{"id":"CVE-2026-64754","kind":"vulnerability","aliases":["CVE-2026-64754"],"related":[],"title":"An out-of-bounds write issue was addressed with improved bounds checking","description":"About the security content of iOS 26.6 and iPadOS 26.6 - Apple Support\n\n# About the security content of iOS 26.6 and iPadOS 26.6\n\nThis document describes the security content of iOS 26.6 and iPadOS 26.6.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## iOS 26.6 and iPadOS 26.6\n\nReleased July 27, 2026\n\n### Accessibility\n\nAvailable for: iPhone 11 and later\n\nImpact: An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n\nDescription: This issue was addressed through improved state management.\n\nCVE-2026-64732: Jorge Welch (@jorgwelch)\n\n### Accounts Framework\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to fingerprint the user\n\nDescription: This issue was addressed with improved data protection.\n\nCVE-2026-64733: Rosyna Keller of Totally Not Malicious Software (paradisefacade.com)\n\n### App Store\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to access sensitive user data\n\nDescription: This issue was addressed with improved checks.\n\nCVE-2026-43801: Rahul Raj\n\n### Apple Account\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-65353: 章鱼哥@aipyaipy.com, Chris Bailey - Short Circuit, N.M.Praveen Nawarathne (@zblockrat), Stuart Wallace\n\nEntry added September 14, 2026\n\n### Apple Neural Engine\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-28928: Dun\n\n### Apple Neural Engine\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43748: Vladislav Shevchenko (Positive Technologies), an anonymous researcher, tamdao, Franco Belman at Blackwing Intelligence\n\nEntry added September 14, 2026\n\n### AppleAVD\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-65407: Franco Belman at Blackwing Intelligence\n\nEntry added September 14, 2026\n\n### AppleDouble\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-43776: Irvin Wang, Peter Malone, Nicolas Rabrenovic, Rishabh Jain (rjcyber) of cyberplanet\n\nEntry updated September 14, 2026\n\n### Audio\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause a denial-of-service\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\n### AuthKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to fingerprint the user\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-43730: David Strnadel\n\n### AVEVideoEncoder\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to execute arbitrary code with kernel privileges\n\nDescription: A buffer overflow was addressed with improved size validation.\n\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\n### BackgroundAssets\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to delete files for which it does not have permission\n\nDescription: A permissions issue was addressed with improved validation.\n\nCVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab\n\n### Books\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to modify protected parts of the file system\n\nDescription: A race condition was addressed with improved checks.\n\nCVE-2026-43811: Rodolphe Brunetti (@eisw0lf) of Lupus Nova\n\n### CloudAttestation\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A maliciously crafted app may be able to bypass code signing enforcement\n\nDescription: A validation issue was addressed with improved input sanitization.\n\nCVE-2026-43813: Anton Pakhunov\n\n### Contacts\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to add contacts without user authorization\n\nDescription: An authorization issue was addressed with improved validation.\n\nCVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel Febrero\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted contact may leak sensitive data\n\nDescription: The issue was addressed with improved checks.\n\nCVE-2026-64734: Daniel Williams\n\n### Contacts\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to access information about a user's contacts\n\nCVE-2026-43797: Arni Hardarson (Neonix Security)\n\n### CoreAudio\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted audio file may corrupt process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\n### CoreAudio\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing an audio stream in a maliciously crafted media file may terminate the process\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43744: ret2happy, Mathis Mansière, an anonymous researcher\n\nEntry updated September 14, 2026\n\n### CoreAudio\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A remote attacker may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43803: Rahul Raj\n\n### CoreMedia\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\n### CoreMedia Video Toolbox\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43702: Nathaniel Oh (@calysteon)\n\nEntry added September 14, 2026\n\n### curl\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Authentication credentials may be sent to a server on another origin\n\n### DriverKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An attacker with physical access to a locked device may be able to view sensitive user information\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-43753: Niels Hofmans\n\n### Foundation\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A malicious app may be able to access protected user data\n\nDescription: The issue was addressed with improved input sanitization.\n\nCVE-2026-43714: an anonymous researcher\n\n### FrontBoard\n\nAvailable for: iPhone 11 and later, iPad P","summary":"Apple's iOS 26.6 and iPadOS 26.6 release fixes a batch of flaws, most of which let an app or someone with physical access read sensitive data, cause crashes, or bypass checks. The advisory excerpt does not describe CVE-2026-64754 specifically, so its exact impact is unknown.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"apple ipados","fixed":["26.6"],"affected":"< 26.6","ecosystem":"vendor"},{"name":"apple iphone os","fixed":["26.6"],"affected":"< 26.6","ecosystem":"vendor"},{"name":"apple macos","fixed":["14.8.8"],"affected":">= 14.0, < 14.8.8","ecosystem":"vendor"},{"name":"apple macos","fixed":["15.7.8"],"affected":">= 15.0, < 15.7.8","ecosystem":"vendor"},{"name":"apple macos","fixed":["26.6"],"affected":">= 26.0, < 26.6","ecosystem":"vendor"},{"name":"apple tvos","fixed":["26.6"],"affected":"< 26.6","ecosystem":"vendor"},{"name":"apple visionos","fixed":["26.6"],"affected":"< 26.6","ecosystem":"vendor"},{"name":"apple watchos","fixed":["26.6"],"affected":"< 26.6","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apple","ios","ipad","ipados","iphone","vendor","vendor-advisory"],"not_affected_if":[],"how_to_check":"- Check the version under Settings > General > About; anything below `26.6` on iPhone or iPad predates the fix.\n- Look up CVE-2026-64754 on the Apple advisory pages; the excerpt given does not list it.","fix":"- iOS `26.6`\n- iPadOS `26.6`","status":"open","published_at":"2026-07-27T21:17:13+00:00","first_seen_at":"2026-11-13T20:39:10+00:00","triaged_at":"2026-11-13T20:39:58+00:00","updated_at":"2026-11-13T21:27:25+00:00","category":"vendor","confidence":0.3,"triage":{"at":"2026-11-13T20:39:58Z","model":"claude-haiku-5-5","output":{"fix":"- iOS `26.6`\n- iPadOS `26.6`","reach":"unknown","title":"Apple iOS and iPadOS 26.6: security update fixes many flaws","impact":"medium","summary":"Apple's iOS 26.6 and iPadOS 26.6 release fixes a batch of flaws, most of which let an app or someone with physical access read sensitive data, cause crashes, or bypass checks. The advisory excerpt does not describe CVE-2026-64754 specifically, so its exact impact is unknown.","audience":"everyone","category":"vendor","nicknames":[],"who_cares":["ios","ipados","iphone","ipad"],"confidence":0.3,"fix_status":"available","needs_auth":"unknown","worst_case":"Mixed; some bundled flaws allow code execution or data access","analyst_note":"Confirm whether CVE-2026-64754 is listed in the iOS 26.6 advisory at support.apple.com/en-us/128066 and get its component and impact.","how_to_check":"- Check the version under Settings > General > About; anything below `26.6` on iPhone or iPad predates the fix.\n- Look up CVE-2026-64754 on the Apple advisory pages; the excerpt given does not list it.","plain_action":"Install iOS 26.6 on your iPhone or iPadOS 26.6 on your iPad.","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Owners of iPhone and iPad devices running earlier versions of iOS or iPadOS. The advisory lists many components and attack types, so the entry for this specific CVE needs confirming against the full Apple page.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001803,"input_tokens":9360,"output_tokens":1735,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A,85B,231C,298C,370C,438C,523C,595C,680C '-28928':524C '-43748':596C '-43801':371C '-64732':232C '-64733':299C '-64754':16A,19A,86B '-65353':439C '-65407':681C '11':201C,241C,254C,313C,326C,379C,392C,462C,475C,532C,545C,619C,632C,696C,709C '12.9':246C,318C,384C,467C,537C,624C,701C '14':454C,613C,690C '1st':256C,328C,394C,477C,547C,634C,711C '2026':196C,455C,614C,691C '26.6':49B,52B,100C,103C,112C,115C,124C,127C,189C,192C '27':195C '3rd':248C,262C,320C,334C,386C,400C,469C,483C,539C,553C,626C,640C,703C,717C '5th':274C,346C,412C,495C,565C,652C '8th':267C,339C,405C,488C,558C,645C 'abl':212C,283C,355C,421C,504C,574C,661C 'access':69B,197C,209C,214C,357C,423C 'account':236C,375C 'add':452C,611C,688C 'address':9A,225C,292C,365C,432C,517C,589C,674C 'advisori':45B,79B 'aipyaipy.com':441C 'air':261C,333C,399C,482C,552C,639C,716C 'anonym':602C 'app':64B,280C,308C,352C,418C,501C,571C,658C 'appl':37B,46B,104C,129C,136C,162C,166C,184C,374C,456C,526C 'apple':20A,22A,25A,27A,29A,31A,33A,35A 'appleavd':615C 'appledoubl':692C 'attack':206C 'author':429C 'avail':155C,198C,238C,310C,376C,459C,529C,616C,693C 'bailey':443C 'batch':56B 'belman':606C,683C 'blackw':608C,685C 'bound':5A,12A,585C,592C 'bypass':76B 'caus':73B,506C,576C,663C 'check':13A,77B,368C,593C 'chris':442C 'circuit':445C 'confirm':142C 'content':97C,109C,121C 'crash':74B 'custom':134C 'cve':14A,17A,84B,173C,230C,297C,369C,437C,522C,594C,679C 'cve-id':172C 'data':72B,217C,295C,360C,426C 'describ':83B,118C 'descript':221C,288C,361C,427C,510C,580C,667C 'disclos':139C 'discuss':140C 'document':117C,168C 'doesn':137C 'dun':525C 'engin':458C,528C 'entri':451C,610C,687C 'exact':90B 'excerpt':80B 'fingerprint':285C 'fix':54B 'flaw':58B 'framework':237C 'franco':605C,682C 'free':514C,671C 'generat':249C,257C,263C,268C,275C,321C,329C,335C,340C,347C,387C,395C,401C,406C,413C,470C,478C,484C,489C,496C,540C,548C,554C,559C,566C,627C,635C,641C,646C,653C,704C,712C,718C 'id':174C 'impact':91B,204C,278C,350C,416C,499C,569C,656C 'improv':11A,227C,294C,367C,434C,519C,591C,676C 'inch':247C,255C,319C,327C,385C,393C,468C,476C,538C,546C,625C,633C,702C,710C 'inform':179C 'intellig':609C,686C 'investig':147C 'io':38B,48B,99C,111C,123C,188C 'ipad':39B,244C,252C,260C,266C,272C,316C,324C,332C,338C,344C,382C,390C,398C,404C,410C,465C,473C,481C,487C,493C,535C,543C,551C,557C,563C,622C,630C,638C,644C,650C,699C,707C,715C 'ipado':40B,51B,102C,114C,126C,191C 'ipados':21A 'iphon':41B,200C,219C,240C,312C,378C,461C,531C,618C,695C 'iphone':23A 'issu':7A,144C,223C,290C,363C,430C,515C,587C,672C 'jorg':233C 'jorgwelch':235C 'juli':194C 'keller':301C 'later':203C,243C,251C,259C,265C,270C,277C,315C,323C,331C,337C,342C,349C,381C,389C,397C,403C,408C,415C,464C,472C,480C,486C,491C,498C,534C,542C,550C,556C,561C,568C,621C,629C,637C,643C,648C,655C,698C,706C,714C 'let':62B 'list':159C 'macos':26A,28A,30A 'malici':305C 'manag':229C,436C,521C,678C 'may':210C,281C,353C,419C,502C,572C,659C 'memori':520C,677C 'mini':273C,345C,411C,494C,564C,651C 'mirror':220C 'n.m.praveen':446C 'nawarathn':447C 'neural':457C,527C 'occur':149C 'os':24A 'out-of-bound':2A,582C 'page':165C,187C 'paradisefacade.com':307C 'patch':151C 'physic':68B,208C 'posit':599C 'possibl':176C 'pro':245C,253C,317C,325C,383C,391C,466C,474C,536C,544C,623C,631C,700C,708C 'product':185C 'protect':135C,296C 'rahul':372C 'raj':373C 'read':70B 'recent':156C 'refer':169C 'releas':53B,153C,157C,164C,193C 'research':603C 'rosyna':300C 'secur':96C,108C,120C,130C,143C,163C,167C,181C,186C 'see':182C 'sensit':71B,215C,358C,424C 'septemb':453C,612C,689C 'shevchenko':598C 'short':444C 'softwar':306C 'someon':66B 'specif':87B 'state':228C,435C 'store':309C 'stuart':449C 'support':105C 'system':508C,578C,665C 'tamdao':604C 'technolog':600C 'termin':509C,579C,666C 'total':303C 'tvos':32A 'unexpect':507C,577C,664C 'unknown':93B 'updat':131C 'use':512C,669C 'user':216C,287C,359C,425C 'vendor':42B,44B 'vendor-advisori':43B 'visionos':34A 'vladislav':597C 'vulner':170C 'wallac':450C 'watchos':36A 'welch':234C 'write':6A,586C 'zblockrat':448C '章鱼哥':440C","nicknames":[],"mitigations":[],"who_affected":"Owners of iPhone and iPad devices running earlier versions of iOS or iPadOS. The advisory lists many components and attack types, so the entry for this specific CVE needs confirming against the full Apple page.