel Oh (@calysteon)\n\n### Model I/O\n\nImpact: Processing a maliciously crafted 3D model may lead to memory corruption\n\nCVE-2026-112461: 진규정 (Gyujeong Jin, @G1uN4sh), Lucas Parnell, Nathaniel Oh (@calysteon), Meta Red Team X - Nik Tsytsarkin, YingMuo (@YingMuo) of DEVCORE Research Team, ret2happy (@ret2happy)\n\n### Model I/O\n\nImpact: Processing a maliciously crafted 3D model may lead to memory corruption\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-112485: Nik Tsytsarkin\n\n### Model I/O\n\nImpact: Processing a 3D model may lead to unexpected app termination\n\nCVE-2026-112486: Md Rasel Bhuyan (www.linkedin.com/in/rasel-bhuyan), Musaab Khan (@bxff)\n\n### ncurses\n\nImpact: An app may be able to cause a denial-of-service\n\nDescription: A type confusion issue was addressed with improved memory handling.\n\nCVE-2026-112550: Jonathan Bar Or (@yo_yo_yo_jbo)\n\n### OpenBSM\n\nImpact: Processing a maliciously crafted audit file may corrupt process memory\n\nDescription: A stack buffer overflow was addressed through improved input validation.\n\nCVE-2026-84604: Tristan Madani (Talence Security)\n\n### PackageKit\n\nImpact: An app may be able to modify protected parts of the file system\n\nDescription: A race condition was addressed with improved handling of symbolic links.\n\nCVE-2026-112421: Csaba Fitzl (@theevilbit) of Iru and Gergely Kalman (@gergely_kalman)\n\n### PackageKit\n\nImpact: An app may be able to modify protected parts of the file system\n\nCVE-2026-112442: Mickey Jin (@patch1t)\n\n### Photos Storage\n\nCVE-2026-65397: Varik Matevosyan (@D4RK7ET), an anonymous researcher\n\n### Photos Storage\n\nImpact: An app may be able to bypass certain Privacy preferences\n\nCVE-2026-112660: Prafull Dhiman, Alto_00000\n\n### Photos Storage\n\nCVE-2026-112676: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova\n\n### ppp\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: The issue was addressed with improved checks.\n\nCVE-2026-113899: Siddharth Aeri\n\n### ppp\n\nAvailable for: macOS Sequoia\n\nImpact: A malicious app may be able to intercept network traffic\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-112542: Gabriel '0xv1n' Cardona, Mrunal Chawda, Kujtim Kryeziu (Sentry), Tristan Madani (Talence Security)\n\n### Printing\n\nAvailable for: macOS Sequoia\n\nImpact: A malicious app may be able to break out of its sandbox\n\nDescription: A parsing issue in the handling of directory paths was addressed with improved path validation.\n\nCVE-2026-112562: 도현 김, Ithrael, YEONGJAE SHIN, an anonymous researcher\n\n### quarantine\n\nAvailable for: macOS Sequoia\n\nImpact: A malicious application may bypass Gatekeeper checks\n\nDescription: This issue was addressed with improved validation of file attributes.\n\nCVE-2026-64789: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs (nosebeard.co), an anonymous researcher\n\n### quarantine\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to break out of its sandbox\n\nDescription: An access issue was addressed with additional sandbox restrictions.\n\nCVE-2026-112569: Csaba Fitzl (@theevilbit) of Iru, an anonymous researcher\n\nCVE-2026-112498: an anonymous researcher\n\n### RealityKit\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112491: Hongsik Kim (mnur)\n\n### Remote Management\n\nImpact: An attacker on the local network may be able to cause unexpected system termination or corrupt process memory\n\nDescription: A double free issue was addressed with improved memory management.\n\nCVE-2026-112457: Efstratios Kaplanellis (@5tratan) of Almamater Technologies, Nathaniel Oh (@calysteon)\n\n### Remote Management\n\nImpact: A user with screen sharing access may be able to view another user's screen\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-112480: Andrey Chernykh, ruitong (@abstract)\n\n### RemoteManagement\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: An authorization issue was addressed with improved access control.\n\nCVE-2026-112677: an anonymous researcher, Niels Hofmans, 도현 김, Junyeong Lee (jylab.github.io), Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs, Jonghoon Han (Aegis)\n\n### Sandbox\n\nImpact: An app with root privileges may be able to access private information\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-65392: Ahmad Al Harrizuan Izadin, Prathamesh Walunj, Csaba Fitzl (@theevilbit) of Iru\n\n### SceneKit\n\nImpact: Processing a 3D model may result in disclosure of process memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112425: stratan (@5tratan)\n\n### SceneKit\n\nImpact: Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112423: Rahul Raj\n\n### SceneKit\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-112540: f4&Zhiniang Peng with HUST, Geonha Lee (@leegn4a), Kwak Kiyong (@Pwnkai23), Song Nuri, Wout van der Ploeg (woutvanderploeg.nl), Substrate, Piotr Jerzy Duszynski, Tristan Madani (Talence Security), Arni Hardarson (Neonix Security), an anonymous researcher\n\n### SceneKit\n\nImpact: Processing a maliciously crafted file may lead to heap corruption\n\nCVE-2026-112464: 정우 하 (@0xfa11babe), Narendra Singh (@_3P1C)\n\n### SceneKit\n\nImpact: Processing a maliciously crafted file may lead to unexpected process termination\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-86991: Cem Onat Karagun, Yujung Choi (@Dusker), Mathis Mansière, Rahul Raj\n\n### Screen Sharing\n\nImpact: Connecting to a malicious VNC server may cause a denial-of-service\n\nCVE-2026-112519: Piotr Jerzy Duszynski, Nathaniel Oh (@calysteon)\n\n### Screen Sharing Server\n\nImpact: A malicious app may be able to gain root privileges\n\nCVE-2026-65373: Stefan Esser (Calif), Alfredo Pesoli (@__rev) via Bynario Atlas (bynar.io), Anon Tuttu Venus, Nathaniel Oh (@calysteon)\n\n### Screen Sharing Server\n\nImpact: An attacker with the legacy VNC password for Screen Sharing may be able to copy files to the Mac\n\nCVE-2026-112473: Alfredo Pesoli (@__rev) via Bynario Atlas (bynar.io)\n\n### Screen Sharing Server\n\nImpact: An attacker on the local network may be able to corrupt process memory\n\nCVE-2026-112482: Nathaniel Oh (@calysteon)\n\n### Screen Sharing Server\n\nImpact: A malicious Screen Sharing peer may