{"id":"CVE-2026-28991","kind":"vulnerability","aliases":["CVE-2026-28991"],"related":[],"title":"An out-of-bounds read was addressed with improved bounds checking","description":"About the security content of macOS Sequoia 15.8.2 - Apple Support\n\n# About the security content of macOS Sequoia 15.8.2\n\nThis document describes the security content of macOS Sequoia 15.8.2.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## macOS Sequoia 15.8.2\n\nReleased October 26, 2026\n\n### Accelerate\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause a denial-of-service\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-28991: Seiji Sakurai (@HeapSmasher)\n\n### Accelerate Framework\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted image may lead to unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-86971: an anonymous researcher\n\n### Accounts\n\nAvailable for: macOS Sequoia\n\nImpact: A malicious application may be able to bypass Privacy preferences\n\nDescription: A logging issue was addressed with improved data redaction.\n\nCVE-2026-113898: Bhaswanth Chigurupati\n\n### afpfs\n\nAvailable for: macOS Sequoia\n\nImpact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-64767: Dave G.\n\n### APFS\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112525: We Muftihaturrahmah, Aswin Kumar Gokula Kannan, Ruslan Dautov, Peter Malone\n\n### APFS\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112536: Ruslan Dautov, Thomas Guillem, Narendra Singh (@_3P1C), Kwak Kiyong (@Pwnkai23), Song Nuri, Thanatos Tian (HKPolyU) & wgg with Diffract\n\n### App Store\n\nAvailable for: macOS Sequoia\n\nImpact: A remote attacker may be able to break out of the WebContent sandbox\n\nDescription: This issue was addressed with improved input validation.\n\nCVE-2026-112690: Claudio Bozzato and Francesco Benvenuto of Cisco Talos\n\n### Apple Intelligence\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-86920: Johan Wahyudi\n\n### Apple Neural Engine\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\n### Apple Neural Engine\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\n### AppleAVD\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112416: an anonymous researcher, Meta Red Team X - Nik Tsytsarkin, Narendra Singh (@_3P1C), Hcamael and 章鱼哥@aipy (aipyaipy.com), Dohyeon An @PILAB Technology, Inc\n\n### AppleAVD\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination or corrupt process memory\n\nDescription: An out-of-bounds write was addressed with improved input validation.\n\nCVE-2026-112415: Rahul Raj, Hcamael and 章鱼哥@aipy (aipyaipy.com)\n\n### AppleAVD\n\nAvailable for: macOS Sequoia\n\nImpact: A malicious app may be able to break out of its sandbox\n\nDescription: An information leakage was addressed with additional validation.\n\nCVE-2026-112704: Josh Maine of Calif.io\n\n### AppleMobileFileIntegrity\n\nAvailable for: macOS Sequoia\n\nImpact: A malicious app may be able to read or write to protected files\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-112539: Claudio Bozzato and Francesco Benvenuto of Cisco Talos\n\n### AppleRAID\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-112531: Chanwit Muenprakoddee (ChemIndy)\n\n### ArchiveService\n\nAvailable for: macOS Sequoia\n\nImpact: An app may bypass Gatekeeper checks\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-86937: YingMuo (@YingMuo) of DEVCORE Research Team, Paul Montgomery (@nullevent)\n\n### ArchiveService\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted file may bypass Gatekeeper checks\n\nDescription: A logic issue was addressed with improved checks.\n\nCVE-2026-112568: an anonymous researcher\n\n### Audio\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112546: lunar815, Nathaniel Oh (@calysteon), Piotr Jerzy Duszynski, an anonymous researcher, Surej Sekhar, r3pwnx (@r3pwnx), Lily Cohl (@GenericCoding)\n\n### Audio\n\nAvailable for: macOS Sequoia\n\nCVE-2026-112675: Lakshay Sharma (MrW0r57), Abodi Dawoud\n\n### AVEVideoEncoder\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112705: Marco Schmitt, Andrey Chernykh, Josh Maine of Calif.io\n\n### AVEVideoEncoder\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved input validation.\n\n### AVEVideoEncoder\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112470: Hcamael and 章鱼哥@aipy (aipyaipy.com)\n\nCVE-2026-112468: Hcamael and 章鱼哥@aipy (aipyaipy.com)\n\nCVE-2026-112469: Hcamael and 章鱼哥@aipy (aipyaipy.com)\n\n### AVEVideoEncoder\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\n### BOM\n\nImpact: A maliciously crafted ZIP archive may bypass Gatekeeper checks\n\nDescription: A file quarantine bypass was addressed with additional checks.\n\nCVE-2026-84610: Murray Mike, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### BOM\n\nImpact: Processing a maliciously crafted file may lead to heap corruption\n\nDescription: An out-of-bounds write issue was addressed with improved input validation.\n\n### BOM\n\nImpact: A maliciously crafted ZIP archive may bypass Gatekeeper checks\n\nCVE-2026-112672: 준우 이, Pasquale Scola\n\n### Calendar\n\nAvailable for: macOS Sequoia\n\nDescription: A permissions issue was addressed with additional restrictions.\n\n### Carbon Core\n\nAvailable for: macOS Sequoia\n\nDescription: A logging issue was addressed with improved data redaction.\n\nCVE-2026-84528: zenith\n\n### Carbon Core\n\nAvailable for: macOS Sequoia\n\nImpact: An app may bypass Gatekeeper checks\n\nDescription: A file quarantine bypass was addressed with additional checks.\n\nCVE-2026-86941: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### CloudKit\n\nAvailable for: macOS Sequoia\n\nImpact: A malicious app may be able to gain root privileges\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-86896: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### ColorSync\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted file may disclose process memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112429: Mateusz Jurczyk of Google Project Zero\n\n### Compression\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to disclose kernel memory\n\nDescription: A memory initialization issue was addressed with improved memory handling.\n\nCVE-2026-113910: Tucker Willenborg\n\n### configd\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to gain root privileges\n\nDescription: A parsing issue in the handling of directory paths was addressed with improved path validation.