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Install iOS 26.6 on your iPhone or iPadOS 26.6 on your iPad.","pkeys":["appleipados","appleiphoneos","applemacos","appletvos","applevisionos","applewatchos","ipados","iphoneos","macos","tvos","visionos","watchos"],"ptokens":["apple","ipados","iphone","macos","os","tvos","visionos","watchos"],"labels":["apple","ios","ipad","ipados","iphone","medium","vendor","vendoradvisory"],"campaign_type":null,"search_a":"'-2026':15A,18A '-64754':16A,19A 'address':9A 'apple':20A,22A,25A,27A,29A,31A,33A,35A 'bound':5A,12A 'check':13A 'cve':14A,17A 'improv':11A 'ipados':21A 'iphone':23A 'issu':7A 'macos':26A,28A,30A 'os':24A 'out-of-bound':2A 'tvos':32A 'visionos':34A 'watchos':36A 'write':6A","search_b":"'-2026':85B '-64754':86B '26.6':49B,52B 'access':69B 'advisori':45B,79B 'app':64B 'appl':37B,46B 'batch':56B 'bypass':76B 'caus':73B 'check':77B 'crash':74B 'cve':84B 'data':72B 'describ':83B 'exact':90B 'excerpt':80B 'fix':54B 'flaw':58B 'impact':91B 'io':38B,48B 'ipad':39B 'ipado':40B,51B 'iphon':41B 'let':62B 'physic':68B 'read':70B 'releas':53B 'sensit':71B 'someon':66B 'specif':87B 'unknown':93B 'vendor':42B,44B 'vendor-advisori':43B","search_c":"'-2026':231C,298C,370C,438C,523C,595C,680C '-28928':524C '-43748':596C '-43801':371C '-64732':232C '-64733':299C '-65353':439C '-65407':681C '11':201C,241C,254C,313C,326C,379C,392C,462C,475C,532C,545C,619C,632C,696C,709C '12.9':246C,318C,384C,467C,537C,624C,701C '14':454C,613C,690C '1st':256C,328C,394C,477C,547C,634C,711C '2026':196C,455C,614C,691C '26.6':100C,103C,112C,115C,124C,127C,189C,192C '27':195C '3rd':248C,262C,320C,334C,386C,400C,469C,483C,539C,553C,626C,640C,703C,717C '5th':274C,346C,412C,495C,565C,652C '8th':267C,339C,405C,488C,558C,645C 'abl':212C,283C,355C,421C,504C,574C,661C 'access':197C,209C,214C,357C,423C 'account':236C,375C 'add':452C,611C,688C 'address':225C,292C,365C,432C,517C,589C,674C 'aipyaipy.com':441C 'air':261C,333C,399C,482C,552C,639C,716C 'anonym':602C 'app':280C,308C,352C,418C,501C,571C,658C 'appl':104C,129C,136C,162C,166C,184C,374C,456C,526C 'appleavd':615C 'appledoubl':692C 'attack':206C 'author':429C 'avail':155C,198C,238C,310C,376C,459C,529C,616C,693C 'bailey':443C 'belman':606C,683C 'blackw':608C,685C 'bound':585C,592C 'caus':506C,576C,663C 'check':368C,593C 'chris':442C 'circuit':445C 'confirm':142C 'content':97C,109C,121C 'custom':134C 'cve':173C,230C,297C,369C,437C,522C,594C,679C 'cve-id':172C 'data':217C,295C,360C,426C 'describ':118C 'descript':221C,288C,361C,427C,510C,580C,667C 'disclos':139C 'discuss':140C 'document':117C,168C 'doesn':137C 'dun':525C 'engin':458C,528C 'entri':451C,610C,687C 'fingerprint':285C 'framework':237C 'franco':605C,682C 'free':514C,671C 'generat':249C,257C,263C,268C,275C,321C,329C,335C,340C,347C,387C,395C,401C,406C,413C,470C,478C,484C,489C,496C,540C,548C,554C,559C,566C,627C,635C,641C,646C,653C,704C,712C,718C 'id':174C 'impact':204C,278C,350C,416C,499C,569C,656C 'improv':227C,294C,367C,434C,519C,591C,676C 'inch':247C,255C,319C,327C,385C,393C,468C,476C,538C,546C,625C,633C,702C,710C 'inform':179C 'intellig':609C,686C 'investig':147C 'io':99C,111C,123C,188C 'ipad':244C,252C,260C,266C,272C,316C,324C,332C,338C,344C,382C,390C,398C,404C,410C,465C,473C,481C,487C,493C,535C,543C,551C,557C,563C,622C,630C,638C,644C,650C,699C,707C,715C 'ipado':102C,114C,126C,191C 'iphon':200C,219C,240C,312C,378C,461C,531C,618C,695C 'issu':144C,223C,290C,363C,430C,515C,587C,672C 'jorg':233C 'jorgwelch':235C 'juli':194C 'keller':301C 'later':203C,243C,251C,259C,265C,270C,277C,315C,323C,331C,337C,342C,349C,381C,389C,397C,403C,408C,415C,464C,472C,480C,486C,491C,498C,534C,542C,550C,556C,561C,568C,621C,629C,637C,643C,648C,655C,698C,706C,714C 'list':159C 'malici':305C 'manag':229C,436C,521C,678C 'may':210C,281C,353C,419C,502C,572C,659C 'memori':520C,677C 'mini':273C,345C,411C,494C,564C,651C 'mirror':220C 'n.m.praveen':446C 'nawarathn':447C 'neural':457C,527C 'occur':149C 'out-of-bound':582C 'page':165C,187C 'paradisefacade.com':307C 'patch':151C 'physic':208C 'posit':599C 'possibl':176C 'pro':245C,253C,317C,325C,383C,391C,466C,474C,536C,544C,623C,631C,700C,708C 'product':185C 'protect':135C,296C 'rahul':372C 'raj':373C 'recent':156C 'refer':169C 'releas':153C,157C,164C,193C 'research':603C 'rosyna':300C 'secur':96C,108C,120C,130C,143C,163C,167C,181C,186C 'see':182C 'sensit':215C,358C,424C 'septemb':453C,612C,689C 'shevchenko':598C 'short':444C 'softwar':306C 'state':228C,435C 'store':309C 'stuart':449C 'support':105C 'system':508C,578C,665C 'tamdao':604C 'technolog':600C 'termin':509C,579C,666C 'total':303C 'unexpect':507C,577C,664C 'updat':131C 'use':512C,669C 'user':216C,287C,359C,425C 'vladislav':597C 'vulner':170C 'wallac':450C 'welch':234C 'write':586C 'zblockrat':448C '章鱼哥':440C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-27T21:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"lab","external_id":"https://support.apple.com/en-us/128066#CVE-2026-64754","url":"https://support.apple.com/en-us/128066","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-13T20:39:10+00:00","fetched_at":"2026-11-13T20:39:10+00:00","note":"Apple: About the security content of iOS 26.6 and iPadOS 26.6 - Apple Support"},{"source":"lab","external_id":"https://support.apple.com/en-us/128067#CVE-2026-64754","url":"https://support.apple.com/en-us/128067","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-13T20:39:15+00:00","fetched_at":"2026-11-13T20:39:15+00:00","note":"Apple: About the security content of macOS Tahoe 26.6 - Apple Support"},{"source":"lab","external_id":"https://support.apple.com/en-us/128071#CVE-2026-64754","url":"https://support.apple.com/en-us/128071","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-13T20:39:19+00:00","fetched_at":"2026-11-13T20:39:19+00:00","note":"Apple: About the security content of macOS Sequoia 15.7.8 - Apple Support"},{"source":"lab","external_id":"https://support.apple.com/en-us/128072#CVE-2026-64754","url":"https://support.apple.com/en-us/128072","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-13T20:39:20+00:00","fetched_at":"2026-11-13T20:39:20+00:00","note":"Apple: About the security content of macOS Sonoma 14.8.8 - Apple Support"},{"source":"lab","external_id":"https://support.apple.com/en-us/128069#CVE-2026-64754","url":"https://support.apple.com/en-us/128069","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-13T20:39:21+00:00","fetched_at":"2026-11-13T20:39:21+00:00","note":"Apple: About the security content of tvOS 26.6 - Apple Support"},{"source":"nvd","external_id":"CVE-2026-64754","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64754","severity":null,"published_at":"2026-07-27T21:17:13+00:00","modified_at":"2026-07-29T19:50:43+00:00","first_seen_at":"2026-11-13T21:27:25+00:00","fetched_at":"2026-11-13T21:27:25+00:00","note":null}],"documents":[{"id":62496,"url":"https://support.apple.com/en-us/128066","title":"Apple: About the security content of iOS 26.6 and iPadOS 26.6 - Apple Support","kind":"vendor","source":"nvd","publisher":"vendor","text":"About the security content of iOS 26.6 and iPadOS 26.6 - Apple Support\n\n# About the security content of iOS 26.6 and iPadOS 26.6\n\nThis document describes the security content of iOS 26.6 and iPadOS 26.6.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## iOS 26.6 and iPadOS 26.6\n\nReleased July 27, 2026\n\n### Accessibility\n\nAvailable for: iPhone 11 and later\n\nImpact: An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n\nDescription: This issue was addressed through improved state management.\n\nCVE-2026-64732: Jorge Welch (@jorgwelch)\n\n### Accounts Framework\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to fingerprint the user\n\nDescription: This issue was addressed with improved data protection.\n\nCVE-2026-64733: Rosyna Keller of Totally Not Malicious Software (paradisefacade.com)\n\n### App Store\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to access sensitive user data\n\nDescription: This issue was addressed with improved checks.\n\nCVE-2026-43801: Rahul Raj\n\n### Apple Account\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-65353: 章鱼哥@aipyaipy.com, Chris Bailey - Short Circuit, N.M.Praveen Nawarathne (@zblockrat), Stuart Wallace\n\nEntry added September 14, 2026\n\n### Apple Neural Engine\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-28928: Dun\n\n### Apple Neural Engine\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43748: Vladislav Shevchenko (Positive Technologies), an anonymous researcher, tamdao, Franco Belman at Blackwing Intelligence\n\nEntry added September 14, 2026\n\n### AppleAVD\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-65407: Franco Belman at Blackwing Intelligence\n\nEntry added September 14, 2026\n\n### AppleDouble\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-43776: Irvin Wang, Peter Malone, Nicolas Rabrenovic, Rishabh Jain (rjcyber) of cyberplanet\n\nEntry updated September 14, 2026\n\n### Audio\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause a denial-of-service\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\n### AuthKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to fingerprint the user\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-43730: David Strnadel\n\n### AVEVideoEncoder\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to execute arbitrary code with kernel privileges\n\nDescription: A buffer overflow was addressed with improved size validation.\n\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\n### BackgroundAssets\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to delete files for which it does not have permission\n\nDescription: A permissions issue was addressed with improved validation.\n\nCVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab\n\n### Books\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to modify protected parts of the file system\n\nDescription: A race condition was addressed with improved checks.\n\nCVE-2026-43811: Rodolphe Brunetti (@eisw0lf) of Lupus Nova\n\n### CloudAttestation\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A maliciously crafted app may be able to bypass code signing enforcement\n\nDescription: A validation issue was addressed with improved input sanitization.\n\nCVE-2026-43813: Anton Pakhunov\n\n### Contacts\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to add contacts without user authorization\n\nDescription: An authorization issue was addressed with improved validation.\n\nCVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel Febrero\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted contact may leak sensitive data\n\nDescription: The issue was addressed with improved checks.\n\nCVE-2026-64734: Daniel Williams\n\n### Contacts\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to access information about a user's contacts\n\nCVE-2026-43797: Arni Hardarson (Neonix Security)\n\n### CoreAudio\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted audio file may corrupt process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\n### CoreAudio\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing an audio stream in a maliciously crafted media file may terminate the process\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43744: ret2happy, Mathis Mansière, an anonymous researcher\n\nEntry updated September 14, 2026\n\n### CoreAudio\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A remote attacker may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43803: Rahul Raj\n\n### CoreMedia\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\n### CoreMedia Video Toolbox\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43702: Nathaniel Oh (@calysteon)\n\nEntry added September 14, 2026\n\n### curl\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Authentication credentials may be sent to a server on another origin\n\n### DriverKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An attacker with physical access to a locked device may be able to view sensitive user information\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-43753: Niels Hofmans\n\n### Foundation\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A malicious app may be able to access protected user data\n\nDescription: The issue was addressed with improved input sanitization.\n\nCVE-2026-43714: an anonymous researcher\n\n### FrontBoard\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to access sensitive user data\n\nDescription: This issue was addressed by using HTTPS when sending information over the network.\n\nCVE-2026-64742: Huỳnh Tấn Ngàn\n\n### Game Center\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A malicious app may be able to break out of its sandbox\n\nDescription: A parsing issue in the handling of directory paths was addressed with improved path validation.\n\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\n### Game Center\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to access sensitive user data\n\nDescription: This issue was addressed with improved data protection.\n\nCVE-2026-43796: Ilya Andr (andrd3v) of Positive Technologies, Stanislav Jelezoglo\n\n### Heimdal\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause a denial-of-service\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-64692: Redon Gashi\n\n### HFS\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-64705: Surya Kushwaha, Peter Malone, Dave G.\n\nEntry added September 14, 2026\n\n### ImageIO\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted texture may lead to unexpected app termination\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative\n\n### ImageIO\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted image may lead to arbitrary code execution\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-43818: an anonymous researcher\n\n### ImageIO\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted image may corrupt process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64716: Arni Hardarson, Jonathan Alush-Aben, Peter Malone\n\n### ImageIO\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: The issue was addressed with improved bounds checks.\n\nCVE-2026-64758: 진규정 (Gyujeong Jin, @G1uN4sh)\n\n### ImageIO\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted file may lead to a denial-of-service\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64754: PETOWORKS의 Bugeun Choi (@Bugeun), Rahul Raj\n\n### ImageIO\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted image may lead to a denial-of-service\n\nDescription: A type confusion issue was addressed with improved checks.\n\nCVE-2026-64693: Geonha Lee (@leegn4a)\n\n### IOKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-43805: 이재영\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64749: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ashish Kunwar, Hiroki Imai (LAC Co., Ltd.), hxr1\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-43778: Ashish Kunwar, f0r of MurphySec, Feng Xue and XGPT of ThreatBook, Mahmoud Abdelmoniem, an anonymous researcher, Wang Yu, Lyutoon, Hiroki Imai (LAC Co., Ltd.), DARKNAVY (@DarkNavyOrg), Fábio Luís @scanpt, Nicolas Rabrenovic\n\nEntry updated September 14, 2026\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to disclose kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64709: Pasquale Scola, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A remote attacker may be able to bypass network filters\n\nDescription: An inconsistent user interface issue was addressed with improved state management.