be able to create arbitrary symlinks as root\n\nCVE-2026-112511: Nathaniel Oh (@calysteon)\n\n### Screen Sharing Server\n\nImpact: A malicious application may be able to execute arbitrary code with system privileges\n\nCVE-2026-112484: Mahmoud Abdelmoniem\n\n### Screen Sharing Server\n\nImpact: A remote attacker may be able to cause unexpected app termination or heap corruption\n\nCVE-2026-84590: Nathaniel Oh (@calysteon), Narendra Singh (@_3P1C), koocolb, Tristan Madani (Talence Security)\n\n### Screen Sharing Server\n\nImpact: An attacker on the local network may be able to cause unexpected process termination or disclose process memory\n\nCVE-2026-112481: Nathaniel Oh (@calysteon)\n\n### Security\n\nCVE-2026-113913: Niels Hofmans, Stav Nir and Vladimir Tokarev\n\n### Security\n\nImpact: An app may be able to break out of its sandbox\n\nCVE-2026-65363: Arni Hardarson (Neonix Security), Csaba Fitzl (@theevilbit) of Iru and Gergely Kalman (@gergely_kalman)\n\n### Security\n\nCVE-2026-86931: Pranav Gopalkrishnan, Alan Wang, Ailsa Sun, Hovav Shacham, Riccardo Paccagnella, Chris Fletcher, David Kohlbrenner\n\n### Security\n\nImpact: A sandboxed process may be able to circumvent sandbox restrictions\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-112521: Richard Hyunho Im (@richeeta) at Route Zero Security, Efstratios Kaplanellis (@5tratan) of Almamater Technologies\n\n### Security\n\nImpact: A local attacker may gain access to user's Keychain items\n\nCVE-2026-28864: Alex Radocea\n\n### Security\n\nImpact: An app may be able to gain root privileges\n\nDescription: A logic issue was addressed with improved checks.\n\nCVE-2026-112668: cnitlrt (@abstract), Roman Belovitskiy, Lyutoon, Art Pllana, Redon Gashi of Sentry, ruitong (@abstract), Franco Belman at Blackwing Intelligence, Surej Sekhar, Sihyun Roh (Compsec, SNU), lokerxx, Teodor Sorescu (@teodorsorescu), Eddy Tsalolikhin, Phillip Groves\n\nCVE-2026-86936: cnitlrt (@abstract), lokerxx\n\nCVE-2026-112437: lokerxx\n\nCVE-2026-112434: ruitong (@abstract), lokerxx\n\n### Security\n\nAvailable for: macOS Sequoia\n\nImpact: An malicious app may be able to bypass certificate validation\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-112652: Aditya Kumar\n\n### Security\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to gain root privileges\n\nDescription: An authentication issue was addressed with improved validation of user attributes.\n\nCVE-2026-112430: ruitong (@abstract)\n\n### SecurityAgent\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to gain root privileges\n\nDescription: A downgrade issue was addressed with additional version checks.\n\nCVE-2026-112493: Mickey Jin (@patch1t)\n\n### Shortcuts\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-112559: Lucas Lammer, Stuart Wallace\n\nCVE-2026-112455: Rahul Raj, Chris Bailey - Short Circuit\n\n### Shortcuts\n\nImpact: An app may be able to cause a denial-of-service\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-112601: 진규정 (Gyujeong Jin, @G1uN4sh)\n\n### Siri\n\nImpact: An app may be able to access information about a user's contacts\n\nDescription: A file access issue existed with certain home folder files. This was addressed with improved access restrictions.\n\nCVE-2026-86984: Albin Haliti\n\n### Siri\n\nImpact: An app may be able to access sensitive user data\n\nCVE-2026-86923: Sindre Sorhus, Asaf Cohen\n\n### Siri\n\nImpact: A malicious app may be able to access notifications from other iCloud devices\n\nDescription: A privacy issue was addressed by moving sensitive data to a protected location.\n\nCVE-2026-20648: Morris Richman (@morrisinlife)\n\n### SMB\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-86946: Jakob Pammer\n\n### SMB\n\nImpact: An attacker with control of a network file server may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112552: Bhuwan Bhetwal, Feng Xue and XGPT of ThreatBook, Claudio Bozzato and Francesco Benvenuto of Cisco Talos\n\n### smbx\n\nImpact: A remote attacker may be able to cause unexpected app termination\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-112526: Nathaniel Oh (@calysteon), Narendra Singh (@_3P1C), Tristan Madani (@TristanInSec) from Talence Security, an anonymous researcher\n\n### smbx\n\nImpact: A remote attacker may be able to cause a denial-of-service or disclose process memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112451: Nathaniel Oh (@calysteon)\n\n### smbx\n\nImpact: A remote attacker may be able to cause a denial-of-service\n\nCVE-2026-112510: Efstratios Kaplanellis (@5tratan) of Almamater Technologies, Andrey Chernykh\n\n### smbx\n\nImpact: A malicious Screen Sharing peer may be able to corrupt process memory\n\nCVE-2026-112505: an anonymous researcher, Narendra Singh (@_3P1C), Andrey Chernykh\n\n### SoftRAID\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nCVE-2026-112495: Lyutoon\n\n### Spotlight\n\nImpact: A malicious application may be able to bypass Privacy preferences\n\nCVE-2026-112567: zenith\n\n### Spotlight\n\nCVE-2026-112558: D4rthL\n\n### Spotlight\n\nImpact: A malicious application may be able to bypass Privacy preferences\n\nCVE-2026-112557: D4rthL\n\n### Spotlight\n\nCVE-2026-112628: Santiago Albertengo, Chris Bailey - Short Circuit\n\n### Spotlight\n\nCVE-2026-112441: Pan ZhenPeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Storage\n\nImpact: An app may be able to gain root privileges\n\nCVE-2026-112487: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab, Junyeong Lee (jylab.github.io), Gergely Kalman (@gergely_kalman), Lyutoon, Jaeyeong Lee, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### StorageKit\n\nImpact: An app may be able to gain root privileges\n\nDescription: A parsing issue in the handling of directory paths was addressed with improved path validation.\n\nCVE-2026-112541: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs (nosebeard.co), Maher Azzouzi, Sindre Sorhus, Paul Montgomery (@nullevent), Mickey Jin (@patch1t), Frederick Kaludis (Coiffeur0x90)\n\n### StorageKit\n\nImpact: An app may be able to modify protected parts of the file system\n\nDescription: A race condition was addressed with improved handling of symbolic links.