--- id: "CVE-2026-28864" kind: "vulnerability" aliases: ["CVE-2026-28864"] title: "This issue was addressed with improved permissions checking" severity: "high" cvss: 3.3 epss: null exploited: false status: "open" category: "vendor" products: [{"name": "apple ipados", "fixed": ["18.7.7"], "affected": "< 18.7.7", "ecosystem": "vendor"}, {"name": "apple ipados", "fixed": ["26.4"], "affected": ">= 26.0, < 26.4", "ecosystem": "vendor"}, {"name": "apple iphone os", "fixed": ["18.7.7"], "affected": "< 18.7.7", "ecosystem": "vendor"}, {"name": "apple iphone os", "fixed": ["26.4"], "affected": ">= 26.0, < 26.4", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["14.8.5"], "affected": ">= 14.0, < 14.8.5", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["15.7.5"], "affected": ">= 15.0, < 15.7.5", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["26.4"], "affected": ">= 26.0, < 26.4", "ecosystem": "vendor"}, {"name": "apple visionos", "fixed": ["26.4"], "affected": "< 26.4", "ecosystem": "vendor"}, {"name": "apple watchos", "fixed": ["26.4"], "affected": "< 26.4", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["apple", "macos", "macos-tahoe", "vendor", "vendor-advisory"] not_affected_if: ["already-on-26.7.2"] published_at: "2026-03-25T01:17:10+00:00" first_seen_at: "2026-11-04T05:22:24+00:00" updated_at: "2026-11-04T05:46:44+00:00" sources: [{"source": "lab", "url": "https://support.apple.com/en-us/149522", "first_seen_at": "2026-11-04T05:22:24+00:00"}, {"source": "lab", "url": "https://support.apple.com/en-us/149523", "first_seen_at": "2026-11-04T05:22:24+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28864", "first_seen_at": "2026-11-04T05:46:44+00:00"}] --- # This issue was addressed with improved permissions checking Apple's macOS Tahoe 26.7.2 security release fixes a large batch of flaws across system components, including kernel memory corruption, sandbox escapes, and Gatekeeper bypasses. An attacker who gets a crafted file or a malicious app onto a Mac could run code, escape restrictions, or read protected data. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:apple ipados affected < 18.7.7 fixed 18.7.7 - vendor:apple ipados affected >= 26.0, < 26.4 fixed 26.4 - vendor:apple iphone os affected < 18.7.7 fixed 18.7.7 - vendor:apple iphone os affected >= 26.0, < 26.4 fixed 26.4 - vendor:apple macos affected >= 14.0, < 14.8.5 fixed 14.8.5 - vendor:apple macos affected >= 15.0, < 15.7.5 fixed 15.7.5 - vendor:apple macos affected >= 26.0, < 26.4 fixed 26.4 - vendor:apple visionos affected < 26.4 fixed 26.4 - vendor:apple watchos affected < 26.4 fixed 26.4 ## How to check - Check the installed version under Apple menu > About This Mac, or run `sw_vers -productVersion` in Terminal. - Compare the result against `26.7.2` or later for macOS Tahoe. ## Fix - macOS Tahoe: update to `26.7.2` or later, per the Apple advisory. ## Timeline - 2026-11-04T05:22:24+00:00 lab https://support.apple.com/en-us/149522 — Apple: About the security content of macOS Tahoe 26.7.2 - Apple Support - 2026-11-04T05:22:24+00:00 lab https://support.apple.com/en-us/149523 — Apple: About the security content of macOS Sequoia 15.8.2 - Apple Support - 2026-11-04T05:46:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-28864 ## Documents - [advisory] Apple: About the security content of macOS Sequoia 15.8.2 - Apple Support https://support.apple.com/en-us/149523 - [advisory] Apple: About the security content of macOS Tahoe 26.7.2 - Apple Support https://support.apple.com/en-us/149522 - [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/126792 - [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/126793 - [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/126794 - [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/126795 - [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/126796 - [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/126798 - [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/126799 ## From the sources About the security content of macOS Tahoe 26.7.2 - Apple Support # About the security content of macOS Tahoe 26.7.2 This document describes the security content of macOS Tahoe 26.7.2. ## About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page. Apple security documents reference vulnerabilities by CVE-ID when possible. For more information about security, see the Apple Product Security page. ## macOS Tahoe 26.7.2 Released October 26, 2026 ### Accelerate Framework Available for: macOS Tahoe Impact: Processing a maliciously crafted image may lead to unexpected app termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-86971: an anonymous researcher ### Accounts Available for: macOS Tahoe Impact: A malicious application may be able to bypass Privacy preferences Description: A logging issue was addressed with improved data redaction. CVE-2026-113898: Bhaswanth Chigurupati ### AirPort Available for: macOS Tahoe Impact: An app may be able to read sensitive location information Description: An authorization issue was addressed with improved state management. CVE-2026-112551: Nguyen Duc Anh of Noventiq, Sindre Sorhus ### APFS Available for: macOS Tahoe Impact: Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-84496: 준우 이, Maher Azzouzi, Jonathan Bar Or (@yo_yo_yo_jbo), Marco Schmitt, Nathaniel Oh (@calysteon), Aswin Kumar Gokulakannan, Narendra Singh (@_3P1C), Thanatos Tian (HKPolyU) & wgg with Diffract, Jakob Pammer, an anonymous researcher, Bhuwan Bhetwal, Kwak kiyong (@Pwnkai23) , Song nuri ### APFS Available for: macOS Tahoe Impact: An app may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112525: We Muftihaturrahmah, Aswin Kumar Gokula Kannan, Ruslan Dautov, Peter Malone ### APFS Available for: macOS Tahoe Impact: An app may be able to cause unexpected system termination or write kernel memory Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112536: Ruslan Dautov, Thomas Guillem, Narendra Singh (@_3P1C), Kwak Kiyong (@Pwnkai23), Song Nuri, Thanatos Tian (HKPolyU) & wgg with Diffract ### App Store Available for: macOS Tahoe Impact: An app may be able to bypass network restrictions Description: This issue was addressed with improved checks. CVE-2026-112467: Sindre Sorhus ### App Store Available for: macOS Tahoe Impact: A remote attacker may be able to break out of the WebContent sandbox Description: This issue was addressed with improved input validation. CVE-2026-112690: Claudio Bozzato and Francesco Benvenuto of Cisco Talos ### Apple Intelligence Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-86920: Johan Wahyudi ### Apple Neural Engine Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-84595: tamdao ### Apple Neural Engine Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112696: Jaeyeong Lee ### AppleAVD Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112416: an anonymous researcher, Meta Red Team X - Nik Tsytsarkin, Narendra Singh (@_3P1C), Hcamael and 章鱼哥@aipy (aipyaipy.com), Dohyeon An @PILAB Technology, Inc ### AppleAVD Impact: An app may be able to cause unexpected system termination or corrupt process memory Description: An out-of-bounds write was addressed with improved input validation. CVE-2026-112415: Rahul Raj, Hcamael and 章鱼哥@aipy (aipyaipy.com) ### AppleAVD Impact: A malicious app may be able to break out of its sandbox Description: An information leakage was addressed with additional validation. CVE-2026-112704: Josh Maine of Calif.io ### AppleMobileFileIntegrity Impact: A malicious app may be able to read or write to protected files Description: A permissions issue was addressed with additional restrictions. CVE-2026-112539: Claudio Bozzato and Francesco Benvenuto of Cisco Talos ### AppleRAID Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-112531: Chanwit Muenprakoddee (ChemIndy) ### Archive Utility Impact: An attacker with root privileges may be able to access protected user data Description: A permissions issue was addressed with additional restrictions. CVE-2026-86939: Lance Cain - Senior Security Researcher at SpecterOps Inc. ### ArchiveService Impact: An app may bypass Gatekeeper checks Description: A logic issue was addressed with improved state management. CVE-2026-86937: YingMuo (@YingMuo) of DEVCORE Research Team, Paul Montgomery (@nullevent) ### ArchiveService Impact: Processing a maliciously crafted file may bypass Gatekeeper checks Description: A logic issue was addressed with improved checks. CVE-2026-112568: an anonymous researcher ### Audio Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112546: lunar815, Nathaniel Oh (@calysteon), Piotr Jerzy Duszynski, an anonymous researcher, Surej Sekhar, r3pwnx (@r3pwnx), Lily Cohl (@GenericCoding) ### Audio Impact: An app may be able to access sensitive user data Description: This issue was addressed with additional entitlement checks. CVE-2026-112675: Lakshay Sharma (MrW0r57), Abodi Dawoud ### AVEVideoEncoder Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112705: Marco Schmitt, Andrey Chernykh, Josh Maine of Calif.io ### AVEVideoEncoder Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: An out-of-bounds write issue was addressed with improved input validation. CVE-2026-112689: Franco Belman at Blackwing Intelligence ### AVEVideoEncoder Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112470: Hcamael and 章鱼哥@aipy (aipyaipy.com) CVE-2026-112468: Hcamael and 章鱼哥@aipy (aipyaipy.com) CVE-2026-112469: Hcamael and 章鱼哥@aipy (aipyaipy.com) ### AVEVideoEncoder Impact: An app may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2026-112466: Hcamael and 章鱼哥@aipy (aipyaipy.com) ### Bluetooth Impact: An attacker in physical proximity may be able to cause a denial-of-service Description: A null pointer dereference was addressed with improved validation. CVE-2026-112566: Chris Bailey - Short Circuit ### BOM Impact: A maliciously crafted ZIP archive may bypass Gatekeeper checks Description: A file quarantine bypass was addressed with additional checks. CVE-2026-84610: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs, Murray Mike ### BOM Impact: Processing a maliciously crafted file may lead to heap corruption Description: An out-of-bounds write issue was addressed with improved input validation. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_