\n\nCVE-2026-64735: Gor Aleksanyan\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43739: impost0r (ret2plt), Ruslan Dautov, Aleksandr Tarasikov, jay, Dhiyanesh Selvaraj (@redroot97), Vinay Kumar Rasala (Xplo8E) from Appknox, Lyutoon, DongJun Kim (smlijun) with UIUC, Hwiwon Lee (hwiwonl) with UIUC, Jongseong Kim (nevul37) with UIUC, Younggi Park (grill66) with UIUC, Peter Malone, an anonymous researcher, Hari Shanmugam (The Hxr1), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Marco Grassi, Dun, Daniele Castronovo, Michal Kosiorek\n\nCVE-2026-43816: Josh Maine of Calif.io, Ruslan Dautov, 재영 정, @rootxran (Rao Ali Nawaz), Chanwit Muenprakoddee (ChemIndy), an anonymous researcher, Ye Zhang (@VAR10CK) of Baidu Security, Franco Belman at Blackwing Intelligence, Christian Figueroa, Johnny Franks (@0xjohnny), Ashmit Sharma & Atul RV, Peter Malone, Muhamad Syaiful, Muneeb Amin Bhat, Dhiyanesh Selvaraj (@redroot97), Ali Marzouq, Bountyy Oy - Mihalis Haatainen, Huy Nguyen (@34306) of Calif.io\n\nEntry updated September 14, 2026\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-43822: Eddy Tsalolikhin, Michal Kosiorek\n\nCVE-2026-64729: Josh Maine of Calif.io, beist, Adam Doupé of ASU SEFCOM, Dun, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Johnny Franks (@0xjohnny)\n\nCVE-2026-43814: Somair Ansar, Huy Nguyen (@34306) of Calif.io\n\nCVE-2026-64700: Asjid Kalam (@odinshell)\n\nCVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nEntry updated September 14, 2026\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Connecting to a malicious NFS server may lead to kernel memory corruption\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-28931: Redon Gashi, Abhijeet Singh (linkedin.com/in/abhiunix/), Peter Malone, Omar Cerrito\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-43817: Huy Nguyen (@34306) of Calif.io\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A remote user may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43810: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A memory initialization issue was addressed with improved memory handling.\n\nCVE-2026-64775: Ryan Hileman via Xint Code (xint.io)\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-64720: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., an anonymous researcher, Asjid Kalam (@odinshell), Jian Zhou and Ye Zhang\n\nEntry updated September 14, 2026\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-64751: N.M.Praveen Nawarathne (@zblockrat)\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to access sensitive user data\n\nDescription: This issue was addressed through improved state management.\n\nCVE-2026-64721: Lukas Gerlach\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-65357: YingMuo (@YingMuo) of DEVCORE Research Team, Tristan Rousseau, James Duffy (@0x4A616D657344)\n\nEntry added September 14, 2026\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to disclose kernel memory\n\nDescription: This issue was addressed with improved redaction of sensitive information.\n\nCVE-2026-65371: Vladislav Shevchenko (Positive Technologies)\n\nEntry added September 14, 2026\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-43808: Dun, deepsec of DARKNAVY (@DarkNavyOrg)\n\nEntry added September 14, 2026\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-64717: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nEntry added September 14, 2026\n\n### libarchive\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted file may result in disclosure of process memory\n\nDescription: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.\n\n### libc\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A malicious app may be able to break out of its sandbox\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-28973: an anonymous researcher\n\n### Libnotify\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An attacker may be able to cause unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64739: Feng Xue and XGPT of ThreatBook, Dun\n\n### Managed Configuration\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-64743: Daniel Febrero\n\n### mDNSResponder\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An attacker on the local network may be able to cause a denial-of-service\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64724: Daisuke Hatakeyama (@SYZD Research)\n\n### MediaRemote\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to gain root privileges\n\nDescription: A path handling issue was addressed with improved validation.\n\nCVE-2026-43723: Richard Zana, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### Model I/O\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted image may corrupt process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43733: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative\n\nCVE-2026-43729: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative\n\n### Model I/O\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nDescription: An out-of-bounds write issue was addressed with improved input validation.\n\nCVE-2026-64772: stratan (@5tratan), wh0am1i\n\n### Model I/O\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\n### Model I/O\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a 3D model may result in disclosure of process memory\n\nDescription: A buffer overflow issue was addressed with improved memory handling.\n\n### Model I/O\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-64774: stratan (@5tratan)\n\n### Model I/O\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64770: stratan (@5tratan)\n\nCVE-2026-64769: stratan (@5tratan)\n\n### Model I/O\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A remote attacker may cause an unexpected app termination\n\nDescription: An out-of-bounds read issue was addressed with improved input validation.\n\nCVE-2026-64768: stratan (@5tratan)\n\n### NSColorPanel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to leak sensitive user information\n\nCVE-2026-64711: Koh M. Nakagawa (@tsunek0h) of FFRI Security, Inc.\n\n### Pro Res\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-43812: Francisco Knabe\n\n### Sandbox Profiles\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to read a persistent device identifier\n\nDescription: A permissions issue was addressed with additional restrictions.\n\n### SceneKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-64766: stratan (@5tratan)\n\nCVE-2026-64765: Nik Tsytsarkin, stratan (@5tratan)\n\nEntry updated September 14, 2026\n\n### SceneKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64764: stratan (@5tratan)\n\n### SceneKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nDescription: An out-of-bounds write issue was addressed by removing the vulnerable code.\n\nCVE-2026-64763: stratan (@5tratan)\n\n### Single Sign-On\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to access user-sensitive data\n\nDescription: The issue was addressed with improved checks.\n\nCVE-2026-43762: RedRays Security Team\n\nEntry added September 14, 2026\n\n### Siri\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An information disclosure issue was addressed by removing the vulnerable code.\n\nCVE-2026-43800: Stanislav Jelezoglo\n\n### Watch App\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to fingerprint the user\n\nDescription: A privacy issue was addressed by moving sensitive data.\n\nCVE-2026-28938: Morris Richman (@morrisinlife), Asaf Cohen, Gongyu Ma (@Mezone0)\n\nEntry added September 14, 2026\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Websites may know if the user has visited a given link\n\nDescription: This issue was addressed with improved checks.\n\nWebKit Bugzilla: 316827\n\nCVE-2026-64713: Kwak Kiyong, Song Nuri\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Visiting a website that frames malicious content may lead to UI spoofing\n\nDescription: The issue was addressed with improved UI.\n\nWebKit Bugzilla: 311660\n\nCVE-2026-64730: Kagami Rosylight of Mozilla\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Maliciously crafted web content may violate iframe sandboxing policy\n\nDescription: A permissions issue was addressed with improved validation.\n\nWebKit Bugzilla: 313220\n\nCVE-2026-64728: an anonymous researcher \n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 313521\n\nCVE-2026-64783: Luke Francis, Francisco Alonso (@revskills), Shubham Chaskar, Jiyong Yang (@Sy2n0), 杉山 壮太, lattice, Behzad Najjarpour Jabbari (@_G4ru_), Junyeong Lee, Mooth.ai, OGINOME Tomohito, Using GLM From Z.AI, Gia Bui (@yabeow) from Calif.io\n\nEntry updated September 14, 2026\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and la","published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":14242,"url":"https://support.apple.com/en-us/128071","title":"macOS Sequoia 15.7.8 security content","kind":"advisory","source":"nvd","publisher":"vendor","text":"About the security content of macOS Sequoia 15.7.8 - Apple Support\n\n# About the security content of macOS Sequoia 15.7.8\n\nThis document describes the security content of macOS Sequoia 15.7.8.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## macOS Sequoia 15.7.8\n\nReleased July 27, 2026\n\n### Accounts\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to gain root privileges\n\nDescription: A parsing issue in the handling of directory paths was addressed with improved path validation.\n\nCVE-2026-43749: Adam Franke, Trung Nguyen (@everping) of CyStack, Ashish Kunwar\n\n### Accounts\n\nAvailable for: macOS Sequoia\n\nImpact: A malicious application may be able to bypass Privacy preferences\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-65404: 이재영, Vinay Kumar Rasala (Xplo8E) from Appknox, Stuart Wallace, Arni Hardarson (Neonix Security)\n\nEntry added September 14, 2026\n\n### afpfs\n\nAvailable for: macOS Sequoia\n\nImpact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-64767: Dave G.\n\n### afpfs\n\nAvailable for: macOS Sequoia\n\nImpact: Connecting to a malicious afpfs server may lead to kernel memory corruption\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-43815: Dave G.\n\nEntry added September 14, 2026\n\n### apache\n\nImpact: A remote attacker may be able to cause a denial-of-service\n\nDescription: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.\n\nCVE-2026-23918: Bartlomiej Dmitruk of striga.ai, Stanislaw Strzalkowski of isec.pl\n\nEntry updated September 14, 2026\n\n### APFS\n\nImpact: A remote user may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64695: Narendra Singh (@_3P1C), Peter Malone\n\nEntry updated September 14, 2026\n\n### App Store\n\nImpact: An app may be able to access sensitive user data\n\nCVE-2026-43801: Rahul Raj\n\n### Apple Account\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-43781: Pinak Oza\n\n### Apple Account\n\nImpact: A malicious app may be able to break out of its sandbox\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-64737: Robert Mindo\n\n### Apple Neural Engine\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43748: Vladislav Shevchenko (Positive Technologies), an anonymous researcher, tamdao, Franco Belman at Blackwing Intelligence\n\nEntry updated September 14, 2026\n\n### AppleDouble\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-43776: Peter Malone, Nicolas Rabrenovic, Irvin Wang, Rishabh Jain (rjcyber) of cyberplanet\n\nEntry updated September 14, 2026\n\n### AppleRAID\n\nImpact: A local user may be able to read kernel memory\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-43681: impost0r (ret2plt), David Ige - Beryllium Security\n\n### AppleRAID\n\nImpact: Mounting a malicious disk image may cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43761: lokerxx, Narendra Singh (@_3P1C), Lyutoon, Jordy Zomer (@pwningsystems), Richard Zana, George Stergiopoulos, InfoSec lab, Athens University of Economics and Business, Greece, Aswin Kumar Gokulakannan\n\nEntry added September 14, 2026\n\n### Assets\n\nImpact: A malicious application may be able to bypass Privacy preferences\n\nCVE-2026-43672: 이재영\n\n### ATS\n\nImpact: An app may be able to read files outside of its sandbox\n\nDescription: A permissions issue was addressed by removing the vulnerable code.\n\nCVE-2026-43763: Pavan Nallamothu, Jared Reyes\n\n### Audio\n\nImpact: An app may be able to break out of its sandbox\n\nCVE-2026-64702: John Lussier\n\n### Audio\n\nImpact: An app may be able to cause a denial-of-service\n\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\n### AVEVideoEncoder\n\nImpact: An app may be able to execute arbitrary code with kernel privileges\n\nDescription: A buffer overflow was addressed with improved size validation.\n\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\n### AVEVideoEncoder\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun\n\n### BackgroundAssets\n\nImpact: An app may be able to delete files for which it does not have permission\n\nCVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab\n\n### BOM\n\nImpact: A maliciously crafted ZIP archive may bypass Gatekeeper checks\n\nCVE-2026-28849: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs \n\n### cd9660\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nCVE-2026-64698: Richard Zana, Peter Malone, Nathaniel Oh (@calysteon), an anonymous researcher\n\n### Contacts\n\nImpact: Processing a maliciously crafted contact may leak sensitive data\n\nCVE-2026-64734: Daniel Williams\n\n### Control Center\n\nCVE-2026-43756: 이재영\n\n### Core Services\n\nImpact: An app may be able to gain root privileges\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-43693: Gergely Kalman (@gergely_kalman)\n\n### CoreAudio\n\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\n### CoreAudio\n\nImpact: Processing an audio stream in a maliciously crafted media file may terminate the process\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43744: ret2happy, Mathis Mansière, an anonymous researcher\n\nEntry updated September 14, 2026\n\n### CoreAudio\n\nImpact: A remote attacker may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43803: Rahul Raj\n\n### CoreMedia\n\nCVE-2026-43775: Csaba Fitzl (@theevilbit) of Iru\n\n### CoreMedia\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination\n\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\n### CoreServices\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nCVE-2026-28936: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### CoreUI\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted asset catalog may result in disclosure of process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43738: Peter Malone\n\n### CoreUI\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause a denial of service\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-84489: stratan (@5tratan), Peter Malone\n\nEntry added September 14, 2026\n\n### CoreVideo\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43802: an anonymous researcher\n\n### Crash Reporter\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to leak sensitive user information\n\nDescription: A privacy issue was addressed by removing sensitive data.