\n\nCVE-2026-112535: Sindre Sorhus\n\n### StorageKit\n\nImpact: An app may be able to modify protected parts of the file system\n\nDescription: A parsing issue in the handling of directory paths was addressed with improved path validation.\n\nCVE-2026-112504: Mickey Jin (@patch1t)\n\n### StorageKit\n\nImpact: An app may be able to gain root privileges\n\nCVE-2026-112492: Alfredo Pesoli (@__rev) via Bynario Atlas (bynar.io)\n\n### StorageKit\n\nImpact: An app may be able to gain root privileges\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-112548: Surej Sekhar\n\n### System Settings\n\nImpact: An attacker may tamper with code-signed applications to execute arbitrary code in the application's context\n\nCVE-2026-112556: Paul Montgomery (@nullevent), Mickey Jin (@patch1t)\n\n### System Settings\n\nImpact: An app may be able to break out of its sandbox\n\nCVE-2026-112453: Sindre Sorhus\n\n### System Settings\n\nImpact: An app may be able to bypass Gatekeeper checks\n\nCVE-2026-112512: Mufeed VH of Winfunc Research (winfunc.com), YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab, Mathis Mansière\n\n### Time Machine\n\nImpact: An app may be able to bypass Privacy preferences\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-112447: 云开 江, Joshua Maina, Ithrael, Mahmoud Gamal (@Zombiehelp54)\n\n### udf\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to disclose kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-84498: Nathaniel Oh (@calysteon)\n\n### udf\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112529: Nathaniel Oh (@calysteon)\n\n### udf\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-112524: Thanatos Tian (HKPolyU) & wgg & 2st with Diffract, Peter Malone, Tim Michaud (@TimGMichaud) o","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":14116,"url":"https://support.apple.com/en-us/149522","title":"Apple: About the security content of macOS Tahoe 26.7.2 - Apple Support","kind":"advisory","source":"lab","publisher":"vendor","text":"About the security content of macOS Tahoe 26.7.2 - Apple Support\n\n# About the security content of macOS Tahoe 26.7.2\n\nThis document describes the security content of macOS Tahoe 26.7.2.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## macOS Tahoe 26.7.2\n\nReleased October 26, 2026\n\n### Accelerate Framework\n\nAvailable for: macOS Tahoe\n\nImpact: Processing a maliciously crafted image may lead to unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-86971: an anonymous researcher\n\n### Accounts\n\nAvailable for: macOS Tahoe\n\nImpact: A malicious application may be able to bypass Privacy preferences\n\nDescription: A logging issue was addressed with improved data redaction.\n\nCVE-2026-113898: Bhaswanth Chigurupati\n\n### AirPort\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to read sensitive location information\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-112551: Nguyen Duc Anh of Noventiq, Sindre Sorhus\n\n### APFS\n\nAvailable for: macOS Tahoe\n\nImpact: Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-84496: 준우 이, Maher Azzouzi, Jonathan Bar Or (@yo_yo_yo_jbo), Marco Schmitt, Nathaniel Oh (@calysteon), Aswin Kumar Gokulakannan, Narendra Singh (@_3P1C), Thanatos Tian (HKPolyU) & wgg with Diffract, Jakob Pammer, an anonymous researcher, Bhuwan Bhetwal, Kwak kiyong (@Pwnkai23) , Song nuri\n\n### APFS\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112525: We Muftihaturrahmah, Aswin Kumar Gokula Kannan, Ruslan Dautov, Peter Malone\n\n### APFS\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112536: Ruslan Dautov, Thomas Guillem, Narendra Singh (@_3P1C), Kwak Kiyong (@Pwnkai23), Song Nuri, Thanatos Tian (HKPolyU) & wgg with Diffract\n\n### App Store\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to bypass network restrictions\n\nDescription: This issue was addressed with improved checks.\n\nCVE-2026-112467: Sindre Sorhus\n\n### App Store\n\nAvailable for: macOS Tahoe\n\nImpact: A remote attacker may be able to break out of the WebContent sandbox\n\nDescription: This issue was addressed with improved input validation.\n\nCVE-2026-112690: Claudio Bozzato and Francesco Benvenuto of Cisco Talos\n\n### Apple Intelligence\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-86920: Johan Wahyudi\n\n### Apple Neural Engine\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-84595: tamdao\n\n### Apple Neural Engine\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112696: Jaeyeong Lee\n\n### AppleAVD\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112416: an anonymous researcher, Meta Red Team X - Nik Tsytsarkin, Narendra Singh (@_3P1C), Hcamael and 章鱼哥@aipy (aipyaipy.com), Dohyeon An @PILAB Technology, Inc\n\n### AppleAVD\n\nImpact: An app may be able to cause unexpected system termination or corrupt process memory\n\nDescription: An out-of-bounds write was addressed with improved input validation.\n\nCVE-2026-112415: Rahul Raj, Hcamael and 章鱼哥@aipy (aipyaipy.com)\n\n### AppleAVD\n\nImpact: A malicious app may be able to break out of its sandbox\n\nDescription: An information leakage was addressed with additional validation.\n\nCVE-2026-112704: Josh Maine of Calif.io\n\n### AppleMobileFileIntegrity\n\nImpact: A malicious app may be able to read or write to protected files\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-112539: Claudio Bozzato and Francesco Benvenuto of Cisco Talos\n\n### AppleRAID\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-112531: Chanwit Muenprakoddee (ChemIndy)\n\n### Archive Utility\n\nImpact: An attacker with root privileges may be able to access protected user data\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-86939: Lance Cain - Senior Security Researcher at SpecterOps Inc.\n\n### ArchiveService\n\nImpact: An app may bypass Gatekeeper checks\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-86937: YingMuo (@YingMuo) of DEVCORE Research Team, Paul Montgomery (@nullevent)\n\n### ArchiveService\n\nImpact: Processing a maliciously crafted file may bypass Gatekeeper checks\n\nDescription: A logic issue was addressed with improved checks.