--- id: "CVE-2026-64691" page: "https://infrastack.ai/live/CVE-2026-64691" kind: "vulnerability" aliases: ["CVE-2026-64691"] title: "apple macos: A buffer overflow was addressed with improved size validation" severity: "critical" cvss: 9.8 epss: null exploited: false status: "open" category: "infrastructure" products: [{"name": "macOS Tahoe", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["26.6"], "affected": ">= 26.0, < 26.6", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["apple", "infrastructure", "mac", "macos", "vendor-advisory"] not_affected_if: ["already-on-macos-26.6"] published_at: "2026-07-27T21:17:08+00:00" first_seen_at: "2026-11-13T20:39:14+00:00" updated_at: "2026-11-13T21:27:25+00:00" sources: [{"source": "lab", "url": "https://support.apple.com/en-us/128067", "first_seen_at": "2026-11-13T20:39:14+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64691", "first_seen_at": "2026-11-13T21:27:25+00:00"}] exploit_sources: [] --- # apple macos: A buffer overflow was addressed with improved size validation Link for people: https://infrastack.ai/live/CVE-2026-64691 (this .md is for agents) A buffer overflow in the macOS GPU drivers, fixed in macOS Tahoe 26.6, lets an app cause unexpected system termination. The advisory names no further impact for this entry. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:macOS Tahoe affected range not listed fixed no fixed version listed - vendor:apple macos affected >= 26.0, < 26.6 fixed 26.6 ## How to check - Confirm the Mac is on macOS Tahoe `26.6` or later, for example with `sw_vers -productVersion` - Note that the advisory's GPU Drivers entry gives no 'Available for' line, so affected hardware is unknown ## Fix - macOS Tahoe: `26.6` ## Timeline - 2026-11-13T20:39:14+00:00 lab https://support.apple.com/en-us/128067 — Apple: About the security content of macOS Tahoe 26.6 - Apple Support - 2026-11-13T21:27:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-64691 ## Documents - [advisory] macOS Tahoe 26.6 security content https://support.apple.com/en-us/128067 - [mentions] macOS Tahoe 26.6 security content https://support.apple.com/en-us/128067 ## From the sources About the security content of macOS Tahoe 26.6 - Apple Support # About the security content of macOS Tahoe 26.6 This document describes the security content of macOS Tahoe 26.6. ## About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page. Apple security documents reference vulnerabilities by CVE-ID when possible. For more information about security, see the Apple Product Security page. ## macOS Tahoe 26.6 Released July 27, 2026 ### Accounts Available for: macOS Tahoe Impact: An app may be able to access sensitive user data Description: An access issue was addressed with additional sandbox restrictions. CVE-2026-43819: Vinay Kumar Rasala (Xplo8E) from Appknox, Chris Bailey - Short Circuit, Omar Cerrito Entry updated September 14, 2026 ### Accounts Available for: macOS Tahoe Impact: An app may be able to gain root privileges Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-43749: Adam Franke, Ashish Kunwar, Trung Nguyen (@everping) of CyStack ### Accounts Framework Available for: macOS Tahoe Impact: An app may be able to fingerprint the user Description: This issue was addressed with improved data protection. CVE-2026-64733: Rosyna Keller of Totally Not Malicious Software (paradisefacade.com) ### afpfs Available for: macOS Tahoe Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-64767: Dave G. ### afpfs Impact: Connecting to a malicious afpfs server may lead to kernel memory corruption Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-43815: Dave G. Entry added September 14, 2026 ### apache Impact: A remote attacker may be able to cause a denial-of-service Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2026-23918: Bartlomiej Dmitruk of striga.ai, Stanislaw Strzalkowski of isec.pl Entry updated September 14, 2026 ### APFS Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64695: Narendra Singh (@_3P1C), Peter Malone Entry updated September 14, 2026 ### App Store CVE-2026-43801: Rahul Raj ### Apple Account Description: A race condition was addressed with improved state handling. CVE-2026-43781: Pinak Oza ### Apple Account Impact: A malicious app may be able to break out of its sandbox CVE-2026-64737: Robert Mindo ### Apple Account CVE-2026-65353: 章鱼哥@aipyaipy.com, Chris Bailey - Short Circuit, N.M.Praveen Nawarathne (@zblockrat), Stuart Wallace Entry added September 14, 2026 ### Apple Neural Engine Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43748: Vladislav Shevchenko (Positive Technologies), an anonymous researcher, tamdao, Franco Belman at Blackwing Intelligence Entry updated September 14, 2026 ### Apple Neural Engine Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-28928: Dun ### AppleAVD Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-65407: Franco Belman at Blackwing Intelligence Entry added September 14, 2026 ### AppleDouble Impact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-43776: Rishabh Jain (rjcyber) of cyberplanet, Irvin Wang, Peter Malone, Nicolas Rabrenovic Entry updated September 14, 2026 ### AppleRAID Impact: A local user may be able to read kernel memory Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-43681: impost0r (ret2plt), David Ige - Beryllium Security ### AppleRAID Impact: Mounting a malicious disk image may cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43761: lokerxx, Narendra Singh (@_3P1C), Lyutoon, Jordy Zomer (@pwningsystems), Richard Zana, Aswin Kumar Gokulakannan, George Stergiopoulos, InfoSec lab, Athens University of Economics and Business, Greece Entry added September 14, 2026 ### Assets Impact: A malicious application may be able to bypass Privacy preferences CVE-2026-43672: 이재영 ### ATS Impact: An app may be able to read files outside of its sandbox Description: A permissions issue was addressed by removing the vulnerable code. CVE-2026-43763: Pavan Nallamothu, Jared Reyes ### Audio Impact: An app may be able to break out of its sandbox CVE-2026-64702: John Lussier ### Audio Impact: An app may be able to cause a denial-of-service CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/) ### AuthKit CVE-2026-43730: David Strnadel ### AVEVideoEncoder Impact: An app may be able to execute arbitrary code with kernel privileges Description: A buffer overflow was addressed with improved size validation. CVE-2026-64747: Franco Belman at Blackwing Intelligence ### AVEVideoEncoder Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64762: Dun, Franco Belman at Blackwing Intelligence ### BackgroundAssets Impact: An app may be able to delete files for which it does not have permission CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab ### cd9660 Impact: An app may be able to cause unexpected system termination or read kernel memory CVE-2026-64698: an anonymous researcher, Richard Zana, Nathaniel Oh (@calysteon), Peter Malone ### CloudAttestation Impact: A maliciously crafted app may be able to bypass code signing enforcement Description: A validation issue was addressed with improved input sanitization. CVE-2026-43813: Anton Pakhunov ### Contacts Impact: An app may be able to add contacts without user authorization CVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel Febrero ### Contacts Impact: Processing a maliciously crafted contact may leak sensitive data CVE-2026-64734: Daniel Williams ### Contacts CVE-2026-43797: Arni Hardarson (Neonix Security) ### Control Center CVE-2026-43756: 이재영 ### Core Services Available for: macOS Tahoe Impact: An app may be able to gain root privileges Description: A race condition was addressed with improved state handling. CVE-2026-43693: Gergely Kalman (@gergely_kalman) ### CoreAudio Available for: macOS Tahoe Impact: Processing a maliciously crafted audio file may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative ### CoreAudio Available for: macOS Tahoe Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43744: ret2happy, Mathis Mansière, an anonymous researcher Entry updated September 14, 2026 ### CoreAudio Available for: macOS Tahoe Impact: A remote attacker may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43803: Rahul Raj ### CoreMedia Impact: An app may be able to access sensi --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_