\n\nCVE-2026-64710: Matthew Schneider\n\n### CUPS\n\nImpact: A malicious app may be able to gain root privileges\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-39875: Dallas Dubs, Aaron Grattafiori - NVIDIA AI Red Team, XBreach.ai, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\nCVE-2026-64701: Yongyue WANG AKA Brian.W of OKX security, Roman Zabicki, Katika Mohaseen, Aaron Grattafiori - NVIDIA AI Red Team, an anonymous researcher, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs, an anonymous researcher\n\nEntry updated September 14, 2026\n\n### CUPS\n\nImpact: An app may be able to gain root privileges\n\nCVE-2026-43698: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### curl\n\nImpact: Authentication credentials may be sent to a server on another origin\n\nDescription: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.\n\n### curl\n\nDescription: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.\n\nCVE-2025-14017\n\nEntry added September 14, 2026\n\n### Data Detectors UI\n\nCVE-2026-43758: HvxyZLF\n\n### DesktopServices\n\nImpact: An app may bypass Gatekeeper checks\n\nDescription: A file quarantine bypass was addressed with additional checks.\n\nCVE-2026-64708: Lance Cain - Offensive Security Engineer, SpecterOps Inc.\n\n### Disk Images\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-28926: Jonathan Bar Or (@yo_yo_yo_jbo)\n\n### Disk Images\n\nImpact: Parsing a maliciously crafted file may lead to an unexpected app termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-43747: Anthony Laou Hine Tsuei (@anarcheuz)\n\n### Disk Images\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-64694: Gil Portnoy & Henry\n\n### Disk Images\n\nImpact: An app may be able to bypass network restrictions\n\nCVE-2026-28945: Ayaan Ahmad\n\n### Disk Images\n\nCVE-2026-64776: Hyunwoo Kim (@v4bel)\n\n### DriverKit\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43793: erdene-och Byambabayar\n\n### DriverKit\n\nCVE-2026-43753: Niels Hofmans\n\n### Foundation\n\nCVE-2026-43714: an anonymous researcher\n\n### Game Center\n\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\n### Game Center\n\nCVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive Technologies\n\n### Heimdal\n\nCVE-2026-64692: Redon Gashi\n\n### HFS\n\nImpact: A remote user may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-43682: Trung Nguyen (@everping) of CyStack, Peter Malone, Nicolas Rabrenovic, Dave G., Atul R V & Ashmit Sharma\n\n### HFS\n\nImpact: Processing a maliciously crafted image may lead to arbitrary code execution\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-28981: Hcamael and 章鱼哥@aipy （aipyaipy.com）, Aswin Kumar Gokulakannan, Surya Narayan Kushwaha, Dun\n\n### HFS\n\nImpact: Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-43773: Surya Narayan Kushwaha, Richard Zana, Peter Malone, Hyunwoo Kim (@v4bel), Cem Onat Karagun\n\n### HFS\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43767: Alfredo Pesoli (@__rev) of Bynar.io, Hyunwoo Kim (@v4bel)\n\nEntry updated September 14, 2026\n\n### HFS\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-64697: Peter Malone\n\n### HFS\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43764: Tristan Madani (@TristanInSec) from Talence Security\n\n### HFS\n\nImpact: An attacker may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-43710: Peter Malone\n\n### Icons\n\nCVE-2025-43325: an anonymous researcher\n\n### ImageIO\n\nCVE-2026-64716: Peter Malone, Jonathan Alush-Aben, Arni Hardarson\n\n### ImageIO\n\nImpact: Processing a maliciously crafted texture may lead to unexpected app termination\n\nCVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may lead to arbitrary code execution\n\nCVE-2026-43818: an anonymous researcher\n\n### ImageIO\n\nCVE-2026-43661: Gandalf4a of PKU-ICODE, Anton Pakhunov, an anonymous researcher\n\n### ImageIO\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted file may lead to a denial-of-service\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64754: Rahul Raj, PETOWORKS의 Bugeun Choi (@Bugeun)\n\n### ImageIO\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted image may lead to a denial-of-service\n\nDescription: A type confusion issue was addressed with improved checks.\n\nCVE-2026-64693: Geonha Lee (@leegn4a)\n\n### ImageIO\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted image may lead to a denial-of-service\n\nDescription: A memory corruption issue was addressed with improved bounds checking.\n\nCVE-2026-64714: an anonymous researcher\n\nEntry added September 14, 2026\n\n### IOKit\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-43805: 이재영\n\n### IOSkywalkFamily\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2026-39877: Richard Zana, Dhiyanesh Selvaraj (@redroot97)\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64749: hxr1, Hiroki Imai (LAC Co., Ltd.), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ashish Kunwar\n\n### Kernel\n\nCVE-2026-43782: Igor Ushakov\n\n### Kernel\n\nCVE-2026-64744: Ryan Hileman via Xint Code (xint.io)\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-64775: Ryan Hileman via Xint Code (xint.io)\n\n### Kernel\n\nImpact: A remote user may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A race condition was addressed with improved locking.\n\nCVE-2026-28982: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Adam Doupé of ASU SEFCOM\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-43778: Ashish Kunwar, f0r of MurphySec, Mahmoud Abdelmoniem, Feng Xue and XGPT of ThreatBook, Wang Yu, Nicolas Rabrenovic, Lyutoon, Hiroki Imai (LAC Co., Ltd.), Fábio Luís @scanpt, DARKNAVY (@DarkNavyOrg), an anonymous researcher\n\nEntry updated September 14, 2026\n\n### Kernel\n\nImpact: A remote attacker may be able to bypass network filters\n\nDescription: An inconsistent user interface issue was addressed with improved state management.\n\nCVE-2026-64735: Gor Aleksanyan\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-43822: Michal Kosiorek, Eddy Tsalolikhin\n\nCVE-2026-64700: Asjid Kalam (@odinshell)\n\nCVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nImpact: A remote user may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-43810: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nCVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel)\n\n### Kernel\n\nImpact: An app may be able to leak sensitive kernel state\n\nCVE-2026-43722: Hyunwoo Kim (@v4bel), Feng Xue and XGPT of ThreatBook\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43809: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nCVE-2026-43757: Wang Yu, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nCVE-2026-43754: Ernesto Martínez García, Calif Research\n\n### Kernel\n\nCVE-2026-64723: Ji'an Zhou, Mingxuan Yang, Ye Zhang\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-39868: Ye Zhang (@VAR10CK) of Baidu Security, Vladislav Shevchenko (Positive Technologies), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nCVE-2026-64709: Pasquale Scola, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nCVE-2026-64721: Lukas Gerlach\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-64717: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nEntry added September 14, 2026\n\n### LaunchServices\n\nCVE-2026-20672: Kirin (@Pwnrin) and LFY (@secsys) from Fudan University\n\n### LaunchServices\n\nImpact: A remote attacker may be able to cause a denial of service\n\nCVE-2026-28983: Ruslan Dautov\n\n### libarchive\n\nImpact: Processing a maliciously crafted file may result in disclosure of process memory\n\n### libarchive\n\nImpact: A maliciously crafted ZIP archive may bypass Gatekeeper checks\n\nCVE-2026-28900: Prathamesh Walunj (@attahasa)\n\nEntry updated September 14, 2026\n\n### libc\n\nCVE-2026-28973: an anonymous researcher\n\n### Libnotify\n\nImpact: An attacker may be able to cause unexpected app termination\n\nCVE-2026-64739: Feng Xue and XGPT of ThreatBook, Dun\n\n### libxslt\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process crash\n\nCVE-2026-43703: Tristan Madani (@TristanInSec) from Talence Security\n\n### libxslt\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process crash\n\nDescription: A double free issue was addressed with improved memory management.\n\nCVE-2026-43706: Tristan Madani (@TristanInSec) from Talence Security\n\n### LoginWindow\n\nAvailable for: macOS Sequoia\n\nImpact: An attacker with physical access to a locked device may be able to view sensitive user information\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-43766: Amy (amys.website)\n\n### Maps\n\nAvailable for: macOS Sequoia\n\nImpact: A malicious app may be able to break out of its sandbox\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-64738: Robert Mindo, Nathaniel Oh (@calysteon)\n\n### mDNSResponder\n\nAvailable for: macOS Sequoia\n\nImpact: An attacker on the local network may be able to cause a denial-of-service\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43653: Atul R V\n\nCVE-2026-64724: Daisuke Hatakeyama (@SYZD Research)\n\n### MediaRemote\n\nImpact: An app may be able to gain root privileges\n\nDescription: A path handling issue was addressed with improved validation.\n\nCVE-2026-43723: Richard Zana, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### MobileAccessoryUpdater\n\nImpact: A malicious accessory may be able to cause unexpected app termination\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-43807: Tristan Madani (@TristanInSec) from Talence Security\n\n### Model I/O\n\nImpact: Processing a maliciously crafted image may corrupt process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43733: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative\n\nCVE-2026-43729: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative\n\n### Model I/O\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nDescription: An out-of-bounds write issue was addressed with improved input validation.\n\nCVE-2026-64772: wh0am1i, stratan (@5tratan)\n\n### Model I/O\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-64774: stratan (@5tratan)\n\n### Model I/O\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64770: stratan (@5tratan)\n\nCVE-2026-64769: stratan (@5tratan)\n\n### Model I/O\n\nDescription: A buffer overflow issue was addressed with improved memory handling.\n\nCVE-2026-64722: wh0am1i\n\n### Model I/O\n\nImpact: A remote attacker may cause an unexpected app termination\n\nCVE-2026-64768: stratan (@5tratan)\n\n### Model I/O\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-64771: wh0am1i\n\n### Net-SNMP\n\nImpact: An app may be able to cause a denial-of-service\n\nDescription: A stack overflow was addressed with improved input validation.\n\nCVE-2026-43771: Robert Tran\n\n### NetFSFramework\n\nCVE-2026-43772: Mickey Jin (@patch1t)\n\n### Network Extensions\n\nCVE-2026-28961: Dan Raviv\n\n### NSColorPanel\n\nCVE-2026-64711: Koh M. Nakagawa (@tsunek0h) of FFRI Security, Inc.\n\n### PackageKit\n\nCVE-2026-28912: Matej Moravec (@MacejkoMoravec)\n\n### PackageKit\n\nCVE-2026-43765: Mickey Jin (@patch1t)\n\n### ppp\n\nImpact: An attacker may be able to cause unexpected system termination or read kernel memory\n\nCVE-2026-28896: Dave G.\n\n### ppp\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-28933: 九宫格 of Chongqing Telecom, Chanwit Muenprakoddee (ChemIndy), Aethel-Systems\n\nEntry added September 14, 2026\n\n### Printing\n\nImpact: A malicious app may be able to break out of its sandbox\n\nCVE-2026-64731: Narcis Oliveras Fontàs, Sindre Sorhus, Richard Zana\n\nEntry updated September 14, 2026\n\n### Pro Res\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43812: Francisco Knabe\n\n### quarantine\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nCVE-2026-43694: Zachary Neal, Hcamael and 章鱼哥@aipy (aipyaipy.com), JC Alvarado of Stripe, Jacob Hazak\n\nEntry updated September 14, 2026\n\n### Remote Management\n\nCVE-2026-39874: @pixiepointsec\n\n### SceneKit\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nCVE-2026-64764: stratan (@5tratan)\n\n### SceneKit\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nCVE-2026-64763: stratan (@5tratan)\n\n### SceneKit\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nCVE-2026-64766: stratan (@5tratan)\n\nCVE-2026-64765: Nik Tsytsarkin, stratan (@5tratan)\n\nEntry updated September 14, 2026\n\n### Screen Sharing Server\n\nImpact: An app may be able to intercept network connections intended for another process\n\nCVE-2026-43779: Dave G., Asaf Cohen\n\n### Screen Sharing Server\n\nImpact: A remote attacker may be able to cause a denial of service\n\nCVE-2026-43777: Junming C.(Chapoly1305)\n\n### Screen Sharing Server\n\nImpact: A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n\nCVE-2026-43665: Ayaan Ahmad\n\n### Siri\n\nImpact: A person with physical access to a locked device may be able to access contacts and photos\n\nCVE-2026-64745: Vivek Dhar, ASI (RM) in Border Security Force, FTR HQ BSF Kashmir\n\n### SMB\n\nImpact: Connecting to a malicious SMB server may lead to unexpected system termination\n\nCVE-2026-39873: Feng Xue and XGPT of ThreatBook, Peter Malone\n\nCVE-2026-64696: Feng Xue and XGPT of ThreatBook, Peter Malone\n\nEntry updated September 14, 2026\n\n### SMB\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A type confusion issue was addressed with improved memory handling.\n\nCVE-2026-64704: He Wei (ギカク), Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Aswin Kumar Gokulakannan, Kitten Food, Peter Malone, Calif.io in collaboration with Claude and Anthropic Research\n\nEntry updated September 14, 2026\n\n### Spotlight\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-43774: Csaba Fitzl (@theevilbit) of Iru\n\n### StorageKit\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to access sensitive user data\n\nDescription: A race condition was addressed with additional validation.\n\nCVE-2026-43770: Tien-Chih Lin of CyCraft Technology\n\n### udf\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43768: Hyunwoo Kim (@v4bel)\n\n### WebDAV\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause a denial-of-service\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-64703: Bruce Dang of Calif.io in collaboration with Claude and Anthropic Research\n\n### WebDAV\n\nImpact: An app may be able to disclose kernel memory\n\nDescription: A memory initialization issue was addressed with improved memory handling.\n\nCVE-2026-64699: Bruce Dang of Calif.io\n\n### Wi‑Fi\n\nImpact: An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-43750: an anonymous researcher\n\n### xar\n\nImpact: An app may be able to cause a denial of service\n\nDescription: A logic issue existed resulting in memory corruption. This was addressed with improved state management.\n\nCVE-2026-28932: Mathis Mansière\n\n### zip\n\nImpact: A maliciously crafted ZIP archive may bypass Gatekeeper checks\n\nDescription: A logic issue was addressed with improved file handling.