\n\nCVE-2026-112568: an anonymous researcher\n\n### Audio\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112546: lunar815, Nathaniel Oh (@calysteon), Piotr Jerzy Duszynski, an anonymous researcher, Surej Sekhar, r3pwnx (@r3pwnx), Lily Cohl (@GenericCoding)\n\n### Audio\n\nImpact: An app may be able to access sensitive user data\n\nDescription: This issue was addressed with additional entitlement checks.\n\nCVE-2026-112675: Lakshay Sharma (MrW0r57), Abodi Dawoud\n\n### AVEVideoEncoder\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112705: Marco Schmitt, Andrey Chernykh, Josh Maine of Calif.io\n\n### AVEVideoEncoder\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved input validation.\n\nCVE-2026-112689: Franco Belman at Blackwing Intelligence\n\n### AVEVideoEncoder\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112470: Hcamael and 章鱼哥@aipy (aipyaipy.com)\n\nCVE-2026-112468: Hcamael and 章鱼哥@aipy (aipyaipy.com)\n\nCVE-2026-112469: Hcamael and 章鱼哥@aipy (aipyaipy.com)\n\n### AVEVideoEncoder\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\nCVE-2026-112466: Hcamael and 章鱼哥@aipy (aipyaipy.com)\n\n### Bluetooth\n\nImpact: An attacker in physical proximity may be able to cause a denial-of-service\n\nDescription: A null pointer dereference was addressed with improved validation.\n\nCVE-2026-112566: Chris Bailey - Short Circuit\n\n### BOM\n\nImpact: A maliciously crafted ZIP archive may bypass Gatekeeper checks\n\nDescription: A file quarantine bypass was addressed with additional checks.\n\nCVE-2026-84610: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs, Murray Mike\n\n### BOM\n\nImpact: Processing a maliciously crafted file may lead to heap corruption\n\nDescription: An out-of-bounds write issue was addressed with improved input validation.\n\nCVE-2026-112670: Bhaswanth Chigurupati\n\n### BOM\n\nAvailable for: macOS Tahoe\n\nImpact: A maliciously crafted ZIP archive may bypass Gatekeeper checks\n\nDescription: The issue was addressed with improved checks.\n\nCVE-2026-112672: 준우 이, Pasquale Scola\n\n### Calendar\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to access sensitive user data\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-112678: Neon, Niels Hofmans, Mustafa Calap (@ordinal0, dbg.re)\n\n### Carbon Core\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to access sensitive user data\n\nDescription: A logging issue was addressed with improved data redaction.\n\nCVE-2026-84528: zenith\n\n### Carbon Core\n\nImpact: An app may bypass Gatekeeper checks\n\nDescription: A file quarantine bypass was addressed with additional checks.\n\nCVE-2026-86941: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### CloudKit\n\nAvailable for: macOS Tahoe\n\nImpact: A malicious app may be able to gain root privileges\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-86896: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### ColorSync\n\nImpact: Processing a maliciously crafted file may disclose process memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112429: Mateusz Jurczyk of Google Project Zero\n\n### Compression\n\nImpact: An app may be able to disclose kernel memory\n\nDescription: A memory initialization issue was addressed with improved memory handling.\n\nCVE-2026-113910: Tucker Willenborg\n\n### configd\n\nImpact: An app may be able to gain root privileges\n\nDescription: A parsing issue in the handling of directory paths was addressed with improved path validation.\n\nCVE-2026-112545: Frederick Kaludis (Coiffeur0x90), Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### Control Center\n\nImpact: A malicious application may be able to bypass Privacy preferences\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-112462: DEVADATH V L, Junyeong Lee (jylab.github.io), Weeraphat Srisutham, Yejun Kim, an anonymous researcher, Zwei Tasse Kaffee, Lakshay Sharma (MrW0r57)\n\n### copyfile\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to modify protected parts of the file system\n\nDescription: This issue was addressed with improved handling of symlinks.\n\nCVE-2026-86966: Jihwan Yoon\n\n### Core Image\n\nImpact: Processing a maliciously crafted image may lead to unexpected process termination\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-112471: Meta Red Team X - Nik Tsytsarkin\n\n### CoreAudio\n\nImpact: An app may be able to cause unexpected system termination or corrupt process memory\n\nDescription: A race condition was addressed with improved locking.\n\nCVE-2026-112708: Nathaniel Oh (@calysteon)\n\n### CoreAudio\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds write was addressed with improved input validation.\n\nCVE-2026-86969: Meta Red Team X - Nik Tsytsarkin\n\n### CoreAudio\n\nImpact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n\nCVE-2026-113912: an anonymous researcher, 章鱼哥@aipy (aipyaipy.com), Roman Zabicki, Anna Groza (@pwnlambda) of Calif.io\n\n### CoreAudio\n\nImpact: An app may be able to cause unexpected system termination or corrupt process memory\n\nDescription: A buffer overflow issue was addressed with improved memory handling.\n\nCVE-2026-113907: Meta Red Team X - Nik Tsytsarkin\n\n### CoreAudio\n\nImpact: An attacker in radio range may be able to cause unexpected system termination\n\nDescription: A heap buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-112638: Altin Gashi, Përparim Mjeku, Altin Gashi\n\n### CoreAudio\n\nImpact: Processing a maliciously crafted audio file may lead to memory corruption\n\nDescription: A buffer overflow was addressed with improved size validation.