\n\nCVE-2026-112545: Frederick Kaludis (Coiffeur0x90), Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### Control Center\n\nAvailable for: macOS Sequoia\n\nImpact: A malicious application may be able to bypass Privacy preferences\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-112462: DEVADATH V L, Junyeong Lee (jylab.github.io), Weeraphat Srisutham, Yejun Kim, an anonymous researcher, Zwei Tasse Kaffee, Lakshay Sharma (MrW0r57)\n\n### copyfile\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to modify protected parts of the file system\n\nDescription: This issue was addressed with improved handling of symlinks.\n\n### Core Image\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted image may lead to unexpected process termination\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-112471: Meta Red Team X - Nik Tsytsarkin\n\n### CoreAudio\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination or corrupt process memory\n\nDescription: A race condition was addressed with improved locking.\n\nCVE-2026-112708: Nathaniel Oh (@calysteon)\n\n### CoreAudio\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds write was addressed with improved input validation.\n\n### CoreAudio\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n\nDescription: An out-of-bounds access issue was addressed with improved bounds checking.\n\nCVE-2026-113912: an anonymous researcher, 章鱼哥@aipy (aipyaipy.com), Roman Zabicki, Anna Groza (@pwnlambda) of Calif.io\n\n### CoreAudio\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination or corrupt process memory\n\nDescription: A buffer overflow issue was addressed with improved memory handling.\n\nCVE-2026-113907: Meta Red Team X - Nik Tsytsarkin\n\n### CoreAudio\n\nAvailable for: macOS Sequoia\n\nImpact: An attacker in radio range may be able to cause unexpected system termination\n\nDescription: A heap buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-112638: Altin Gashi, Përparim Mjeku, Altin Gashi\n\n### CoreGraphics\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted PDF file may lead to memory corruption\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112610: Meta Red Team X - Nik Tsytsarkin\n\nCVE-2026-112611: f4&Zhiniang Peng with HUST, Aobo Wang (@M4x_1997), Xiang Chen, Jakob Pammer, Anna Groza (@pwnlambda) of Calif.io, Piotr Jerzy Duszynski, an anonymous researcher\n\n### CoreMedia\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-86992: Niels Hofmans\n\n### CoreMedia\n\nImpact: Parsing a file may lead to an unexpected app termination or arbitrary code execution\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2026-112688: 정우 하 (@0xfa11babe), Chris Bailey - Short ","summary":"Apple's security notes for macOS Sequoia 15.8.2 list dozens of fixed flaws across system components such as APFS, AppleAVD, CoreAudio and CoreMedia. Several entries say a malicious app or a crafted file can gain root privileges, read or write kernel memory, or bypass Gatekeeper and privacy controls.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"apple ipados","fixed":["26.5"],"affected":"< 26.5","ecosystem":"vendor"},{"name":"apple iphone os","fixed":["26.5"],"affected":"< 26.5","ecosystem":"vendor"},{"name":"apple macos","fixed":["26.5"],"affected":">= 26.0, < 26.5","ecosystem":"vendor"},{"name":"apple tvos","fixed":["26.5"],"affected":"< 26.5","ecosystem":"vendor"},{"name":"apple visionos","fixed":["26.5"],"affected":"< 26.5","ecosystem":"vendor"},{"name":"apple watchos","fixed":["26.5"],"affected":"< 26.5","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apple","apple-devices","macos","macos-sequoia","vendor","vendor-advisory"],"not_affected_if":["already-on-15.8.2"],"how_to_check":"- Run `sw_vers -productVersion` on each Mac and compare the result with `15.8.2`\n- Check System Settings > General > Software Update for pending macOS updates","fix":"- macOS Sequoia: `15.8.2`","status":"open","published_at":"2026-05-11T21:18:59+00:00","first_seen_at":"2026-10-29T04:33:05+00:00","triaged_at":"2026-10-29T04:34:34+00:00","updated_at":"2026-10-29T04:41:59+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-29T04:34:34Z","model":"claude-haiku-5-5","output":{"fix":"- macOS Sequoia: `15.8.2`","reach":"local","title":"Apple macOS Sequoia 15.8.2: many kernel and app flaws patched","impact":"high","summary":"Apple's security notes for macOS Sequoia 15.8.2 list dozens of fixed flaws across system components such as APFS, AppleAVD, CoreAudio and CoreMedia. Several entries say a malicious app or a crafted file can gain root privileges, read or write kernel memory, or bypass Gatekeeper and privacy controls.","audience":"everyone","category":"vendor","nicknames":[],"who_cares":["macos","macos-sequoia","apple-devices"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"A local app or crafted file gains root or reads kernel memory","analyst_note":"Check the Apple advisory page for which CVE is tied to which entry; the signal is a single CVE id but the page lists many flaws.","how_to_check":"- Run `sw_vers -productVersion` on each Mac and compare the result with `15.8.2`\n- Check System Settings > General > Software Update for pending macOS updates\n- unknown for any check that covers the specific CVE ids in this advisory","plain_action":"Update your Mac to macOS Sequoia 15.8.2: System Settings > General > Software Update.","needs_analyst":true,"not_affected_if":["already-on-15.8.2"],"who_is_affected":"Any Mac running macOS Sequoia before 15.8.2 is affected, since the advisory covers system components that ordinary apps can reach. Attacks that need a malicious app or a crafted file are the main paths, so workstations that open untrusted files or run unvetted apps matter most. Machines already on 15.8.2 or a newer release can skip this entry.