APPLE MACOS · CVE-2026-39874 · Vendor
FIX → 26.6 · 15.7.8 · 14.8.8
Apple's security notes for macOS Tahoe 26.6 list dozens of CVEs across system components such as Accounts, afpfs, AppleDouble, CoreAudio and Disk Images. Several entries say a local app could break out of its sandbox, gain root or corrupt kernel memory, and one says connecting to a malicious afpfs server may corrupt kernel memory.
first public Jul 27, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
The advisory covers Apple's macOS Tahoe system components; the entries listed here are not tied to a specific configuration in the sources. Most entries require a local app or user; the afpfs entries involve a remote server or network attacker. The sources do not say which entries are reachable without an account.
Not affected if unknown
Who cares apple, macos, macos-tahoe, vendor-advisory
Upgrade to 26.6 · 15.7.8 · 14.8.8
26.6 (per the advisory's title; the sources do not state a per-CVE fixed build)About the security content of macOS Tahoe 26.6 - Apple Support
This document describes the security content of macOS Tahoe 26.6.
For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.
Apple security documents reference vulnerabilities by CVE-ID when possible.
For more information about security, see the Apple Product Security page.
Released July 27, 2026
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: An access issue was addressed with additional sandbox restrictions.
CVE-2026-43819: Vinay Kumar Rasala (Xplo8E) from Appknox, Chris Bailey - Short Circuit, Omar Cerrito
Entry updated September 14, 2026
Available for: macOS Tahoe
Impact: An app may be able to gain root privileges
Description: A parsing issue in the handling of directory paths was addressed with improved path validation.
CVE-2026-43749: Adam Franke, Ashish Kunwar, Trung Nguyen (@everping) of CyStack
Available for: macOS Tahoe
Impact: An app may be able to fingerprint the user
Description: This issue was addressed with improved data protection.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
CVE-2026-64733: Rosyna Keller of Totally Not Malicious Software (paradisefacade.com)
Available for: macOS Tahoe
Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory
Description: A buffer overflow was addressed with improved bounds checking.
CVE-2026-64767: Dave G.
Impact: Connecting to a malicious afpfs server may lead to kernel memory corruption
Description: A buffer overflow was addressed with improved bounds checking.
CVE-2026-43815: Dave G.
Entry added September 14, 2026
Impact: A remote attacker may be able to cause a denial-of-service
Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2026-23918: Bartlomiej Dmitruk of striga.ai, Stanislaw Strzalkowski of isec.pl
Entry updated September 14, 2026
Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64695: Narendra Singh (@_3P1C), Peter Malone
Entry updated September 14, 2026
CVE-2026-43801: Rahul Raj
Description: A race condition was addressed with improved state handling.
CVE-2026-43781: Pinak Oza
Impact: A malicious app may be able to break out of its sandbox
CVE-2026-64737: Robert Mindo
CVE-2026-65353: 章鱼哥@aipyaipy.com, Chris Bailey - Short Circuit, N.M.Praveen Nawarathne (@zblockrat), Stuart Wallace
Entry added September 14, 2026
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-43748: Vladislav Shevchenko (Positive Technologies), an anonymous researcher, tamdao, Franco Belman at Blackwing Intelligence
Entry updated September 14, 2026
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory management.
CVE-2026-28928: Dun
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory management.
CVE-2026-65407: Franco Belman at Blackwing Intelligence
Entry added September 14, 2026
Impact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution
Description: A buffer overflow was addressed with improved bounds checking.
CVE-2026-43776: Rishabh Jain (rjcyber) of cyberplanet, Irvin Wang, Peter Malone, Nicolas Rabrenovic
Entry updated September 14, 2026
Impact: A local user may be able to read kernel memory
Description: A buffer overflow was addressed with improved bounds checking.
CVE-2026-43681: impost0r (ret2plt), David Ige - Beryllium Security
Impact: Mounting a malicious disk image may cause unexpected system termination
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-43761: lokerxx, Narendra Singh (@_3P1C), Lyutoon, Jordy Zomer (@pwningsystems), Richard Zana, Aswin Kumar Gokulakannan, George Stergiopoulos, InfoSec lab, Athens University of Economics and Business, Greece
Entry added September 14, 2026
Impact: A malicious application may be able to bypass Privacy preferences
CVE-2026-43672: 이재영
Impact: An app may be able to read files outside of its sandbox
Description: A permissions issue was addressed by removing the vulnerable code.
CVE-2026-43763: Pavan Nallamothu, Jared Reyes
Impact: An app may be able to break out of its sandbox
CVE-2026-64702: John Lussier
Impact: An app may be able to cause a denial-of-service
CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)
CVE-2026-43730: David Strnadel
Impact: An app may be able to execute arbitrary code with kernel privileges
Description: A buffer overflow was addressed with improved size validation.
CVE-2026-64747: Franco Belman at Blackwing Intelligence
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds read was addressed with improved bounds checking.
CVE-2026-64762: Dun, Franco Belman at Blackwing Intelligence
Impact: An app may be able to delete files for which it does not have permission
CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab
Impact: An app may be able to cause unexpected system termination or read kernel memory
CVE-2026-64698: an anonymous researcher, Richard Zana, Nathaniel Oh (@calysteon), Peter Malone
Impact: A maliciously crafted app may be able to bypass code signing enforcement
Description: A validation issue was addressed with improved input sanitization.
CVE-2026-43813: Anton Pakhunov
Impact: An app may be able to add contacts without user authorization
CVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel Febrero
Impact: Processing a maliciously crafted contact may leak sensitive data
CVE-2026-64734: Daniel Williams
CVE-2026-43797: Arni Hardarson (Neonix Security)
CVE-2026-43756: 이재영
Available for: macOS Tahoe
Impact: An app may be able to gain root privileges
Description: A race condition was addressed with improved state handling.
CVE-2026-43693: Gergely Kalman (@gergely_kalman)
Available for: macOS Tahoe
Impact: Processing a maliciously crafted audio file may corrupt process memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative
Available for: macOS Tahoe
Impact: Processing an audio stream in a maliciously crafted media file may terminate the process
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-43744: ret2happy, Mathis Mansière, an anonymous researcher
Entry updated September 14, 2026
Available for: macOS Tahoe
Impact: A remote attacker may be able to cause unexpected system termination
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-43803: Rahul Raj
Impact: An app may be able to access sensi
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.