\n\nCVE-2026-86972: an anonymous researcher, Meta Product Security\n\n### CoreGraphics\n\nImpact: Processing a maliciously crafted PDF file may lead to memory corruption\n\nCVE-2026-112611: f4&Zhiniang Peng with HUST, Aobo Wang (@M4x_1997), Xiang Chen, Jakob Pammer, Anna Groza (@pwnlambda) of Calif.io, Piotr Jerzy Duszynski, an anonymous researcher\n\nCVE-2026-112610: Meta Red Team X - Nik Tsytsarkin\n\n### CoreMedia\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-86992: Niels Hofmans\n\n### CoreMedia\n\nImpact: Parsing a file may lead to an unexpected app termination or arbitrary code execution\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2026-112688: 정우 하 (@0xfa11babe), Chris Bailey - Short Circuit\n\n### CoreMedia\n\nImpact: A malicious app may be able to access the camera without user permission\n\nCVE-2026-86990: Mustafa Calap (@ordinal0, dbg.re)\n\n### CoreServicesUIAgent\n\nImpact: A maliciously crafted disk image may bypass Gatekeeper checks\n\nCVE-2026-65368: an anonymous researcher\n\n### CoreSymbolication\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112604: Nathaniel Oh (@calysteon)\n\n### CoreText\n\nImpact: Processing a maliciously crafted font may result in the disclosure of process memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112656: Nurihan Kim (HanTul) working with TrendAI Zero Day Initiative\n\n### Crash Reporter\n\nImpact: An app may be able to gain root privileges\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-113900: Frederick Kaludis (Coiffeur0x90), YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab, Lakshay Sharma (MrW0r57)/WorstCase Labs., Ashish Kavishwar, Csaba Fitzl (@theevilbit) of Iru and Gergely Kalman (@gergely_kalman)\n\n### CUPS\n\nImpact: An app with App Sandbox restrictions may be able to escape the sandbox and execute code with root privileges\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-84545: Jurre van Bergen - Threatnotify, Mathis Mansière, 章鱼哥@aipy (aipyaipy.com）, Redon Gashi (Sentry)\n\n### CUPS\n\nImpact: A local attacker may be able to elevate their privileges\n\nCVE-2026-65327: Sanny Mitra\n\n### CVMS\n\nImpact: An app may be able to gain root privileges\n\nCVE-2026-112530: Alfredo Pesoli (@__rev) of Bynar.io, Claudio Bozzato and Francesco Benvenuto of Cisco Talos\n\n### DesktopServices\n\nImpact: An app may be able to bypass Gatekeeper checks\n\nCVE-2026-112444: Paul Montgomery (@nullevent)\n\n### DesktopServices\n\nAvailable for: macOS Tahoe\n\nImpact: An app may bypass Gatekeeper checks\n\nDescription: A logic issue was addressed with improved checks.\n\nCVE-2026-112428: Koh M. Nakagawa (@tsunek0h) of FFRI Security, Inc., Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### Directory Utility\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to modify protected parts of the file system\n\nDescription: A path handling issue was addressed with improved validation.\n\nCVE-2026-112483: Csaba Fitzl (@theevilbit) of Iru, Lyutoon\n\n### Disk Images\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to cause a denial-of-service\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-112502: Narendra Singh (@_3P1C)\n\n### DiskArbitration\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to break out of its sandbox\n\nDescription: An access issue was addressed with additional sandbox restrictions.\n\nCVE-2026-112570: Andrey Chernykh (BypassLabs.ai), Keisuke Hosoda\n\n### dyld\n\nImpact: An attacker with memory write capability may be able to bypass pointer authentication codes and run arbitrary code\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-86958: oxsignal\n\n### dyld\n\nImpact: An app may be able to bypass sandbox restrictions\n\nCVE-2026-112534: an anonymous researcher\n\n### FileProvider\n\nImpact: An app may be able to access sensitive user data\n\nDescription: A race condition was addressed with additional validation.\n\nCVE-2026-113896: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, R4mbb\n\n### FontParser\n\nImpact: Processing a maliciously crafted font may result in the disclosure of process memory\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\nCVE-2026-86970: Hcamael and 章鱼哥@aipy (aipyaipy.com)\n\n### FontParser\n\nImpact: Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112683: Hcamael and 章鱼哥@aipy (aipyaipy.com)\n\n### FontParser\n\nImpact: Processing a maliciously crafted font may result in the disclosure of process memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112642: Meta Red Team X - Nik Tsytsarkin\n\n### GPU Drivers\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-84539: Ye Zhang (@VAR10CK) of Baidu Security\n\n### GPU Drivers\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112593: f00l (@PPPF00L) and 3ndy1(@_3ndy1)\n\n### Grapher\n\nImpact: Processing a maliciously crafted file may lead to arbitrary code execution\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-86929: Anand (anandsreekumar.com)\n\n### Heimdal\n\nImpact: A remote attacker may cause an unexpected process termination\n\nDescription: A double free issue was addressed with improved memory management.\n\nCVE-2026-112410: Piotr Jerzy Duszynski\n\n### Heimdal\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-86942: He Wei (ギカク)\n\n### Help Viewer\n\nCVE-2026-112523: powerprove, Michael Benich, Niels Hofmans, Christian Niel Angel of Protectiv IT Security Inc. (protectiv.ph), Lyutoon, Seung Je Seong, R4mbb, Wojciech Regula of SecuRing (wojciechregula.blog)\n\n### HFS\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112424: Peter Malone\n\n### HFS\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112475: Aswin Kumar Gokulakannan, Minseok Kim, Dave G., Thanatos Tian (HKPolyU) & wgg & xmr, Marco Schmitt\n\n### HFS\n\nImpact: Processing a maliciously crafted file may lead to heap corruption\n\nCVE-2026-112456: Jihwan Yoon, Yash Pandya, Parth Raval\n\n### iCloud\n\nCVE-2026-112647: Sattyam Yadav, onetwo, Christian Niel Angel of Protectiv IT Security Inc. (protectiv.ph), Robert Tran, Merrick Hare\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may lead to heap corruption\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-84627: ธนกฤต ทัฬหะ, Rahul Raj, Piotr Jerzy Duszynski, PETOWORKS의 Bugeun Choi (@Bugeun), Mateusz Jurczyk of Google Project Zero, f0r of MurphySec\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may result in memory corruption\n\nCVE-2026-64750: Mateusz Jurczyk of Google Project Zero, Eddy Tsalolikhin, Johann Rehberger\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may corrupt process memory\n\nDescription: A buffer overflow issue was addressed with improved memory handling.\n\nCVE-2026-112488: an anonymous researcher, Mateusz Jurczyk of Google Project Zero, Nik Tsytsarkin\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may result in disclosure of process memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112560: Wout van der Ploeg (woutvanderploeg.nl)\n\nCVE-2026-112561: Meta Red Team X - Nik Tsytsarkin\n\nCVE-2026-112627: Mateusz Jurczyk of Google Project Zero\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may result in disclosure of process memory\n\nDescription: A memory initialization issue was addressed with improved memory handling.