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.001214,"input_tokens":8837,"output_tokens":661,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112415':662C '-112416':604C '-112525':364C '-112536':411C '-112690':461C '-113898':290C '-2026':14A,17A,219C,257C,289C,325C,363C,410C,460C,498C,603C,661C '-28991':15A,18A,220C '-64767':326C '-86920':499C '-86971':258C '15.8.2':51B,99C,109C,119C,182C '2026':186C '26':185C '3p1c':418C,616C 'abl':197C,273C,304C,339C,385C,442C,481C,514C,546C,637C 'acceler':187C,224C 'access':483C 'account':262C 'across':57B 'address':8A,213C,251C,283C,319C,357C,404C,454C,492C,529C,565C,597C,655C 'advisori':43B 'afpf':293C 'aipi':620C,668C 'aipyaipy.com':621C,669C 'anonym':260C,606C 'apf':62B,329C,375C 'app':72B,194C,240C,336C,382C,430C,478C,511C,543C,586C,634C 'appl':32B,34B,44B,100C,121C,128C,154C,158C,176C,470C,502C,534C 'apple':19A,21A,24A,26A,28A,30A 'apple-devic':33B 'appleavd':63B,570C,627C,670C 'applic':270C 'aswin':367C 'attack':301C,439C 'author':489C 'avail':147C,188C,226C,263C,294C,330C,376C,432C,472C,505C,537C,571C,628C,671C 'benvenuto':466C 'bhaswanth':291C 'bound':5A,11A,210C,216C,247C,254C,322C,354C,360C,400C,407C,525C,532C,561C,568C,593C,600C,652C 'bozzato':463C 'break':444C 'buffer':316C 'bypass':87B,275C 'caus':199C,306C,341C,387C,516C,548C,639C 'check':12A,217C,255C,323C,361C,408C,533C,569C,601C 'chigurupati':292C 'cisco':468C 'claudio':462C 'compon':59B 'confirm':134C 'content':95C,105C,115C 'control':91B 'coreaudio':64B 'coremedia':66B 'corrupt':311C,553C,644C 'craft':75B,234C,579C 'custom':126C 'cve':13A,16A,165C,218C,256C,288C,324C,362C,409C,459C,497C,602C,660C 'cve-id':164C 'data':286C,486C 'dautov':372C,413C 'dave':327C 'denial':202C 'denial-of-servic':201C 'describ':112C 'descript':205C,242C,278C,314C,349C,395C,450C,487C,520C,556C,588C,647C 'devic':35B 'diffract':429C 'disclos':131C 'discuss':132C 'document':111C,160C 'doesn':129C 'dohyeon':622C 'dozen':53B 'engin':504C,536C 'entri':68B 'file':76B,581C 'fix':55B 'flaw':56B 'framework':225C 'francesco':465C 'g':328C 'gain':78B 'gatekeep':88B 'gokula':369C 'guillem':415C 'hcamael':617C,665C 'heapsmash':223C 'hkpolyu':426C 'id':166C 'imag':235C 'impact':192C,230C,267C,298C,334C,380C,436C,476C,509C,541C,575C,632C,675C 'improv':10A,215C,253C,285C,321C,359C,406C,456C,494C,531C,567C,599C,657C 'inc':626C 'inform':171C 'input':457C,658C 'intellig':471C 'investig':139C 'ipados':20A 'iphone':22A 'issu':136C,249C,281C,402C,452C,490C,527C,563C,595C 'johan':500C 'kannan':370C 'kernel':84B,312C,347C,393C,554C 'kiyong':420C 'kumar':368C 'kwak':419C 'lead':237C,583C 'list':52B,151C 'log':280C 'maco':36B,38B,49B,97C,107C,117C,180C,190C,228C,265C,296C,332C,378C,434C,474C,507C,539C,573C,630C,673C 'macos':25A 'macos-sequoia':37B 'malici':71B,233C,269C,578C 'maliciou':677C 'malon':374C 'manag':496C 'may':195C,236C,271C,302C,337C,383C,440C,479C,512C,544C,582C,635C 'memori':85B,313C,348C,394C,555C,646C 'meta':608C 'muftihaturrahmah':366C 'narendra':416C,614C 'neural':503C,535C 'nik':612C 'note':47B 'nuri':423C 'occur':141C 'octob':184C 'os':23A 'out-of-bound':2A,207C,244C,351C,397C,522C,558C,590C,649C 'overflow':317C 'page':157C,179C 'patch':143C 'peter':373C 'pilab':624C 'possibl':168C 'prefer':277C 'privaci':90B,276C 'privileg':80B 'process':231C,576C,645C 'product':177C 'protect':127C 'pwnkai23':421C 'rahul':663C 'raj':664C 'read':6A,81B,211C,346C,355C 'recent':148C 'red':609C 'redact':287C 'refer':161C 'releas':145C,149C,156C,183C 'remot':300C,438C 'research':261C,607C 'root':79B 'ruslan':371C,412C 'sakurai':222C 'sandbox':449C 'say':69B 'secur':46B,94C,104C,114C,122C,135C,155C,159C,173C,178C 'see':174C 'seiji':221C 'sensit':484C 'sequoia':39B,50B,98C,108C,118C,181C,191C,229C,266C,297C,333C,379C,435C,475C,508C,540C,574C,631C,674C 'servic':204C 'sever':67B 'singh':417C,615C 'song':422C 'state':495C 'store':431C 'support':101C 'system':58B,308C,343C,389C,518C,550C,641C 'talo':469C 'team':610C 'technolog':625C 'termin':241C,309C,344C,390C,519C,551C,587C,642C 'thanato':424C 'thoma':414C 'tian':425C 'tsytsarkin':613C 'tvos':27A 'unexpect':239C,307C,342C,388C,517C,549C,585C,640C 'updat':123C 'user':485C 'valid':458C,659C 'vendor':40B,42B 'vendor-advisori':41B 'video':580C 'visionos':29A 'vulner':162C 'wahyudi':501C 'watchos':31A 'webcont':448C 'wgg':427C 'write':83B,248C,392C,401C,526C,562C,594C,653C 'x':611C '章鱼哥':619C,667C","nicknames":[],"mitigations":[],"who_affected":"Any Mac running macOS Sequoia before 15.8.2 is affected, since the advisory covers system components that ordinary apps can reach. Attacks that need a malicious app or a crafted file are the main paths, so workstations that open untrusted files or run unvetted apps matter most. Machines already on 15.8.2 or a newer release can skip this entry.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update your Mac to macOS Sequoia 15.8.2: System Settings > General > Software Update.","first_public_at":"2026-05-11T21:18:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"lab","external_id":"https://support.apple.com/en-us/149523#CVE-2026-28991","url":"https://support.apple.com/en-us/149523","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-29T04:33:05+00:00","fetched_at":"2026-10-29T04:33:05+00:00","note":"Apple: About the security content of macOS Sequoia 15.8.2 - Apple Support"},{"source":"nvd","external_id":"CVE-2026-28991","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28991","severity":null,"published_at":"2026-05-11T21:18:59+00:00","modified_at":"2026-10-26T21:18:24+00:00","first_seen_at":"2026-10-29T04:41:59+00:00","fetched_at":"2026-10-29T04:41:59+00:00","note":null}],"documents":[{"id":14117,"url":"https://support.apple.com/en-us/149523","title":"Apple: About the security content of macOS Sequoia 15.8.2 - Apple Support","kind":"advisory","source":"lab","publisher":"vendor","text":"About the security content of macOS Sequoia 15.8.2 - Apple Support\n\n# About the security content of macOS Sequoia 15.8.2\n\nThis document describes the security content of macOS Sequoia 15.8.2.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## macOS Sequoia 15.8.2\n\nReleased October 26, 2026\n\n### Accelerate\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause a denial-of-service\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-28991: Seiji Sakurai (@HeapSmasher)\n\n### Accelerate Framework\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted image may lead to unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-86971: an anonymous researcher\n\n### Accounts\n\nAvailable for: macOS Sequoia\n\nImpact: A malicious application may be able to bypass Privacy preferences\n\nDescription: A logging issue was addressed with improved data redaction.\n\nCVE-2026-113898: Bhaswanth Chigurupati\n\n### afpfs\n\nAvailable for: macOS Sequoia\n\nImpact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-64767: Dave G.