\n\nCVE-2026-28914: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs (nosebeard.co)\n\n## Additional recognition\n\n### Audio\n\nWe would like to acknowledge Niels Hofmans for their assistance.\n\n### copyfile\n\nWe would like to acknowledge Keisuke Hosoda for their assistance.\n\n### CoreMedia\n\nWe would like to acknowledge yaohway for their assistance.\n\n### Disk Images\n\nWe would like to acknowledge Jordy Zomer (@pwningsystems), Phillip Groves, Richard Zana for their assistance.\n\n### Kerberos v5 PAM module\n\nWe would like to acknowledge Hiroki Imai, Ricerca Security, Inc. for their assistance.\n\nEntry added September 14, 2026\n\n### Kernel\n\nWe would like to acknowledge Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Cem Onat Karagun, Chris Betz, James Duffy (@0x4A616D657344), Lyutoon, Mathis Mansière, Tristan Rousseau, Yeojin Kim, YingMuo (@YingMuo) of DEVCORE Research Team for their assistance.\n\nEntry updated September 14, 2026\n\n### libxslt\n\nWe would like to acknowledge Kubilay Berk Alkan for their assistance.\n\n### mDNSResponder\n\nWe would like to acknowledge Cem Onat Karagun, He Wei (ギカク), Jex Amro, 章鱼哥 (@aipy) of aipyaipy.com for their assistance.\n\n### PluginKit\n\nWe would like to acknowledge Asaf Cohen, Ashish Kunwar for their assistance.\n\n### Printing UIKit\n\nWe would like to acknowledge Jacolon Walker ( @call_eax ) for their assistance.\n\n### ReplayKit\n\nWe would like to acknowledge an anonymous researcher for their assistance.\n\n### Spotlight\n\nWe would like to acknowledge Ilya Andr (andrd3v) and nkhmelni for their assistance.\n\n### System Settings\n\nWe would like to acknowledge Masaki Moriguchi for their assistance.\n\n### Time Machine\n\nWe would like to acknowledge Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs for their assistance.\n\n Published Date: September 14, 2026","published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":14243,"url":"https://support.apple.com/en-us/128072","title":"macOS Sonoma 14.8.8 security content","kind":"advisory","source":"nvd","publisher":"vendor","text":"About the security content of macOS Sonoma 14.8.8 - Apple Support\n\n# About the security content of macOS Sonoma 14.8.8\n\nThis document describes the security content of macOS Sonoma 14.8.8.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## macOS Sonoma 14.8.8\n\nReleased July 27, 2026\n\n### Accounts\n\nAvailable for: macOS Sonoma\n\nImpact: An app may be able to gain root privileges\n\nDescription: A parsing issue in the handling of directory paths was addressed with improved path validation.\n\nCVE-2026-43749: Adam Franke, Trung Nguyen (@everping) of CyStack, Ashish Kunwar\n\n### Accounts\n\nAvailable for: macOS Sonoma\n\nImpact: A malicious application may be able to bypass Privacy preferences\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-65404: 이재영, Vinay Kumar Rasala (Xplo8E) from Appknox, Stuart Wallace, Arni Hardarson (Neonix Security)\n\nEntry added September 14, 2026\n\n### afpfs\n\nAvailable for: macOS Sonoma\n\nImpact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-64767: Dave G.\n\n### afpfs\n\nAvailable for: macOS Sonoma\n\nImpact: Connecting to a malicious afpfs server may lead to kernel memory corruption\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-43815: Dave G.\n\nEntry added September 14, 2026\n\n### apache\n\nImpact: A remote attacker may be able to cause a denial-of-service\n\nDescription: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.\n\nCVE-2026-23918: Bartlomiej Dmitruk of striga.ai, Stanislaw Strzalkowski of isec.pl\n\nEntry updated September 14, 2026\n\n### APFS\n\nImpact: A remote user may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64695: Narendra Singh (@_3P1C), Peter Malone\n\nEntry updated September 14, 2026\n\n### App Store\n\nImpact: An app may be able to access sensitive user data\n\nCVE-2026-43801: Rahul Raj\n\n### Apple Account\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-43781: Pinak Oza\n\n### Apple Account\n\nImpact: A malicious app may be able to break out of its sandbox\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-64737: Robert Mindo\n\n### AppleRAID\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-43681: impost0r (ret2plt), David Ige - Beryllium Security\n\n### AppleRAID\n\nImpact: Mounting a malicious disk image may cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43761: lokerxx, Narendra Singh (@_3P1C), Lyutoon, Jordy Zomer (@pwningsystems), Richard Zana, George Stergiopoulos, InfoSec lab, Athens University of Economics and Business, Greece, Aswin Kumar Gokulakannan\n\nEntry added September 14, 2026\n\n### Assets\n\nImpact: A malicious application may be able to bypass Privacy preferences\n\nCVE-2026-43672: 이재영\n\n### ATS\n\nImpact: An app may be able to read files outside of its sandbox\n\nDescription: A permissions issue was addressed by removing the vulnerable code.\n\nCVE-2026-43763: Pavan Nallamothu, Jared Reyes\n\n### Audio\n\nImpact: An app may be able to break out of its sandbox\n\nCVE-2026-64702: John Lussier\n\n### Audio\n\nImpact: An app may be able to cause a denial-of-service\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\n### AVEVideoEncoder\n\nImpact: An app may be able to execute arbitrary code with kernel privileges\n\nDescription: A buffer overflow was addressed with improved size validation.\n\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\n### AVEVideoEncoder\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun\n\n### BackgroundAssets\n\nImpact: An app may be able to delete files for which it does not have permission\n\nCVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab\n\n### BOM\n\nImpact: A maliciously crafted ZIP archive may bypass Gatekeeper checks\n\nCVE-2026-28849: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs \n\n### cd9660\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64698: Richard Zana, Peter Malone, Nathaniel Oh (@calysteon), an anonymous researcher\n\n### Contacts\n\nImpact: Processing a maliciously crafted contact may leak sensitive data\n\nCVE-2026-64734: Daniel Williams\n\n### Control Center\n\nCVE-2026-43756: 이재영\n\n### Core Services\n\nImpact: An app may be able to gain root privileges\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-43693: Gergely Kalman (@gergely_kalman)\n\n### CoreAudio\n\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\n### CoreAudio\n\nImpact: Processing an audio stream in a maliciously crafted media file may terminate the process\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43744: ret2happy, Mathis Mansière, an anonymous researcher\n\nEntry updated September 14, 2026\n\n### CoreAudio\n\nImpact: A remote attacker may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43803: Rahul Raj\n\n### CoreMedia\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination\n\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\n### CoreServices\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nCVE-2026-28936: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### CoreUI\n\nImpact: Processing a maliciously crafted asset catalog may result in disclosure of process memory\n\nCVE-2026-43738: Peter Malone\n\n### CoreUI\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-84489: stratan (@5tratan), Peter Malone\n\nEntry added September 14, 2026\n\n### CoreVideo\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43802: an anonymous researcher\n\n### Crash Reporter\n\nImpact: An app may be able to leak sensitive user information\n\nDescription: A privacy issue was addressed by removing sensitive data.\n\nCVE-2026-64710: Matthew Schneider\n\n### CUPS\n\nAvailable for: macOS Sonoma\n\nImpact: A malicious app may be able to gain root privileges\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-39875: XBreach.ai, Dallas Dubs, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs, Aaron Grattafiori - NVIDIA AI Red Team\n\n### CUPS\n\nAvailable for: macOS Sonoma\n\nImpact: An app may be able to gain root privileges\n\nDescription: An injection issue was addressed with improved validation.\n\nCVE-2026-43698: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### curl\n\nAvailable for: macOS Sonoma\n\nImpact: Authentication credentials may be sent to a server on another origin\n\nDescription: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.\n\n### curl\n\nAvailable for: macOS Sonoma\n\nImpact: Multiple issues in curl\n\nDescription: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.\n\nCVE-2025-14017\n\nEntry added September 14, 2026\n\n### Data Detectors UI\n\nCVE-2026-43758: HvxyZLF\n\n### DesktopServices\n\nAvailable for: macOS Sonoma\n\nImpact: An app may bypass Gatekeeper checks\n\nDescription: A file quarantine bypass was addressed with additional checks.\n\nCVE-2026-64708: Lance Cain - Offensive Security Engineer, SpecterOps Inc.\n\n### Disk Images\n\nAvailable for: macOS Sonoma\n\nImpact: An app may be able to elevate privileges\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-28926: Jonathan Bar Or (@yo_yo_yo_jbo)\n\n### Disk Images\n\nImpact: Parsing a maliciously crafted file may lead to an unexpected app termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-43747: Anthony Laou Hine Tsuei (@anarcheuz)\n\n### Disk Images\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-64694: Gil Portnoy & Henry\n\n### Disk Images\n\nImpact: An app may be able to bypass network restrictions\n\nCVE-2026-28945: Ayaan Ahmad\n\n### Disk Images\n\nCVE-2026-64776: Hyunwoo Kim (@v4bel)\n\n### DriverKit\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43793: erdene-och Byambabayar\n\n### DriverKit\n\nImpact: An attacker with physical access to a locked device may be able to view sensitive user information\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-43753: Niels Hofmans\n\n### Find My\n\nImpact: An attacker with physical access may be able to silently persist an Apple Account on an erased device\n\nCVE-2026-28836: Pyrophoria, Estifanos Megersa, and Ahmed Uddin\n\nEntry added September 14, 2026\n\n### Foundation\n\nCVE-2026-43714: an anonymous researcher\n\n### Game Center\n\nImpact: A malicious app may be able to break out of its sandbox\n\nDescription: A parsing issue in the handling of directory paths was addressed with improved path validation.\n\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\n### Game Center\n\nCVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive Technologies\n\n### Heimdal\n\nCVE-2026-64692: Redon Gashi\n\n### HFS\n\nImpact: A remote user may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-43682: Trung Nguyen (@everping) of CyStack, Peter Malone, Nicolas Rabrenovic, Dave G., Atul R V & Ashmit Sharma\n\n### HFS\n\nImpact: Processing a maliciously crafted image may lead to arbitrary code execution\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-28981: Hcamael and 章鱼哥@aipy （aipyaipy.com）, Aswin Kumar Gokulakannan, Surya Narayan Kushwaha, Dun\n\n### HFS\n\nImpact: Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-43773: Surya Narayan Kushwaha, Richard Zana, Peter Malone, Hyunwoo Kim (@v4bel), Cem Onat Karagun\n\n### HFS\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43767: Alfredo Pesoli (@__rev) of Bynar.io, Hyunwoo Kim (@v4bel)\n\nEntry updated September 14, 2026\n\n### HFS\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-64697: Peter Malone\n\n### HFS\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43764: Tristan Madani (@TristanInSec) from Talence Security\n\n### HFS\n\nImpact: An attacker may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-43710: Peter Malone\n\n### Icons\n\nCVE-2025-43325: an anonymous researcher\n\n### ImageIO\n\nCVE-2026-64716: Peter Malone, Jonathan Alush-Aben, Arni Hardarson\n\n### ImageIO\n\nImpact: Processing a maliciously crafted texture may lead to unexpected app termination\n\nCVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may lead to arbitrary code execution\n\nCVE-2026-43818: an anonymous researcher\n\n### ImageIO\n\nCVE-2026-43661: Gandalf4a of PKU-ICODE, Anton Pakhunov, an anonymous researcher\n\n### ImageIO\n\nImpact: Processing a maliciously crafted file may lead to a denial-of-service\n\nCVE-2026-64754: Rahul Raj, PETOWORKS의 Bugeun Choi (@Bugeun)\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may lead to a denial-of-service\n\nCVE-2026-64693: Geonha Lee (@leegn4a)\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may lead to a denial-of-service\n\nCVE-2026-64714: an anonymous researcher\n\nEntry added September 14, 2026\n\n### IOKit\n\nAvailable for: macOS Sonoma\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-43805: 이재영\n\n### IOSkywalkFamily\n\nAvailable for: macOS Sonoma\n\nImpact: An app may be able to disclose kernel memory\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2026-39877: Richard Zana, Dhiyanesh Selvaraj (@redroot97)\n\n### Kernel\n\nAvailable for: macOS Sonoma\n\nImpact: An app may be able to access sensitive user data\n\nDescription: This issue was addressed with improved checks.\n\nCVE-2026-43782: Igor Ushakov\n\n### Kernel\n\nImpact: An app may be able to disclose kernel memory\n\nCVE-2026-64744: Ryan Hileman via Xint Code (xint.io)\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A memory initialization issue was addressed with improved memory handling.\n\nCVE-2026-64775: Ryan Hileman via Xint Code (xint.io)\n\n### Kernel\n\nImpact: A remote user may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A race condition was addressed with improved locking.\n\nCVE-2026-28982: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Adam Doupé of ASU SEFCOM\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-43778: Ashish Kunwar, f0r of MurphySec, Mahmoud Abdelmoniem, Feng Xue and XGPT of ThreatBook, Wang Yu, Nicolas Rabrenovic, Lyutoon, Hiroki Imai (LAC Co., Ltd.), Fábio Luís @scanpt, DARKNAVY (@DarkNavyOrg), an anonymous researcher\n\nEntry updated September 14, 2026\n\n### Kernel\n\nImpact: A remote attacker may be able to bypass network filters\n\nDescription: An inconsistent user interface issue was addressed with improved state management.