\n\nCVE-2026-112571: sh3rlock (김보겸)\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may lead to unexpected app termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-86954: Mateusz Jurczyk of Google Project Zero\n\nCVE-2026-112634: Mateusz Jurczyk of Google Project Zero\n\nCVE-2026-112629: Mateusz Jurczyk of Google Project Zero\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may lead to unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112633: Mateusz Jurczyk of Google Project Zero\n\nCVE-2026-112614: Mateusz Jurczyk of Google Project Zero, PETOWORKS의 Bugeun Choi (@Bugeun), Rahul Raj, Piotr Jerzy Duszynski\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may result in memory corruption\n\nDescription: An integer underflow was addressed with improved input validation.\n\nCVE-2026-112625: Mateusz Jurczyk of Google Project Zero\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may result in disclosure of process memory\n\nDescription: An uninitialized memory issue was addressed with improved memory handling.\n\nCVE-2026-112630: Mateusz Jurczyk of Google Project Zero\n\nCVE-2026-112632: Mateusz Jurczyk of Google Project Zero\n\n### IOGPUFamily\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-112533: Andrey Chernykh, Sihyun Roh (Compsec, SNU)\n\n### IOHIDFamily\n\nAvailable for: macOS Tahoe\n\nImpact: An attacker may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112515: Charles Stevenson, Mathis Mansière, Seung Je Seong\n\n### IOKit\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read issue was addressed by removing the vulnerable code.\n\nCVE-2026-112478: Nord0x, Narendra Singh (@_3P1C), Marco Schmitt, an anonymous researcher\n\n### IOStorageFamily\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112554: Bhuwan Bhetwal, Kwak Kiyong (@Pwnkai23), Song Nuri, Nicolas Seriot, Tommy DeVoss from Braze Security Team (@thedawgyg), Tucker Willenborg, Navapon Premkasem, Aswin Kumar Gokulakannan, Peter Malone, Richard Zana\n\n### IOSurface\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A race condition was addressed with improved locking.\n\nCVE-2026-112477: an anonymous researcher\n\n### Kernel\n\nImpact: An app may be able to cause unexpected changes to copy-on-write memory\n\nDescription: A memory integrity issue was addressed with improved handling of copy-on-write pages.\n\nCVE-2026-112576: Pedro Pinho\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A type confusion issue was addressed with improved memory handling.\n\nCVE-2026-112606: Wang Yu\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-112532: Peter Malone\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-112517: Pasquale Scola, Cem Onat Karagun, Wout van der Ploeg (woutvanderploeg.nl), John Lussier, an anonymous researcher\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-112516: an anonymous researcher, greenbynox\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-112698: OpenAI, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nImpact: An attacker may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-112514: Marc Newlin of SkySafe, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., greenbynox\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nCVE-2026-84495: Wang Yu\n\n### Kernel\n\nImpact: An app may be able to execute arbitrary code with kernel privileges\n\nCVE-2026-86916: Wang Yu\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-65350: Xinru Chi of Pangu Lab, Tim Michaud (@TimGMichaud) of Aginor.ai, Nebula Security (@nebusecurity)\n\n### Kernel\n\nCVE-2026-112543: f0r of MurphySec\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-112476: Arnold Cartagena, Matt Suiche (@msuiche) of Tolmo\n\n### Kernel\n\nImpact: An unprivileged attacker may be able to execute arbitrary code as root\n\nCVE-2026-112438: Jakob Pammer\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-86964: Ryan Hileman via Xint Code (xint.io)\n\n### Kernel\n\nCVE-2026-112665: Will Estes\n\n### Kernel\n\nCVE-2026-112501: Cem Onat Karagun\n\n### Kernel\n\nCVE-2026-112624: Jerry L. Knot\n\n### LaunchServices\n\nCVE-2026-112494: Yiğit Can YILMAZ (@yilmazcanyigit)\n\n### libarchive\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nCVE-2026-112522: Eliya M., Viacheslav Radiukov, Tristan Madani (Talence Security), Robert Tran\n\n### libcryptex\n\nImpact: An malicious app may be able to create files in protected directories\n\nCVE-2026-86945: an anonymous researcher, Andrey Chernykh\n\n### libxpc\n\nImpact: An app may be able to break out of its sandbox\n\nCVE-2026-112497: Claudio Bozzato and Francesco Benvenuto of Cisco Talos\n\n### Mail\n\nImpact: Processing a maliciously crafted message may lead to a denial-of-service\n\nDescription: A stack overflow was addressed with improved input validation.\n\nCVE-2026-112414: Daniel Rodríguez, Nathaniel Oh (@calysteon)\n\n### Mail\n\nImpact: A remote attacker may be able to cause a denial-of-service\n\nCVE-2026-112671: Nathaniel Oh (@calysteon)\n\n### MediaAnalysis\n\nCVE-2026-113915: Abodi Dawoud, Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Ilya Andr (andrd3v) of Positive Technologies, Zhongquan Li (@Guluisacat)\n\n### Messages\n\nImpact: A remote attacker may be able to cause unexpected app termination\n\nCVE-2026-112682: Mahmoud Abdelmoniem\n\n### Metal\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to read files outside of its sandbox\n\nDescription: An access issue was addressed with improved access restrictions.