\n\n### APFS\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112525: We Muftihaturrahmah, Aswin Kumar Gokula Kannan, Ruslan Dautov, Peter Malone\n\n### APFS\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112536: Ruslan Dautov, Thomas Guillem, Narendra Singh (@_3P1C), Kwak Kiyong (@Pwnkai23), Song Nuri, Thanatos Tian (HKPolyU) & wgg with Diffract\n\n### App Store\n\nAvailable for: macOS Sequoia\n\nImpact: A remote attacker may be able to break out of the WebContent sandbox\n\nDescription: This issue was addressed with improved input validation.\n\nCVE-2026-112690: Claudio Bozzato and Francesco Benvenuto of Cisco Talos\n\n### Apple Intelligence\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-86920: Johan Wahyudi\n\n### Apple Neural Engine\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\n### Apple Neural Engine\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\n### AppleAVD\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112416: an anonymous researcher, Meta Red Team X - Nik Tsytsarkin, Narendra Singh (@_3P1C), Hcamael and 章鱼哥@aipy (aipyaipy.com), Dohyeon An @PILAB Technology, Inc\n\n### AppleAVD\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination or corrupt process memory\n\nDescription: An out-of-bounds write was addressed with improved input validation.\n\nCVE-2026-112415: Rahul Raj, Hcamael and 章鱼哥@aipy (aipyaipy.com)\n\n### AppleAVD\n\nAvailable for: macOS Sequoia\n\nImpact: A malicious app may be able to break out of its sandbox\n\nDescription: An information leakage was addressed with additional validation.\n\nCVE-2026-112704: Josh Maine of Calif.io\n\n### AppleMobileFileIntegrity\n\nAvailable for: macOS Sequoia\n\nImpact: A malicious app may be able to read or write to protected files\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-112539: Claudio Bozzato and Francesco Benvenuto of Cisco Talos\n\n### AppleRAID\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-112531: Chanwit Muenprakoddee (ChemIndy)\n\n### ArchiveService\n\nAvailable for: macOS Sequoia\n\nImpact: An app may bypass Gatekeeper checks\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-86937: YingMuo (@YingMuo) of DEVCORE Research Team, Paul Montgomery (@nullevent)\n\n### ArchiveService\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted file may bypass Gatekeeper checks\n\nDescription: A logic issue was addressed with improved checks.\n\nCVE-2026-112568: an anonymous researcher\n\n### Audio\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112546: lunar815, Nathaniel Oh (@calysteon), Piotr Jerzy Duszynski, an anonymous researcher, Surej Sekhar, r3pwnx (@r3pwnx), Lily Cohl (@GenericCoding)\n\n### Audio\n\nAvailable for: macOS Sequoia\n\nCVE-2026-112675: Lakshay Sharma (MrW0r57), Abodi Dawoud\n\n### AVEVideoEncoder\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112705: Marco Schmitt, Andrey Chernykh, Josh Maine of Calif.io\n\n### AVEVideoEncoder\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved input validation.\n\n### AVEVideoEncoder\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112470: Hcamael and 章鱼哥@aipy (aipyaipy.com)\n\nCVE-2026-112468: Hcamael and 章鱼哥@aipy (aipyaipy.com)\n\nCVE-2026-112469: Hcamael and 章鱼哥@aipy (aipyaipy.com)\n\n### AVEVideoEncoder\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\n### BOM\n\nImpact: A maliciously crafted ZIP archive may bypass Gatekeeper checks\n\nDescription: A file quarantine bypass was addressed with additional checks.\n\nCVE-2026-84610: Murray Mike, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### BOM\n\nImpact: Processing a maliciously crafted file may lead to heap corruption\n\nDescription: An out-of-bounds write issue was addressed with improved input validation.\n\n### BOM\n\nImpact: A maliciously crafted ZIP archive may bypass Gatekeeper checks\n\nCVE-2026-112672: 준우 이, Pasquale Scola\n\n### Calendar\n\nAvailable for: macOS Sequoia\n\nDescription: A permissions issue was addressed with additional restrictions.\n\n### Carbon Core\n\nAvailable for: macOS Sequoia\n\nDescription: A logging issue was addressed with improved data redaction.\n\nCVE-2026-84528: zenith\n\n### Carbon Core\n\nAvailable for: macOS Sequoia\n\nImpact: An app may bypass Gatekeeper checks\n\nDescription: A file quarantine bypass was addressed with additional checks.\n\nCVE-2026-86941: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### CloudKit\n\nAvailable for: macOS Sequoia\n\nImpact: A malicious app may be able to gain root privileges\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-86896: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### ColorSync\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted file may disclose process memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112429: Mateusz Jurczyk of Google Project Zero\n\n### Compression\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to disclose kernel memory\n\nDescription: A memory initialization issue was addressed with improved memory handling.\n\nCVE-2026-113910: Tucker Willenborg\n\n### configd\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to gain root privileges\n\nDescription: A parsing issue in the handling of directory paths was addressed with improved path validation.\n\nCVE-2026-112545: Frederick Kaludis (Coiffeur0x90), Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### Control Center\n\nAvailable for: macOS Sequoia\n\nImpact: A malicious application may be able to bypass Privacy preferences\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-112462: DEVADATH V L, Junyeong Lee (jylab.github.io), Weeraphat Srisutham, Yejun Kim, an anonymous researcher, Zwei Tasse Kaffee, Lakshay Sharma (MrW0r57)\n\n### copyfile\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to modify protected parts of the file system\n\nDescription: This issue was addressed with improved handling of symlinks.\n\n### Core Image\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted image may lead to unexpected process termination\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-112471: Meta Red Team X - Nik Tsytsarkin\n\n### CoreAudio\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination or corrupt process memory\n\nDescription: A race condition was addressed with improved locking.\n\nCVE-2026-112708: Nathaniel Oh (@calysteon)\n\n### CoreAudio\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds write was addressed with improved input validation.