\n\nCVE-2026-64735: Gor Aleksanyan\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-43822: Michal Kosiorek, Eddy Tsalolikhin\n\nCVE-2026-64700: Asjid Kalam (@odinshell)\n\nCVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nImpact: A remote user may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43810: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nCVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel)\n\n### Kernel\n\nImpact: An app may be able to leak sensitive kernel state\n\nCVE-2026-43722: Hyunwoo Kim (@v4bel), Feng Xue and XGPT of ThreatBook\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-43809: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nCVE-2026-43757: Wang Yu, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nCVE-2026-43754: Ernesto Martínez García, Calif Research\n\n### Kernel\n\nCVE-2026-64723: Ji'an Zhou, Mingxuan Yang, Ye Zhang\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-39868: Ye Zhang (@VAR10CK) of Baidu Security, Vladislav Shevchenko (Positive Technologies), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nCVE-2026-64709: Pasquale Scola, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nCVE-2026-64721: Lukas Gerlach\n\n### LaunchServices\n\nCVE-2026-20672: Kirin (@Pwnrin) and LFY (@secsys) from Fudan University\n\n### LaunchServices\n\nImpact: A remote attacker may be able to cause a denial of service\n\nCVE-2026-28983: Ruslan Dautov\n\n### libarchive\n\n### libarchive\n\nImpact: A maliciously crafted ZIP archive may bypass Gatekeeper checks\n\nCVE-2026-28900: Prathamesh Walunj (@attahasa)\n\nEntry updated September 14, 2026\n\n### libc\n\nCVE-2026-28973: an anonymous researcher\n\n### Libnotify\n\nImpact: An attacker may be able to cause unexpected app termination\n\nCVE-2026-64739: Feng Xue and XGPT of ThreatBook, Dun\n\n### libxslt\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process crash\n\nCVE-2026-43703: Tristan Madani (@TristanInSec) from Talence Security\n\n### libxslt\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process crash\n\nDescription: A double free issue was addressed with improved memory management.\n\nCVE-2026-43706: Tristan Madani (@TristanInSec) from Talence Security\n\n### LoginWindow\n\nCVE-2026-43766: Amy (amys.website)\n\n### Maps\n\nImpact: A malicious app may be able to break out of its sandbox\n\nCVE-2026-64738: Robert Mindo, Nathaniel Oh (@calysteon)\n\n### mDNSResponder\n\nImpact: An attacker on the local network may be able to cause a denial-of-service\n\nCVE-2026-64724: Daisuke Hatakeyama (@SYZD Research)\n\n### MediaRemote\n\nCVE-2026-43723: Richard Zana, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### Metal\n\nCVE-2026-28911: yk lin of @pixiepointsec\n\n### MobileAccessoryUpdater\n\nImpact: A malicious accessory may be able to cause unexpected app termination\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-43807: Tristan Madani (@TristanInSec) from Talence Security\n\n### Model I/O\n\nAvailable for: macOS Sonoma\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-64774: stratan (@5tratan)\n\n### Model I/O\n\nAvailable for: macOS Sonoma\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64770: stratan (@5tratan)\n\nCVE-2026-64769: stratan (@5tratan)\n\n### Model I/O\n\nImpact: A remote attacker may cause an unexpected app termination\n\nDescription: An out-of-bounds read issue was addressed with improved input validation.\n\nCVE-2026-64768: stratan (@5tratan)\n\n### Net-SNMP\n\nImpact: An app may be able to cause a denial-of-service\n\nDescription: A stack overflow was addressed with improved input validation.\n\nCVE-2026-43771: Robert Tran\n\n### NetFSFramework\n\nImpact: An app may be able to break out of its sandbox\n\nDescription: A path traversal issue was addressed with improved input validation.\n\nCVE-2026-43772: Mickey Jin (@patch1t)\n\n### Network Extensions\n\nImpact: An attacker with physical access to a locked device may be able to view sensitive user information\n\nCVE-2026-28961: Dan Raviv\n\n### NSColorPanel\n\nCVE-2026-64711: Koh M. Nakagawa (@tsunek0h) of FFRI Security, Inc.\n\n### NSDocument\n\nDescription: A parsing issue in the handling of directory paths was addressed with improved path validation.\n\nCVE-2026-86902: silo\n\nEntry added September 14, 2026\n\n### PackageKit\n\nImpact: An app may be able to modify protected parts of the file system\n\nCVE-2026-43765: Mickey Jin (@patch1t)\n\n### ppp\n\nImpact: An attacker may be able to cause unexpected system termination or read kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-28896: Dave G.\n\n### ppp\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-28933: 九宫格 of Chongqing Telecom, Chanwit Muenprakoddee (ChemIndy), Aethel-Systems\n\nEntry added September 14, 2026\n\n### quarantine\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nCVE-2026-43694: Zachary Neal, Hcamael and 章鱼哥@aipy (aipyaipy.com), JC Alvarado of Stripe, Jacob Hazak\n\nEntry updated September 14, 2026\n\n### Remote Management\n\nImpact: A malicious app may be able to gain root privileges\n\nCVE-2026-39874: @pixiepointsec\n\n### SceneKit\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nCVE-2026-64764: stratan (@5tratan)\n\n### SceneKit\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nCVE-2026-64763: stratan (@5tratan)\n\n### SceneKit\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nCVE-2026-64766: stratan (@5tratan)\n\nCVE-2026-64765: Nik Tsytsarkin, stratan (@5tratan)\n\nEntry updated September 14, 2026\n\n### Screen Sharing Server\n\nImpact: An app may be able to intercept network connections intended for another process\n\nCVE-2026-43779: Dave G., Asaf Cohen\n\n### Screen Sharing Server\n\nImpact: A remote attacker may be able to cause a denial of service\n\nCVE-2026-43777: Junming C.(Chapoly1305)\n\n### Screen Sharing Server\n\nImpact: A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n\nCVE-2026-43665: Ayaan Ahmad\n\n### Screen Sharing Server\n\nCVE-2026-43760: wdszzml and Atuin Automated Vulnerability Discovery Engine, Alfredo Pesoli (@__rev) of Bynar.io\n\n### SecurityAgent\n\nCVE-2026-43755: Mickey Jin (@patch1t)\n\n### SMB\n\nImpact: Connecting to a malicious SMB server may lead to unexpected system termination\n\nCVE-2026-39873: Feng Xue and XGPT of ThreatBook, Peter Malone\n\nCVE-2026-64696: Feng Xue and XGPT of ThreatBook, Peter Malone\n\nEntry updated September 14, 2026\n\n### SMB\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A type confusion issue was addressed with improved memory handling.\n\nCVE-2026-64704: He Wei (ギカク), Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Aswin Kumar Gokulakannan, Kitten Food, Peter Malone, Calif.io in collaboration with Claude and Anthropic Research\n\nEntry updated September 14, 2026\n\n### Spotlight\n\nCVE-2026-43774: Csaba Fitzl (@theevilbit) of Iru\n\n### StorageKit\n\nCVE-2026-43770: Tien-Chih Lin of CyCraft Technology\n\n### udf\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43768: Hyunwoo Kim (@v4bel)\n\n### WebDAV\n\nImpact: An app may be able to cause a denial-of-service\n\nCVE-2026-64703: Bruce Dang of Calif.io in collaboration with Claude and Anthropic Research\n\n### WebDAV\n\nCVE-2026-64699: Bruce Dang of Calif.io\n\n### Wi‑Fi\n\nImpact: An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-43750: an anonymous researcher\n\n### xar\n\nCVE-2026-28932: Mathis Mansière\n\n### zip\n\nImpact: A maliciously crafted ZIP archive may bypass Gatekeeper checks\n\nCVE-2026-28914: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs (nosebeard.co)\n\n## Additional recognition\n\n### Audio\n\nWe would like to acknowledge Niels Hofmans for their assistance.\n\n### copyfile\n\nWe would like to acknowledge Keisuke Hosoda for their assistance.\n\n### CoreMedia\n\nWe would like to acknowledge yaohway for their assistance.\n\n### Disk Images\n\nWe would like to acknowledge Jordy Zomer (@pwningsystems), Phillip Groves, Richard Zana for their assistance.\n\n### Kerberos v5 PAM module\n\nWe would like to acknowledge Hiroki Imai, Ricerca Security, Inc. for their assistance.\n\nEntry added September 14, 2026\n\n### Kernel\n\nWe would like to acknowledge Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Cem Onat Karagun, James Duffy (@0x4A616D657344), Lyutoon, Mathis Mansière, Tristan Rousseau, Yeojin Kim, YingMuo (@YingMuo) of DEVCORE Research Team for their assistance.\n\nEntry updated September 14, 2026\n\n### libxslt\n\nWe would like to acknowledge Kubilay Berk Alkan for their assistance.\n\n### mDNSResponder\n\nWe would like to acknowledge Cem Onat Karagun, He Wei (ギカク), Jex Amro, 章鱼哥 (@aipy) of aipyaipy.com for their assistance.\n\n### PluginKit\n\nWe would like to acknowledge Asaf Cohen, Ashish Kunwar for their assistance.\n\n### Printing UIKit\n\nWe would like to acknowledge Jacolon Walker ( @call_eax ) for their assistance.\n\n### ReplayKit\n\nWe would like to acknowledge an anonymous researcher for their assistance.\n\n### System Settings\n\nWe would like to acknowledge Masaki Moriguchi for their assistance.\n\n### Time Machine\n\nWe would like to acknowledge Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs for their assistance.\n\n Published Date: September 14, 2026","published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":62499,"url":"https://support.apple.com/en-us/128069","title":"Apple: About the security content of tvOS 26.6 - Apple Support","kind":"vendor","source":"nvd","publisher":"vendor","text":"About the security content of tvOS 26.6 - Apple Support\n\n# About the security content of tvOS 26.6\n\nThis document describes the security content of tvOS 26.6.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## tvOS 26.6\n\nReleased July 27, 2026\n\n### Accounts Framework\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to fingerprint the user\n\nDescription: This issue was addressed with improved data protection.\n\nCVE-2026-64733: Rosyna Keller of Totally Not Malicious Software (paradisefacade.com)\n\n### App Store\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to access sensitive user data\n\nDescription: This issue was addressed with improved checks.\n\nCVE-2026-43801: Rahul Raj\n\n### Apple Neural Engine\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-28928: Dun\n\n### AppleAVD\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-65407: Franco Belman at Blackwing Intelligence\n\nEntry added September 14, 2026\n\n### Audio\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to cause a denial-of-service\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\n### AuthKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to fingerprint the user\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-43730: David Strnadel\n\n### AVEVideoEncoder\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to execute arbitrary code with kernel privileges\n\nDescription: A buffer overflow was addressed with improved size validation.\n\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\n### CloudAttestation\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: A maliciously crafted app may be able to bypass code signing enforcement\n\nDescription: A validation issue was addressed with improved input sanitization.\n\nCVE-2026-43813: Anton Pakhunov\n\n### CoreAudio\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing a maliciously crafted audio file may corrupt process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\n### CoreAudio\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing an audio stream in a maliciously crafted media file may terminate the process\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43744: ret2happy, Mathis Mansière, an anonymous researcher\n\nEntry updated September 14, 2026\n\n### CoreAudio\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: A remote attacker may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43803: Rahul Raj\n\n### CoreMedia\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\n### CoreMedia Video Toolbox\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43702: Nathaniel Oh (@calysteon)\n\nEntry added September 14, 2026\n\n### curl\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Authentication credentials may be sent to a server on another origin\n\nDescription: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.\n\n### FrontBoard\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to access sensitive user data\n\nCVE-2026-64742: Huỳnh Tấn Ngàn\n\n### Game Center\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: A malicious app may be able to break out of its sandbox\n\nDescription: A parsing issue in the handling of directory paths was addressed with improved path validation.\n\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\n### Game Center\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to access sensitive user data\n\nCVE-2026-43796: Ilya Andr (andrd3v) of Positive Technologies, Stanislav Jelezoglo\n\n### Heimdal\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to cause a denial-of-service\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-64692: Redon Gashi\n\n### ImageIO\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing a maliciously crafted texture may lead to unexpected app termination\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative\n\n### ImageIO\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing a maliciously crafted image may corrupt process memory\n\nCVE-2026-64716: Arni Hardarson, Jonathan Alush-Aben, Peter Malone\n\n### ImageIO\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: The issue was addressed with improved bounds checks.\n\nCVE-2026-64758: 진규정 (Gyujeong Jin, @G1uN4sh)\n\n### ImageIO\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing a maliciously crafted file may lead to a denial-of-service\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64754: PETOWORKS의 Bugeun Choi (@Bugeun), Rahul Raj\n\n### ImageIO\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing a maliciously crafted image may lead to a denial-of-service\n\nCVE-2026-64693: Geonha Lee (@leegn4a)\n\n### IOGPUFamily\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-43743: Lyutoon, Dun\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-43778: Ashish Kunwar, f0r of MurphySec, Feng Xue and XGPT of ThreatBook, Mahmoud Abdelmoniem, an anonymous researcher, Wang Yu, Lyutoon, Hiroki Imai (LAC Co., Ltd.), DARKNAVY (@DarkNavyOrg), Fábio Luís @scanpt, Nicolas Rabrenovic\n\nEntry updated September 14, 2026\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to disclose kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64709: Pasquale Scola, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: A remote attacker may be able to bypass network filters\n\nDescription: An inconsistent user interface issue was addressed with improved state management.