\n\nCVE-2026-84542: Mustafa Ahmed, an anonymous researcher\n\n### Model I/O\n\nAvailable for: macOS Tahoe\n\nImpact: Processing a maliciously crafted 3D model may lead to memory corruption\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-112565: Musaab Khan (@bxff), Hcamael and 章鱼哥@aipy (aipyaipy.com), Saoud Khalifah, stratan (@5tratan), Niels Hofmans\n\nCVE-2026-112449: ret2happy (@ret2happy)\n\n### Model I/O\n\nAvailable for: macOS Tahoe\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112413: Nathaniel Oh (@calysteon)\n\n### Model I/O\n\nAvailable for: macOS Tahoe\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112553: stratan (@5tratan)\n\nCVE-2026-112563: stratan (@5tratan)\n\n### Model I/O\n\nImpact: Processing a maliciously crafted 3D model may lead to memory corruption\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112461: 진규정 (Gyujeong Jin, @G1uN4sh), Lucas Parnell, Nathaniel Oh (@calysteon), Meta Red Team X - Nik Tsytsarkin, YingMuo (@YingMuo) of DEVCORE Research Team, ret2happy (@ret2happy)\n\n### Model I/O\n\nImpact: Processing a maliciously crafted 3D model may lead to memory corruption\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-112485: Nik Tsytsarkin\n\n### Model I/O\n\nImpact: Processing a 3D model may lead to unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112486: Md Rasel Bhuyan (www.linkedin.com/in/rasel-bhuyan), Musaab Khan (@bxff)\n\n### ncurses\n\nImpact: An app may be able to cause a denial-of-service\n\nDescription: A type confusion issue was addressed with improved memory handling.\n\nCVE-2026-112550: Jonathan Bar Or (@yo_yo_yo_jbo)\n\n### OpenBSM\n\nImpact: Processing a maliciously crafted audit file may corrupt process memory\n\nDescription: A stack buffer overflow was addressed through improved input validation.\n\nCVE-2026-84604: Tristan Madani (Talence Security)\n\n### PackageKit\n\nImpact: An app may be able to modify protected parts of the file system\n\nDescription: A race condition was addressed with improved handling of symbolic links.\n\nCVE-2026-112421: Csaba Fitzl (@theevilbit) of Iru and Gergely Kalman (@gergely_kalman)\n\n### PackageKit\n\nImpact: An app may be able to modify protected parts of the file system\n\nDescription: A race condition was addressed with additional validation.\n\nCVE-2026-112442: Mickey Jin (@patch1t)\n\n### Photos Storage\n\nCVE-2026-65397: Varik Matevosyan (@D4RK7ET), an anonymous researcher\n\n### Photos Storage\n\nImpact: An app may be able to bypass certain Privacy preferences\n\nCVE-2026-112660: Prafull Dhiman, Alto_00000\n\n### Photos Storage\n\nCVE-2026-112676: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova\n\n### ppp\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-113899: Siddharth Aeri\n\n### ppp\n\nImpact: A malicious app may be able to intercept network traffic\n\nCVE-2026-112542: Gabriel '0xv1n' Cardona, Mrunal Chawda, Kujtim Kryeziu (Sentry), Tristan Madani (Talence Security)\n\n### Printing\n\nImpact: A malicious app may be able to break out of its sandbox\n\nDescription: A parsing issue in the handling of directory paths was addressed with improved path validation.\n\nCVE-2026-112562: 도현 김, Ithrael, YEONGJAE SHIN, an anonymous researcher\n\n### quarantine\n\nImpact: A malicious application may bypass Gatekeeper checks\n\nCVE-2026-64789: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs (nosebeard.co), an anonymous researcher\n\n### quarantine\n\nImpact: An app may be able to break out of its sandbox\n\nCVE-2026-112569: Csaba Fitzl (@theevilbit) of Iru, an anonymous researcher\n\nCVE-2026-112498: an anonymous researcher\n\n### RealityKit\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112491: Hongsik Kim (mnur)\n\n### Remote Management\n\nImpact: An attacker on the local network may be able to cause unexpected system termination or corrupt process memory\n\nDescription: A double free issue was addressed with improved memory management.\n\nCVE-2026-112457: Efstratios Kaplanellis (@5tratan) of Almamater Technologies, Nathaniel Oh (@calysteon)\n\n### Remote Management\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-112480: Andrey Chernykh, ruitong (@abstract)\n\n### RemoteManagement\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nCVE-2026-112677: an anonymous researcher, Niels Hofmans, 도현 김, Junyeong Lee (jylab.github.io), Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs, Jonghoon Han (Aegis)\n\n### SceneKit\n\nImpact: Processing a 3D model may result in disclosure of process memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112425: stratan (@5tratan)\n\n### SceneKit\n\nImpact: Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112423: Rahul Raj\n\n### SceneKit\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-112540: f4&Zhiniang Peng with HUST, Geonha Lee (@leegn4a), Kwak Kiyong (@Pwnkai23), Song Nuri, Wout van der Ploeg (woutvanderploeg.nl), Substrate, Piotr Jerzy Duszynski, Tristan Madani (Talence Security), Arni Hardarson (Neonix Security), an anonymous researcher\n\n### SceneKit\n\nImpact: Processing a maliciously crafted file may lead to heap corruption\n\nDescription: An out-of-bounds write issue was addressed with improved input validation.\n\nCVE-2026-112464: 정우 하 (@0xfa11babe), Narendra Singh (@_3P1C)\n\n### SceneKit\n\nImpact: Processing a maliciously crafted file may lead to unexpected process termination\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-86991: Cem Onat Karagun, Yujung Choi (@Dusker), Mathis Mansière, Rahul Raj\n\n### Screen Sharing\n\nAvailable for: macOS Tahoe\n\nImpact: Connecting to a malicious VNC server may cause a denial-of-service\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-112519: Piotr Jerzy Duszynski, Nathaniel Oh (@calysteon)\n\n### Screen Sharing Server\n\nAvailable for: macOS Tahoe\n\nImpact: A malicious app may be able to gain root privileges\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-65373: Stefan Esser (Calif), Alfredo Pesoli (@__rev) via Bynario Atlas (bynar.io), Anon Tuttu Venus, Nathaniel Oh (@calysteon)\n\n### Screen Sharing Server\n\nAvailable for: macOS Tahoe\n\nImpact: An attacker with the legacy VNC password for Screen Sharing may be able to copy files to the Mac\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-112473: Alfredo Pesoli (@__rev) via Bynario Atlas (bynar.io)\n\n### Screen Sharing Server\n\nAvailable for: macOS Tahoe\n\nImpact: An attacker on the local network may be able to corrupt process memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112482: Nathaniel Oh (@calysteon)\n\n### Screen Sharing Server\n\nAvailable for: macOS Tahoe\n\nImpact: A malicious Screen Sharing peer may be able to create arbitrary symlinks as root\n\nDescription: A path handling issue was addressed with improved logic.