\n\n### CoreAudio\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n\nDescription: An out-of-bounds access issue was addressed with improved bounds checking.\n\nCVE-2026-113912: an anonymous researcher, 章鱼哥@aipy (aipyaipy.com), Roman Zabicki, Anna Groza (@pwnlambda) of Calif.io\n\n### CoreAudio\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination or corrupt process memory\n\nDescription: A buffer overflow issue was addressed with improved memory handling.\n\nCVE-2026-113907: Meta Red Team X - Nik Tsytsarkin\n\n### CoreAudio\n\nAvailable for: macOS Sequoia\n\nImpact: An attacker in radio range may be able to cause unexpected system termination\n\nDescription: A heap buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-112638: Altin Gashi, Përparim Mjeku, Altin Gashi\n\n### CoreGraphics\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted PDF file may lead to memory corruption\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112610: Meta Red Team X - Nik Tsytsarkin\n\nCVE-2026-112611: f4&Zhiniang Peng with HUST, Aobo Wang (@M4x_1997), Xiang Chen, Jakob Pammer, Anna Groza (@pwnlambda) of Calif.io, Piotr Jerzy Duszynski, an anonymous researcher\n\n### CoreMedia\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-86992: Niels Hofmans\n\n### CoreMedia\n\nImpact: Parsing a file may lead to an unexpected app termination or arbitrary code execution\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2026-112688: 정우 하 (@0xfa11babe), Chris Bailey - Short Circuit\n\n### CoreServicesUIAgent\n\nAvailable for: macOS Sequoia\n\nImpact: A maliciously crafted disk image may bypass Gatekeeper checks\n\nDescription: A logic issue was addressed with improved validation.\n\nCVE-2026-65368: an anonymous researcher\n\n### CoreText\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted font may result in the disclosure of process memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112656: Nurihan Kim (HanTul) working with TrendAI Zero Day Initiative\n\n### CUPS\n\nAvailable for: macOS Sequoia\n\nImpact: An app with App Sandbox restrictions may be able to escape the sandbox and execute code with root privileges\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-84545: Jurre van Bergen - Threatnotify, Mathis Mansière, 章鱼哥@aipy (aipyaipy.com）, Redon Gashi (Sentry)\n\n### CUPS\n\nAvailable for: macOS Sequoia\n\nImpact: A local attacker may be able to elevate their privileges\n\nDescription: A logic issue was addressed with improved checks.\n\n### CVMS\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to gain root privileges\n\nDescription: A logic issue was addressed with improved checks.\n\nCVE-2026-112530: Alfredo Pesoli (@__rev) of Bynar.io, Claudio Bozzato and Francesco Benvenuto of Cisco Talos\n\n### DesktopServices\n\nAvailable for: macOS Sequoia\n\nImpact: An app may bypass Gatekeeper checks\n\nDescription: A logic issue was addressed with improved checks.\n\nCVE-2026-112428: Koh M. Nakagawa (@tsunek0h) of FFRI Security, Inc., Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### Directory Utility\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to modify protected parts of the file system\n\nDescription: A path handling issue was addressed with improved validation.\n\nCVE-2026-112483: Csaba Fitzl (@theevilbit) of Iru, Lyutoon\n\n### Disk Images\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause a denial-of-service\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-112502: Narendra Singh (@_3P1C)\n\n### DiskArbitration\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to break out of its sandbox\n\nDescription: An access issue was addressed with additional sandbox restrictions.\n\nCVE-2026-112570: Andrey Chernykh (BypassLabs.ai), Keisuke Hosoda\n\n### dyld\n\nAvailable for: macOS Sequoia\n\nImpact: An attacker with memory write capability may be able to bypass pointer authentication codes and run arbitrary code\n\nDescription: The issue was addressed with improved memory handling.\n\n### dyld\n\nImpact: An app may be able to bypass sandbox restrictions\n\nCVE-2026-112534: an anonymous researcher\n\n### FileProvider\n\nAvailable for: macOS Sequoia\n\nDescription: A race condition was addressed with additional validation.\n\n### FontParser\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted font may result in the disclosure of process memory\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\n### FontParser\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112683: Hcamael and 章鱼哥@aipy (aipyaipy.com)\n\n### FontParser\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted font may result in the disclosure of process memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112642: Meta Red Team X - Nik Tsytsarkin\n\n### Game Center\n\nAvailable for: macOS Sequoia\n\nImpact: A user may be able to view sensitive user information\n\nDescription: A logging issue was addressed with improved data redaction.\n\nCVE-2026-20649: Asaf Cohen\n\n### GPU Drivers\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112593: f00l (@PPPF00L) and 3ndy1(@_3ndy1)\n\n### Grapher\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted file may lead to arbitrary code execution\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-86929: Anand (anandsreekumar.com)\n\n### Heimdal\n\nAvailable for: macOS Sequoia\n\nImpact: A remote attacker may cause an unexpected process termination\n\nDescription: A double free issue was addressed with improved memory management.\n\nCVE-2026-112410: Piotr Jerzy Duszynski\n\n### Heimdal\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause a denial-of-service\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-86942: He Wei (ギカク)\n\n### Help Viewer\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to access user-sensitive data\n\nDescription: This issue was addressed with improved handling of symlinks.\n\nCVE-2026-112523: powerprove, Michael Benich, Niels Hofmans, Christian Niel Angel of Protectiv IT Security Inc. (protectiv.ph), Lyutoon, Seung Je Seong, R4mbb, Wojciech Regula of SecuRing (wojciechregula.blog)\n\n### HFS\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112424: Peter Malone\n\n### HFS\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112475: Aswin Kumar Gokulakannan, Minseok Kim, Dave G., Thanatos Tian (HKPolyU) & wgg & xmr, Marco Schmitt\n\n### HFS\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted file may lead to heap corruption\n\nDescription: An out-of-bounds write issue was addressed with improved input validation.