\n\nCVE-2026-64735: Gor Aleksanyan\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43739: impost0r (ret2plt), Ruslan Dautov, Aleksandr Tarasikov, jay, Dhiyanesh Selvaraj (@redroot97), Vinay Kumar Rasala (Xplo8E) from Appknox, Lyutoon, DongJun Kim (smlijun) with UIUC, Hwiwon Lee (hwiwonl) with UIUC, Jongseong Kim (nevul37) with UIUC, Younggi Park (grill66) with UIUC, Peter Malone, an anonymous researcher, Hari Shanmugam (The Hxr1), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Marco Grassi, Dun, Daniele Castronovo, Michal Kosiorek\n\nCVE-2026-43816: Josh Maine of Calif.io, Ruslan Dautov, 재영 정, @rootxran (Rao Ali Nawaz), Chanwit Muenprakoddee (ChemIndy), an anonymous researcher, Ye Zhang (@VAR10CK) of Baidu Security, Franco Belman at Blackwing Intelligence, Christian Figueroa, Johnny Franks (@0xjohnny), Ashmit Sharma & Atul RV, Peter Malone, Muhamad Syaiful, Muneeb Amin Bhat, Dhiyanesh Selvaraj (@redroot97), Ali Marzouq, Bountyy Oy - Mihalis Haatainen, Huy Nguyen (@34306) of Calif.io\n\nEntry updated September 14, 2026\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-43822: Eddy Tsalolikhin, Michal Kosiorek\n\nCVE-2026-64729: Josh Maine of Calif.io, beist, Adam Doupé of ASU SEFCOM, Dun, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Johnny Franks (@0xjohnny)\n\nCVE-2026-43814: Somair Ansar, Huy Nguyen (@34306) of Calif.io\n\nCVE-2026-64700: Asjid Kalam (@odinshell)\n\nCVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nEntry updated September 14, 2026\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Connecting to a malicious NFS server may lead to kernel memory corruption\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-28931: Redon Gashi, Abhijeet Singh (linkedin.com/in/abhiunix/), Peter Malone, Omar Cerrito\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-43817: Huy Nguyen (@34306) of Calif.io\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: The issue was addressed with improved input sanitization.\n\nCVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel)\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A type confusion issue was addressed with improved memory handling.\n\nCVE-2026-64727: Ye Zhang (@VAR10CK) of Baidu Security\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: A remote user may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43810: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A memory initialization issue was addressed with improved memory handling.\n\nCVE-2026-64775: Ryan Hileman via Xint Code (xint.io)\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-39868: Vladislav Shevchenko (Positive Technologies), Ye Zhang (@VAR10CK) of Baidu Security, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-64720: an anonymous researcher, Asjid Kalam (@odinshell), Jian Zhou and Ye Zhang\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-64751: N.M.Praveen Nawarathne (@zblockrat)\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to access sensitive user data\n\nCVE-2026-64721: Lukas Gerlach\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-65357: YingMuo (@YingMuo) of DEVCORE Research Team, Tristan Rousseau, James Duffy (@0x4A616D657344)\n\nEntry added September 14, 2026\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to disclose kernel memory\n\nCVE-2026-65371: Vladislav Shevchenko (Positive Technologies)\n\nEntry added September 14, 2026\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-43808: Dun, deepsec of DARKNAVY (@DarkNavyOrg)\n\nEntry added September 14, 2026\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-64717: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nEntry added September 14, 2026\n\n### Libnotify\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An attacker may be able to cause unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64739: Dun\n\n### libxslt\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process crash\n\nDescription: A double free issue was addressed with improved memory management.\n\nCVE-2026-43706: Tristan Madani (@TristanInSec) from Talence Security\n\n### libxslt\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process crash\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43703: Tristan Madani (@TristanInSec) from Talence Security\n\n### Managed Configuration\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-64743: Daniel Febrero\n\n### mDNSResponder\n\nImpact: An attacker on the local network may be able to cause a denial-of-service\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64724: Daisuke Hatakeyama (@SYZD Research)\n\n### MediaRemote\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to gain root privileges\n\nCVE-2026-43723: Richard Zana, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### MobileAccessoryUpdater\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: A malicious accessory may be able to cause unexpected app termination\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-43807: Tristan Madani (@TristanInSec) from Talence Security\n\n### Model I/O\n\nImpact: Processing a maliciously crafted image may corrupt process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43729: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative\n\n### Model I/O\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nCVE-2026-64772: stratan (@5tratan), wh0am1i\n\n### Model I/O\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\n### Model I/O\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-64774: stratan (@5tratan)\n\n### Model I/O\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64770: stratan (@5tratan)\n\nCVE-2026-64769: stratan (@5tratan)\n\n### Model I/O\n\nImpact: A remote attacker may cause an unexpected app termination\n\nCVE-2026-64768: stratan (@5tratan)\n\n### Pro Res\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-43812: Francisco Knabe\n\n### Sandbox Profiles\n\nImpact: An app may be able to read a persistent device identifier\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-64741: 彦辰\n\n### SceneKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-64766: stratan (@5tratan)\n\nCVE-2026-64765: Nik Tsytsarkin, stratan (@5tratan)\n\nEntry updated September 14, 2026\n\n### SceneKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64764: stratan (@5tratan)\n\n### SceneKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nDescription: An out-of-bounds write issue was addressed by removing the vulnerable code.\n\nCVE-2026-64763: stratan (@5tratan)\n\n### Siri\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An information disclosure issue was addressed by removing the vulnerable code.\n\nCVE-2026-43800: Stanislav Jelezoglo\n\n### StorageKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to access sensitive user data\n\nDescription: A race condition was addressed with additional validation.\n\nCVE-2026-43770: Tien-Chih Lin of CyCraft Technology\n\n### Web Extensions\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: A malicious web extension may be able to cause an unexpected process crash\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 314642\n\nCVE-2026-43704: dr3dd\n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing maliciously crafted web content may result in the disclosure of process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nWebKit Bugzilla: 308046\n\nCVE-2026-43740: Arni Hardarson, Nathaniel Oh (@calysteon)\n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: A malicious website may exfiltrate data cross-origin\n\nDescription: The issue was addressed with improved checks.\n\nWebKit Bugzilla: 313357\n\nCVE-2026-43735: Gurpreet Shergill, Merrick Hare, Drinor Selmanaj (Sentry), Khai Tran, John Lussier, Rhyru9, Kwak Kiyong, Song Nuri\n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Websites may know if the user has visited a given link\n\nWebKit Bugzilla: 316827\n\nCVE-2026-64713: Kwak Kiyong, Song Nuri\n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process crash\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 313693\n\nCVE-2026-43734: Jonathan Alush-Aben\n\nWebKit Bugzilla: 313857\n\nCVE-2026-43726: Utkarsh Pal, stratan (@5tratan) of Almamater Technologies, Josef Korbel (Citadelo), Tristan Madani (@TristanInSec) from Talence Security, Gia Bui (@yabeow) from Calif.io, Narendra Singh (@_3P1C)\n\nWebKit Bugzilla: 314398\n\nCVE-2026-43709\n\nWebKit Bugzilla: 315161\n\nCVE-2026-43742: Юлия Мерцалова\n\nWebKit Bugzilla: 317227\n\nCVE-2026-43699: Tommy DeVoss from Braze Security Team (@thedawgyg)\n\nEntry updated September 14, 2026\n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Visiting a website that frames malicious content may lead to UI spoofing\n\nWebKit Bugzilla: 311660\n\nCVE-2026-64730: Kagami Rosylight of Mozilla\n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing maliciously crafted web content may disclose sensitive user information\n\nWebKit Bugzilla: 313085\n\nCVE-2026-43732: Nan Wang (@eternalsakura13)\n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to read files outside of its sandbox\n\nWebKit Bugzilla: 314867\n\nCVE-2026-43821: Brian Carpenter\n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nWebKit Bugzilla: 314115\n\nCVE-2026-43731: dr3dd\n\nWebKit Bugzilla: 313577\n\nCVE-2026-43715: Milad Nasr and Nicholas Carlini with Claude, Anthropic\n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: A malicious website may be able to process restricted web content outside the sandbox\n\nWebKit Bugzilla: 312832\n\nCVE-2026-43725: Luke Francis\n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process crash\n\nDescription: The issue was addressed with improved memory handling.\n\nWebKit Bugzilla: 312781\n\nCVE-2026-43663: stratan (@5tratan) of Almamater Technologies, Soyeon Park, Amy Burnett, Khai Tran, sherkito, Kota Toda, HexRabbit (@h3xr4bb1t) and NiNi (@terrynini38514) of DEVCORE Research Team, Using GLM From Z.AI, Tristan Madani (@TristanInSec) from Talence Security, Brian Carpenter\n\nWebKit Bugzilla: 313528\n\nCVE-2026-39872: Utkarsh Pal, Ignacio Sanmillan (@ulexec)\n\nWebKit Bugzilla: 314235\n\nCVE-2026-43712: Kwak Kiyong, Song nuri, Tristan Madani (@TristanInSec) from Talence Security\n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Maliciously crafted web content may violate iframe sandboxing policy\n\nWebKit Bugzilla: 313220\n\nCVE-2026-64728: an anonymous researcher \n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Visiting a website may leak sensitive data\n\nWebKit Bugzilla: 314806\n\nCVE-2026-43713: Jody Ritonga\n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: A malicious website may exfiltrate data cross-origin\n\nWebKit Bugzilla: 315306\n\nCVE-2026-43708: Muhamad Syaiful, Behzad Najjarpour Jabbari (@_G4ru_)\n\nEntry updated September 14, 2026\n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process crash\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nWebKit Bugzilla: 315951\n\nCVE-2026-43707: stratan (@5tratan) of Almamater Technologies, OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: A type confusion issue was addressed with improved checks.\n\nCVE-2026-43705: dr3dd\n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: A malicious website may be able to process restricted web content outside the sandbox\n\nWebKit Bugzilla: 315004\n\nCVE-2026-43701: Aaron Grattafiori - NVIDIA AI Red Team\n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nWebKit Bugzilla: 315365\n\nCVE-2026-43745: OpenAI Codex Security - Amy Burnett, Khai Tran\n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing maliciously crafted web content may disclose sensitive user information\n\nDescription: A cross-origin issue was addressed with improved tracking of security origins.\n\nWebKit Bugzilla: 315368\n\nCVE-2026-43700: Vitaly Simonovich, Christian Meurer Xavier\n\n### WebKit Canvas\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 313175\n\nCVE-2026-43720: Gia Bui (@yabeow) from Calif.io, Josef Korbel\n\nWebKit Bugzilla: 313935\n\nCVE-2026-64718: Niels Hofmans, OGINOME Tomohito, an anonymous researcher\n\nEntry updated September 14, 2026\n\n### WebKit Storage\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: A malicious website may be able to silently hijack clipboard data\n\nDescription: This issue was addressed through improved state management.\n\nCVE-2026-43721: Idan Masas\n\n### WebRTC\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process crash\n\nDescription: An out-of-bounds access issue was addressed with improved bounds checking.\n\nWebKit Bugzilla: 317324\n\nCVE-2026-28979\n\n### WebRTC\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A stack overflow was addressed with improved input validation.\n\nWebKit Bugzilla: 313350\n\nCVE-2026-43718: Nan Wang (@eternalsakura13)\n\n### WebRTC\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 313351\n\nCVE-2026-43717: Nan Wang (@eternalsakura13)\n\n### WebRTC\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: An out-of-bounds access issue was addressed with improved bounds checking.\n\nWebKit Bugzilla: 319404\n\nCVE-2026-64719: Shaheen Fazim\n\n### Wi-Fi\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An attacker in physical proximity may be able to corrupt process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64726: Mathis Mansière, Peter Malone\n\n## Additional recognition\n\n### App Intents\n\nWe would like to acknowledge Fnu Pradumna for their assistance.\n\nEntry added September 14, 2026\n\n### CoreMedia\n\nWe would like to acknowledge yaohway for their assistance.\n\n### Heimdal\n\nWe would like to acknowledge Surya Narayan Kushwaha for their assistance.\n\n### Kernel\n\nWe would like to acknowledge Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Chris Betz, Hiroki Imai (LAC Co., Ltd.) for their assistance.\n\nEntry updated September 14, 2026\n\n### libxslt\n\nWe would like to acknowledge Kubilay Berk Alkan for their assistance.\n\n### Security\n\nWe would like to acknowledge Aswin Kumar Gokula Kannan, John Lussier, Joseph Shamoon, Oleh Konko of 1seal (1seal.org), Surya Narayan Kushwaha, alick, an anonymous researcher for their assistance.\n\nEntry updated September 14, 2026\n\n### WebKit\n\nWe would like to acknowledge Gurpreet Shergill, Henock Habte, Jaya Surya Kommireddy, Junyeong Lee, Lukas Knittel (@kunte_ctf) of Ruhr-University Bochum, Nikos Fanourakis of Technical University of Crete, Sotiris Ioannidis of Technical University of Crete, Panagiotis Ilia of Cyprus University of Technology, and Kostas Drakonakis of Technical University of Crete, Souta Sugiyama, Tony Gorez (@tonygo_) for Reverse Society, Vitaly Simonovich, Youngjoon Kim of Team-Atlanta & sslab at Georgia Tech, Yuma Takeuchi, s3zer0 for their assistance.\n\nEntry updated September 14, 2026\n\n### WebKit Canvas\n\nWe would like to acknowledge Codex Security - Khai Tran, Daisuke Hatakeyama and Ryohei Ueki (@SYZD Research), David Bors at Snyk Security Labs, Giovanni Vignone and Robert van Eijk of Octane Security (octane.security), Henock Habte, Kwak Kiyong, Song nuri, Luat Nguyen (CyberJutsu Academy), Marouane Dahmani, Tom Van Goethem, an anonymous researcher, dr3dd for their assistance.\n\nEntry updated September 14, 2026\n\n### WebKit Storage\n\nWe would like to acknowledge Gurpreet Shergill, Luke Francis, Milad Nasr and Nicholas Carlini with Claude, Anthropic, Oleh Konko of 1seal (1seal.org), Vitaly Simonovich for their assistance.