\n\nCVE-2026-112511: Nathaniel Oh (@calysteon)\n\n### Screen Sharing Server\n\nAvailable for: macOS Tahoe\n\nImpact: A malicious application may be able to execute arbitrary code with system privileges\n\nCVE-2026-112484: Mahmoud Abdelmoniem\n\n### Screen Sharing Server\n\nAvailable for: macOS Tahoe\n\nImpact: A remote attacker may be able to cause unexpected app termination or heap corruption\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-84590: Nathaniel Oh (@calysteon), Narendra Singh (@_3P1C), koocolb, Tristan Madani (Talence Security)\n\n### Screen Sharing Server\n\nAvailable for: macOS Tahoe\n\nImpact: An attacker on the local network may be able to cause unexpected process termination or disclose process memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112481: Nathaniel Oh (@calysteon)\n\n### Security\n\nCVE-2026-113913: Niels Hofmans, Stav Nir and Vladimir Tokarev\n\n### Security\n\nImpact: An app may be able to break out of its sandbox\n\nCVE-2026-65363: Arni Hardarson (Neonix Security), Csaba Fitzl (@theevilbit) of Iru and Gergely Kalman (@gergely_kalman)\n\n### Security\n\nCVE-2026-86931: Pranav Gopalkrishnan, Alan Wang, Ailsa Sun, Hovav Shacham, Riccardo Paccagnella, Chris Fletcher, David Kohlbrenner\n\n### Security\n\nImpact: A sandboxed process may be able to circumvent sandbox restrictions\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-112521: Richard Hyunho Im (@richeeta) at Route Zero Security, Efstratios Kaplanellis (@5tratan) of Almamater Technologies\n\n### Security\n\nImpact: A local attacker may gain access to user's Keychain items\n\nCVE-2026-28864: Alex Radocea\n\n### Security\n\nImpact: An app may be able to gain root privileges\n\nDescription: A logic issue was addressed with improved checks.\n\nCVE-2026-112668: cnitlrt (@abstract), Roman Belovitskiy, Lyutoon, Art Pllana, Redon Gashi of Sentry, ruitong (@abstract), Surej Sekhar, Teodor Sorescu (@teodorsorescu), Eddy Tsalolikhin, Franco Belman at Blackwing Intelligence, Phillip Groves, Sihyun Roh (Compsec, SNU), lokerxx\n\nCVE-2026-86936: cnitlrt (@abstract), lokerxx\n\nCVE-2026-112437: lokerxx\n\nCVE-2026-112434: ruitong (@abstract), lokerxx\n\n### Security\n\nImpact: An malicious app may be able to bypass certificate validation\n\nCVE-2026-112652: Aditya Kumar\n\n### Security\n\nImpact: An app may be able to gain root privileges\n\nCVE-2026-112430: ruitong (@abstract)\n\n### SecurityAgent\n\nImpact: An app may be able to gain root privileges\n\nCVE-2026-112493: Mickey Jin (@patch1t)\n\n### Shortcuts\n\nCVE-2026-112559: Lucas Lammer, Stuart Wallace\n\nCVE-2026-112455: Rahul Raj, Chris Bailey - Short Circuit\n\n### Siri\n\nCVE-2026-86984: Albin Haliti\n\n### Siri\n\nCVE-2026-86923: Sindre Sorhus, Asaf Cohen\n\n### Siri\n\nCVE-2026-43736: Guilherme Rambo of Best Buddy Apps (rambo.codes), Abodi Dawoud\n\n### SMB\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-86946: Jakob Pammer\n\n### SMB\n\nImpact: An attacker with control of a network file server may be able to cause unexpected system termination\n\nCVE-2026-112552: Bhuwan Bhetwal, Feng Xue and XGPT of ThreatBook, Claudio Bozzato and Francesco Benvenuto of Cisco Talos\n\n### smbx\n\nImpact: A remote attacker may be able to cause unexpected app termination\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-112526: Nathaniel Oh (@calysteon), Narendra Singh (@_3P1C), Tristan Madani (@TristanInSec) from Talence Security, an anonymous researcher\n\n### smbx\n\nImpact: A remote attacker may be able to cause a denial-of-service or disclose process memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112451: Nathaniel Oh (@calysteon)\n\n### smbx\n\nImpact: A remote attacker may be able to cause a denial-of-service\n\nCVE-2026-112510: Efstratios Kaplanellis (@5tratan) of Almamater Technologies, Andrey Chernykh\n\n### smbx\n\nImpact: A malicious Screen Sharing peer may be able to corrupt process memory\n\nCVE-2026-112505: an anonymous researcher, Narendra Singh (@_3P1C), Andrey Chernykh\n\n### SoftRAID\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112495: Lyutoon\n\n### Spotlight\n\nDescription: A permissions issue was addressed with additional sandbox restrictions.\n\nCVE-2026-112558: D4rthL\n\n### Spotlight\n\nImpact: A malicious application may be able to bypass Privacy preferences\n\nDescription: The issue was addressed with improved checks.\n\nCVE-2026-112557: D4rthL\n\n### Spotlight\n\nAvailable for: macOS Tahoe\n\nImpact: A malicious application may be able to bypass Privacy preferences\n\nDescription: This issue was addressed with improved checks.\n\nCVE-2026-112567: zenith\n\n### Spotlight\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to access sensitive user data\n\nDescription: This issue was addressed with improved data access restriction.\n\nCVE-2026-112628: Santiago","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":64454,"url":"https://support.apple.com/en-us/126792","title":"Vendor advisory: support.apple.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: support.apple.com"},{"id":64455,"url":"https://support.apple.com/en-us/126793","title":"Vendor advisory: support.apple.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: support.apple.com"},{"id":64456,"url":"https://support.apple.com/en-us/126794","title":"Vendor advisory: support.apple.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: support.apple.com"},{"id":64457,"url":"https://support.apple.com/en-us/126795","title":"Vendor advisory: support.apple.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: support.apple.com"},{"id":64458,"url":"https://support.apple.com/en-us/126796","title":"Vendor advisory: support.apple.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: support.apple.com"},{"id":64459,"url":"https://support.apple.com/en-us/126798","title":"Vendor advisory: support.apple.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: support.apple.com"},{"id":64460,"url":"https://support.apple.com/en-us/126799","title":"Vendor advisory: support.apple.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: support.apple.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}