\n\nCVE-2026-112456: Jihwan Yoon, Yash Pandya, Parth Raval\n\n### iCloud\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An access issue was addressed with additional sandbox restrictions.\n\nCVE-2026-112647: Sattyam Yadav, onetwo, Christian Niel Angel of Protectiv IT Security Inc. (protectiv.ph), Robert Tran, Merrick Hare\n\n### ImageIO\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted image may result in memory corruption\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64750: Mateusz Jurczyk of Google Project Zero, Eddy Tsalolikhin, Johann Rehberger\n\n### ImageIO\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted image may result in disclosure of process memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112560: Wout van der Ploeg (woutvanderploeg.nl)\n\nCVE-2026-112627: Mateusz Jurczyk of Google Project Zero\n\n### ImageIO\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted image may result in disclosure of process memory\n\nDescription: A memory initialization issue was addressed with improved memory handling.\n\nCVE-2026-112571: sh3rlock (김보겸)\n\n### ImageIO\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted image may lead to unexpected app termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-86954: Mateusz Jurczyk of Google Project Zero\n\nCVE-2026-112629: Mateusz Jurczyk of Google Project Zero\n\nCVE-2026-112634: Mateusz Jurczyk of Google Project Zero\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may result in disclosure of process memory\n\nDescription: An uninitialized memory issue was addressed with improved memory handling.\n\nCVE-2026-112632: Mateusz Jurczyk of Google Project Zero\n\nCVE-2026-112630: Mateusz Jurczyk of Google Project Zero\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may result in memory corruption\n\nDescription: An integer underflow was addressed with improved input validation.\n\nCVE-2026-112625: Mateusz Jurczyk of Google Project Zero\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may lead to unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\n### IOGPUFamily\n\nAvailable for: macOS Sequoia\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-112533: Andrey Chernykh, Sihyun Roh (Compsec, SNU)\n\n### IOHIDFamily\n\nImpact: An attacker may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112515: Charles Stevenson, Mathis Mansière, Seung Je Seong\n\n### IOStorageFamily\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112554: Bhuwan Bhetwal, Kwak Kiyong (@Pwnkai23), Song Nuri, Nicolas Seriot, Tommy DeVoss from Braze Security Team (@thedawgyg), Tucker Willenborg, Navapon Premkasem, Aswin Kumar Gokulakannan, Peter Malone, Richard Zana\n\n### IOSurface\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A race condition was addressed with improved locking.\n\nCVE-2026-112477: an anonymous researcher\n\n### Kernel\n\nImpact: An app may be able to cause unexpected changes to copy-on-write memory\n\nDescription: A memory integrity issue was addressed with improved handling of copy-on-write pages.\n\n### Kernel\n\nImpact: An app may be able to gain root privileges\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-113900: Frederick Kaludis (Coiffeur0x90), YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab, Lakshay Sharma (MrW0r57)/WorstCase Labs., Ashish Kavishwar, Csaba Fitzl (@theevilbit) of Iru and Gergely Kalman (@gergely_kalman)\n\n### Kernel\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A type confusion issue was addressed with improved memory handling.\n\nCVE-2026-112606: Wang Yu\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-112532: Peter Malone\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-112517: Pasquale Scola, Cem Onat Karagun, Wout van der Ploeg (woutvanderploeg.nl), John Lussier, an anonymous researcher\n\n### Kernel\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-112516: an anonymous researcher, greenbynox\n\n### Kernel\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-112698: OpenAI, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nAvailable for: macOS Sequoia\n\nImpact: An attacker may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-112514: Marc Newlin of SkySafe, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., greenbynox\n\n### Kernel\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-84495: Wang Yu\n\n### Kernel\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-65350: Xinru Chi of Pangu Lab, Nebula Security (@nebusecurity), Tim Michaud (@TimGMichaud) of Aginor.ai\n\n### Kernel\n\nAvailable for: macOS Sequoia\n\nImpact: A malicious app may be able to break out of its sandbox\n\nDescription: A race condition was addressed with additional validation.\n\nCVE-2026-112543: f0r of MurphySec\n\n### Kernel\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112476: Arnold Cartagena, Matt Suiche (@msuiche) of Tolmo\n\n### Kernel\n\nAvailable for: macOS Sequoia\n\nImpact: An unprivileged attacker may be able to execute arbitrary code as root\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-112438: Jakob Pammer\n\n### Kernel\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-112501: Cem Onat Karagun\n\n### Kernel\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to bypass Privacy preferences\n\nCVE-2026-112624: Jerry L. Knot\n\n### libarchive\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112522: Eliya M., Viacheslav Radiukov, Tristan Madani (Talence Security), Robert Tran\n\n### libcryptex\n\nAvailable for: macOS Sequoia\n\nImpact: A malicious app may be able to create files in protected directories\n\nCVE-2026-86945: an anonymous researcher, Andrey Chernykh\n\n### libxpc\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to break out of its sandbox\n\nCVE-2026-112497: Claudio Bozzato and Francesco Benvenuto of Cisco Talos\n\n### Mail\n\nAvailable for: macOS Sequoia\n\nImpact: A remote attacker may be able to cause a denial-of-service\n\nDescription: A resource exhaustion issue was addressed with improved input validation.\n\nCVE-2026-112671: Nathaniel Oh (@calysteon)\n\n### Mail\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted message may lead to a denial-of-service\n\nDescription: A stack overflow was addressed with improved input validation.\n\nCVE-2026-112414: Daniel Rodríguez, Nathaniel Oh (@calysteon)\n\n### MediaAnalysis\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to access sensitive user data\n\nDescription: A race condition was addressed with additional validation.\n\nCVE-2026-113915: Abodi Dawoud, Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Ilya Andr (andrd3v) of Positive Technologies, Zhongquan Li (@Guluisacat)\n\n### Metal\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to read files outside of its sandbox\n\nDescription: An access issue was addressed with improved access restrictions.\n\nCVE-2026-84542: Mustafa Ahmed, an anonymous researcher\n\n### Model I/O\n\nImpact: Processing a maliciously crafted 3D model may lead to memory corruption\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-112565: Musaab Khan (@bxff), Hcamael and 章鱼哥@aipy (aipyaipy.com), Saoud Khalifah, stratan (@5tratan), Niels Hofmans\n\n### Model I/O\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112563: stratan (@5tratan)\n\n### Model I/O\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112413: Nathaniel Oh (@calysteon)\n\n### Model I/O\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted 3D model may lead to memory corruption\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112461: 진규정 (Gyujeong Jin, @G1uN4sh), Lucas Parnell, Nathaniel Oh (@calysteon), Meta Red Team X - Nik Tsytsarkin, YingMuo (@YingMuo) of DEVCORE Research Team, ret2happy (@ret2happy)\n\n### Model I/O\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted 3D model may lead to memory corruption\n\nDescription: The issue was addressed with improved memory handling.\n\n### Model I/O\n\nImpact: Processing a 3D model may lead to unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112486: Md Rasel Bhuyan (www.linkedin.com/in/rasel-bhuyan), Musaab Khan (@bxff)\n\n### ncurses\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause a denial-of-service\n\nDescription: A type confusion issue was addressed with improved memory handling.\n\nCVE-2026-112550: Jonathan Bar Or (@yo_yo_yo_jbo)\n\n### OpenBSM\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted audit file may corrupt process memory\n\nDescription: A stack buffer overflow was addressed through improved input validation.\n\n### PackageKit\n\nImpact: An app may be able to modify protected parts of the file system\n\nDescription: A race condition was addressed with improved handling of symbolic links.\n\nCVE-2026-112421: Csaba Fitzl (@theevilbit) of Iru and Gergely Kalman (@gergely_kalman)\n\n### PackageKit\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to modify protected parts of the file system\n\nDescription: A race condition was addressed with additional validation.\n\nCVE-2026-112442: Mickey Jin (@patch1t)\n\n### Photos Storage\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-65397: Varik Matevosyan (@D4RK7ET), an anonymous researcher\n\n### Photos Storage\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to bypass certain Privacy preferences\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-112660: Prafull Dhiman, Alto_00000\n\n### Photos Storage\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to access a user's Photos Library\n\n### ppp\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: The issue was addressed with improved checks.\n\nCVE-2026-113899: Siddharth Aeri\n\n### ppp\n\nAvailable for: macOS Sequoia\n\nImpact: A malicious app may be able to intercept network traffic\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-112542: Gabriel '0xv1n' Cardona, Mrunal Chawda, Kujtim Kryeziu (Sentry), Tristan Madani (Talence Security)\n\n### Printing\n\nAvailable for: macOS Sequoia\n\nImpact: A malicious app may be able to break out of its sandbox\n\nDescription: A parsing issue in the handling of directory paths was addressed with improved path validation.\n\nCVE-2026-112562: 도현 김, Ithrael, YEONGJAE SHIN, an anonymous researcher\n\n### quarantine\n\nAvailable for: macOS Sequoia\n\nImpact: A malicious application may bypass Gatekeeper checks\n\nDescription: This issue was addressed with improved validation of file attributes.\n\nCVE-2026-64789: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs (nosebeard.co), an anonymous researcher\n\n### quarantine\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to break out of its sandbox\n\nDescription: An access issue was addressed with additional sandbox restrictions.\n\nCVE-2026-112569: Csaba Fitzl (@theevilbit) of Iru, an anonymous researcher\n\nCVE-2026-112498: an anonymous researcher\n\n### RealityKit\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112491: Hongsik Kim (mnur)\n\n### Remote Management\n\nAvailable for: macOS Sequoia\n\nImpact: An attacker on the local network may be able to cause unexpected system termination or corrupt process memory\n\nDescription: A double free issue was addressed with improved memory management.\n\nCVE-2026-112457: Efstratios Kaplanellis (@5tratan) of Almamater Technologies, Nathaniel Oh (@calysteon)\n\n### Remote Management\n\nAvailable for: macOS Sequoia\n\nImpact: A user with screen sharing access may be able to view another user's screen\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-112480: Andrey Chernykh, ruitong (@abstract)\n\n### RemoteManagement\n\nAvailable for: macOS Sequoia\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: An authorization issue was addressed with improved access control.\n\nCVE-2026-112677: an anonymous researcher, Niels Hofmans, 도현 김, Junyeong Lee (jylab.github.io), Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs, Jonghoon Han (Aegis)\n\n### Sandbox\n\nAvailable for: macOS Sequoia\n\nImpact: An app with root privileges may be able to access private information\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-65392: Ahmad Al Harrizuan Izadin, Prathamesh Walunj, Csaba Fitzl (@theevilbit) of Iru\n\n### SceneKit\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a 3D model may result in disclosure of process memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112425: stratan (@5tratan)\n\n### SceneKit\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112423: Rahul Raj\n\n### SceneKit\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-112540: f4&Zhiniang Peng with HUST, Geonha Lee (@leegn4a), Kwak Kiyong (@Pwnkai23), Song Nuri, Wout van der Ploeg (woutvanderploeg.nl), Substrate, Piotr Jerzy Duszynski, Tristan Madani (Talence Security), Arni Hardarson (Neonix Security), an anonymous researcher\n\n### SceneKit\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted file may lead to heap corruption\n\nDescription: An out-of-bounds write issue was addressed with improved input validation.\n\nCVE-2026-112464: 정우 하 (@0xfa11babe), Narendra Singh (@_3P1C)\n\n### SceneKit\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted file may lead to unexpected process termination\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-86991: Cem Onat Karagun, Yujung Choi (@Dusker), Mathis Mansière, Rahul Raj\n\n### Screen Sharing\n\nAvailable for: macOS Sequoia\n\nImpact: Connecting to a malicious VNC server may cause a denial-of-service\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-112519: Piotr Jerzy Duszynski, Nathaniel Oh (@calysteon)\n\n### Screen Sharing Server\n\nAvailable for: macOS Sequoia\n\nImpact: A malicious app may be able to gain root privileges\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-65373: Stefan Esser (Calif), Alfredo Pesoli (@__rev) via Bynario Atlas (bynar.io), Anon Tuttu Venus, Nathaniel Oh (@calysteon)\n\n### Screen Sharing Server\n\nAvailable for: macOS Sequoia\n\nImpact: An attacker with the legacy VNC password for Screen Sharing may be able to copy files to the Mac\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-112473: Alfredo Pesoli (@__rev) via Bynario Atlas (bynar.io)\n\n### Screen Sharing Server\n\nAvailable for: macOS Sequoia\n\nImpact: An attacker on the local network may be able to corrupt process memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-112482: Nathaniel Oh (@calysteon)\n\n### Screen Sharing Server\n\nAvailable for: macOS Sequoia\n\nImpact: A malicious Screen Sharing peer may be able to create arbitrary symlinks as root\n\nDescription: A path handling issue was addressed with improved logic.\n\nCVE-2026-112511: Nathaniel Oh (@calysteon)\n\n### Screen Sharing Server\n\nAvailable for: macOS Sequoia\n\nImpact: A malicious application may be able to execute arbitrary code with system privileges\n\nDescription: This issue was addressed with improved file handling.\n\nCVE-2026-112484: Mahmoud Abdelmoniem\n\n### Screen Sharing Server\n\nAvailable for: macOS Sequoia\n\nImpact: A remote attacker may be able to cause unexpected app termination or heap corruption\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-84590: Nathaniel Oh (@calysteon), Narendra Singh (@_3P1C), koocolb, Tristan Madani (Talence Security)\n\n### Screen Sharing Server\n\nAvailable for: macOS Sequoia\n\nImpact: An attacker on the local network may be able to cause unexpected process termination or disclose process memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112481: Nathaniel Oh (@calysteon)\n\n### Security\n\nAvailable for: macOS Sequoia\n\nImpact: Processing web content may disclose sensitive information\n\nDescription: An input validation issue was addressed with improved input validation.\n\nCVE-2026-113913: Niels Hofmans, Stav Nir and Vladimir Tokarev\n\n### Security\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to break out of its sandbox\n\nDescription: The issue was addressed with improved checks.\n\nCVE-2026-65363: Arni Hardarson (Neonix Security), Csaba Fitzl (@theevilbit) of Iru and Gergely Kalman (@gergely_kalman)\n\n### Security\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to access sensitive user data\n\nDescription: A privacy issue was addressed with improved memory management.\n\nCVE-2026-86931: Pranav Gopalkrishnan, Alan Wang, Ailsa Sun, Hovav Shacham, Riccardo Paccagnella, Chris Fletcher, David Kohlbrenner\n\n### Security\n\nAvailable for: macOS Sequoia\n\nImpact: A sandboxed process may be able to circumvent sandbox restrictions\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-112521: Richard Hyunho Im (@richeeta) at Route Zero Security, Efstratios Kaplanellis (@5tratan) of Almamater Technologies\n\n### Security\n\nAvailable for: macOS Sequoia\n\nImpact: A local attacker may gain access to user's Keychain items\n\nDescription: This issue was addressed with improved permissions checking.\n\n### Security\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to gain root privileges\n\nDescription: A logic issue was addressed with improved checks.\n\nCVE-2026-112668: cnitlrt (@abstract), Roman Belovitskiy, Lyutoon, Art Pllana, Redon Gashi of Sentry, ruitong (@abstract), Franco Belman at Blackwing Intelligence, Surej Sekhar, Sihyun Roh (Compsec, SNU), lokerxx, Teodor Sorescu (@teodorsorescu), Eddy Tsalolikhin, Phillip Groves\n\nCVE-2026-112437: lokerxx\n\nCVE-2026-112434: ruitong (@abstract), lokerxx\n\n### Security\n\nAvailable for: macOS Sequoia\n\nImpact: An malicious app may be able to bypass certificate validation\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-112652: Aditya Kumar\n\n### Security\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to gain root privileges\n\nDescription: An authentication issue was addressed with improved validation of user attributes.\n\nCVE-2026-112430: ruitong (@abstract)\n\n### SecurityAgent\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to gain root privileges\n\nDescription: A downgrade issue was addressed with additional version checks.\n\nCVE-2026-112493: Mickey Jin (@patch1t)\n\n### Shortcuts\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-112559: Lucas Lammer, Stuart Wallace\n\nCVE-2026-112455: Rahul Raj, Chris Bailey - Short Circuit\n\n### Shortcuts\n\nAvailable for: macOS Sequ","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":14244,"url":"https://support.apple.com/en-us/127110","title":"Vendor advisory: support.apple.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: support.apple.com"},{"id":14245,"url":"https://support.apple.com/en-us/127115","title":"Vendor advisory: support.apple.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: support.apple.com"},{"id":14246,"url":"https://support.apple.com/en-us/127118","title":"Vendor advisory: support.apple.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: support.apple.com"},{"id":14247,"url":"https://support.apple.com/en-us/127119","title":"Vendor advisory: support.apple.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: support.apple.com"},{"id":14248,"url":"https://support.apple.com/en-us/127120","title":"Vendor advisory: support.apple.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: support.apple.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}