\n\n Published Date: September 14, 2026","published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":14241,"url":"https://support.apple.com/en-us/128067","title":"macOS Tahoe 26.6 security content","kind":"advisory","source":"nvd","publisher":"vendor","text":"About the security content of macOS Tahoe 26.6 - Apple Support\n\n# About the security content of macOS Tahoe 26.6\n\nThis document describes the security content of macOS Tahoe 26.6.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## macOS Tahoe 26.6\n\nReleased July 27, 2026\n\n### Accounts\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An access issue was addressed with additional sandbox restrictions.\n\nCVE-2026-43819: Vinay Kumar Rasala (Xplo8E) from Appknox, Chris Bailey - Short Circuit, Omar Cerrito\n\nEntry updated September 14, 2026\n\n### Accounts\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to gain root privileges\n\nDescription: A parsing issue in the handling of directory paths was addressed with improved path validation.\n\nCVE-2026-43749: Adam Franke, Ashish Kunwar, Trung Nguyen (@everping) of CyStack\n\n### Accounts Framework\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to fingerprint the user\n\nDescription: This issue was addressed with improved data protection.\n\nCVE-2026-64733: Rosyna Keller of Totally Not Malicious Software (paradisefacade.com)\n\n### afpfs\n\nAvailable for: macOS Tahoe\n\nImpact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-64767: Dave G.\n\n### afpfs\n\nImpact: Connecting to a malicious afpfs server may lead to kernel memory corruption\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-43815: Dave G.\n\nEntry added September 14, 2026\n\n### apache\n\nImpact: A remote attacker may be able to cause a denial-of-service\n\nDescription: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.\n\nCVE-2026-23918: Bartlomiej Dmitruk of striga.ai, Stanislaw Strzalkowski of isec.pl\n\nEntry updated September 14, 2026\n\n### APFS\n\nImpact: A remote user may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64695: Narendra Singh (@_3P1C), Peter Malone\n\nEntry updated September 14, 2026\n\n### App Store\n\nCVE-2026-43801: Rahul Raj\n\n### Apple Account\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-43781: Pinak Oza\n\n### Apple Account\n\nImpact: A malicious app may be able to break out of its sandbox\n\nCVE-2026-64737: Robert Mindo\n\n### Apple Account\n\nCVE-2026-65353: 章鱼哥@aipyaipy.com, Chris Bailey - Short Circuit, N.M.Praveen Nawarathne (@zblockrat), Stuart Wallace\n\nEntry added September 14, 2026\n\n### Apple Neural Engine\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43748: Vladislav Shevchenko (Positive Technologies), an anonymous researcher, tamdao, Franco Belman at Blackwing Intelligence\n\nEntry updated September 14, 2026\n\n### Apple Neural Engine\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-28928: Dun\n\n### AppleAVD\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-65407: Franco Belman at Blackwing Intelligence\n\nEntry added September 14, 2026\n\n### AppleDouble\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-43776: Rishabh Jain (rjcyber) of cyberplanet, Irvin Wang, Peter Malone, Nicolas Rabrenovic\n\nEntry updated September 14, 2026\n\n### AppleRAID\n\nImpact: A local user may be able to read kernel memory\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-43681: impost0r (ret2plt), David Ige - Beryllium Security\n\n### AppleRAID\n\nImpact: Mounting a malicious disk image may cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43761: lokerxx, Narendra Singh (@_3P1C), Lyutoon, Jordy Zomer (@pwningsystems), Richard Zana, Aswin Kumar Gokulakannan, George Stergiopoulos, InfoSec lab, Athens University of Economics and Business, Greece\n\nEntry added September 14, 2026\n\n### Assets\n\nImpact: A malicious application may be able to bypass Privacy preferences\n\nCVE-2026-43672: 이재영\n\n### ATS\n\nImpact: An app may be able to read files outside of its sandbox\n\nDescription: A permissions issue was addressed by removing the vulnerable code.\n\nCVE-2026-43763: Pavan Nallamothu, Jared Reyes\n\n### Audio\n\nImpact: An app may be able to break out of its sandbox\n\nCVE-2026-64702: John Lussier\n\n### Audio\n\nImpact: An app may be able to cause a denial-of-service\n\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\n### AuthKit\n\nCVE-2026-43730: David Strnadel\n\n### AVEVideoEncoder\n\nImpact: An app may be able to execute arbitrary code with kernel privileges\n\nDescription: A buffer overflow was addressed with improved size validation.\n\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\n### AVEVideoEncoder\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-64762: Dun, Franco Belman at Blackwing Intelligence\n\n### BackgroundAssets\n\nImpact: An app may be able to delete files for which it does not have permission\n\nCVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab\n\n### cd9660\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nCVE-2026-64698: an anonymous researcher, Richard Zana, Nathaniel Oh (@calysteon), Peter Malone\n\n### CloudAttestation\n\nImpact: A maliciously crafted app may be able to bypass code signing enforcement\n\nDescription: A validation issue was addressed with improved input sanitization.\n\nCVE-2026-43813: Anton Pakhunov\n\n### Contacts\n\nImpact: An app may be able to add contacts without user authorization\n\nCVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel Febrero\n\n### Contacts\n\nImpact: Processing a maliciously crafted contact may leak sensitive data\n\nCVE-2026-64734: Daniel Williams\n\n### Contacts\n\nCVE-2026-43797: Arni Hardarson (Neonix Security)\n\n### Control Center\n\nCVE-2026-43756: 이재영\n\n### Core Services\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to gain root privileges\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-43693: Gergely Kalman (@gergely_kalman)\n\n### CoreAudio\n\nAvailable for: macOS Tahoe\n\nImpact: Processing a maliciously crafted audio file may corrupt process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\n### CoreAudio\n\nAvailable for: macOS Tahoe\n\nImpact: Processing an audio stream in a maliciously crafted media file may terminate the process\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43744: ret2happy, Mathis Mansière, an anonymous researcher\n\nEntry updated September 14, 2026\n\n### CoreAudio\n\nAvailable for: macOS Tahoe\n\nImpact: A remote attacker may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43803: Rahul Raj\n\n### CoreMedia\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-43775: Csaba Fitzl (@theevilbit) of Iru\n\nCVE-2026-43759: 이재영, Rajdip Dey Sarkar, Arni Hardarson (Neonix Security)\n\n### CoreMedia\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\n### CoreMedia Video Toolbox\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43702: Nathaniel Oh (@calysteon)\n\nEntry added September 14, 2026\n\n### CoreServices\n\nImpact: An app may bypass Gatekeeper checks\n\nCVE-2026-28899: Kraken Cryptocurrency Exchange, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\nEntry added September 14, 2026\n\n### CoreVideo\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43802: an anonymous researcher\n\n### Crash Reporter\n\nImpact: An app may be able to leak sensitive user information\n\nCVE-2026-64710: Matthew Schneider\n\n### CUPS\n\nImpact: A malicious app may be able to gain root privileges\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-39875: Dallas Dubs, Aaron Grattafiori - NVIDIA AI Red Team, XBreach.ai, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\nCVE-2026-64701: Yongyue WANG AKA Brian.W of OKX security, Roman Zabicki, Katika Mohaseen, Aaron Grattafiori - NVIDIA AI Red Team, an anonymous researcher, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\nEntry updated September 14, 2026\n\n### curl\n\nDescription: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.\n\n### Data Detectors UI\n\nCVE-2026-43758: HvxyZLF\n\n### DesktopServices\n\nImpact: An app may bypass Gatekeeper checks\n\nDescription: A file quarantine bypass was addressed with additional checks.\n\nCVE-2026-64708: Lance Cain - Offensive Security Engineer, SpecterOps Inc.\n\n### DesktopServices\n\nImpact: A malicious app may be able to gain root privileges\n\nDescription: A race condition was addressed with improved locking.\n\nCVE-2026-43783: Tommy DeVoss from Braze Security Team (@thedawgyg), Mahmoud Abdelmoniem, Kujtim Kryeziu, YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab, 이재영, Ilya Andr (andrd3v), Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs, beist\n\nEntry added September 14, 2026\n\n### Disk Images\n\nCVE-2026-64776: Hyunwoo Kim (@v4bel)\n\n### Disk Images\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-64694: Gil Portnoy & Henry\n\n### Disk Images\n\nImpact: Parsing a maliciously crafted file may lead to an unexpected app termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-43747: Anthony Laou Hine Tsuei (@anarcheuz)\n\n### Disk Images\n\nImpact: An app may be able to bypass network restrictions\n\nCVE-2026-28945: Ayaan Ahmad\n\n### DriverKit\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43793: erdene-och Byambabayar\n\n### DriverKit\n\nCVE-2026-43753: Niels Hofmans\n\n### Foundation\n\nCVE-2026-43714: an anonymous researcher\n\n### Game Center\n\nDescription: A parsing issue in the handling of directory paths was addressed with improved path validation.\n\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\n### Game Center\n\nCVE-2026-43796: Ilya Andr (andrd3v) of Positive Technologies, Stanislav Jelezoglo\n\n### GPU Drivers\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A buffer overflow was addressed with improved size validation.\n\nCVE-2026-64691: Somair Ansar, Josh Maine of Calif.io, Johnny Franks (@0xjohnny), hxr1, Alexandre Soleiman, Alexander Tarasikov and Ruslan Dautov\n\nEntry updated September 14, 2026\n\n### Heimdal\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-64692: Redon Gashi\n\n### HFS\n\nImpact: A remote user may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-43682: Trung Nguyen (@everping) of CyStack, Dave G., Nicolas Rabrenovic, Atul R V & Ashmit Sharma, Peter Malone\n\n### HFS\n\nImpact: Processing a maliciously crafted image may lead to arbitrary code execution\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-28981: Hcamael and 章鱼哥@aipy （aipyaipy.com）, Aswin Kumar Gokulakannan, Surya Narayan Kushwaha, Dun\n\n### HFS\n\nImpact: Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-43773: Richard Zana, Peter Malone, Surya Narayan Kushwaha, Hyunwoo Kim (@v4bel), Cem Onat Karagun\n\n### HFS\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43767: Alfredo Pesoli (@__rev) of Bynar.io, Hyunwoo Kim (@v4bel)\n\nEntry updated September 14, 2026\n\n### HFS\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43764: Tristan Madani (@TristanInSec) from Talence Security\n\n### HFS\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-64697: Peter Malone\n\n### HFS\n\nAvailable for: macOS Tahoe\n\nImpact: An attacker may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43710: Peter Malone\n\n### HFS\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-64705: Surya Kushwaha, Peter Malone, Dave G.\n\nEntry added September 14, 2026\n\n### ImageIO\n\nAvailable for: macOS Tahoe\n\nImpact: Processing a maliciously crafted texture may lead to unexpected app termination\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may lead to arbitrary code execution\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-43818: an anonymous researcher\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may corrupt process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64716: Arni Hardarson, Jonathan Alush-Aben, Peter Malone\n\n### ImageIO\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: The issue was addressed with improved bounds checks.\n\nCVE-2026-64758: 진규정 (Gyujeong Jin, @G1uN4sh)\n\n### ImageIO\n\nImpact: Processing a maliciously crafted file may lead to a denial-of-service\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64754: PETOWORKS의 Bugeun Choi (@Bugeun), Rahul Raj\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may lead to a denial-of-service\n\nDescription: A type confusion issue was addressed with improved checks.\n\nCVE-2026-64693: Geonha Lee (@leegn4a)\n\n### IOKit\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-43805: 이재영\n\n### Kernel\n\nCVE-2026-43782: Igor Ushakov\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-64749: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ashish Kunwar, Hiroki Imai (LAC Co., Ltd.), hxr1\n\n### Kernel\n\nCVE-2026-64744: Ryan Hileman via Xint Code (xint.io)\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-43778: Ashish Kunwar, f0r of MurphySec, Feng Xue and XGPT of ThreatBook, Mahmoud Abdelmoniem, an anonymous researcher, Wang Yu, Lyutoon, Hiroki Imai (LAC Co., Ltd.), DARKNAVY (@DarkNavyOrg), Fábio Luís @scanpt, Nicolas Rabrenovic\n\nEntry updated September 14, 2026\n\n### Kernel\n\nImpact: A remote user may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A race condition was addressed with improved locking.\n\nCVE-2026-28982: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Adam Doupé of ASU SEFCOM\n\n### Kernel\n\nCVE-2026-64709: Pasquale Scola, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nImpact: A remote attacker may be able to bypass network filters\n\nDescription: An inconsistent user interface issue was addressed with improved state management.\n\nCVE-2026-64735: Gor Aleksanyan\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43739: impost0r (ret2plt), Ruslan Dautov, Aleksandr Tarasikov, jay, Dhiyanesh Selvaraj (@redroot97), Vinay Kumar Rasala (Xplo8E) from Appknox, Lyutoon, DongJun Kim (smlijun) with UIUC, Hwiwon Lee (hwiwonl) with UIUC, Jongseong Kim (nevul37) with UIUC, Younggi Park (grill66) with UIUC, Peter Malone, an anonymous researcher, Hari Shanmugam (The Hxr1), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Marco Grassi, Dun, Daniele Castronovo, Michal Kosiorek\n\nCVE-2026-43816: Josh Maine of Calif.io, Ruslan Dautov, 재영 정, @rootxran (Rao Ali Nawaz), Chanwit Muenprakoddee (ChemIndy), an anonymous researcher, Ye Zhang (@VAR10CK) of Baidu Security, Franco Belman at Blackwing Intelligence, Christian Figueroa, Johnny Franks (@0xjohnny), Ashmit Sharma & Atul RV, Peter Malone, Muhamad Syaiful, Muneeb Amin Bhat, Dhiyanesh Selvaraj (@redroot97), Ali Marzouq, Bountyy Oy - Mihalis Haatainen, Huy Nguyen (@34306) of Calif.io\n\nEntry updated September 14, 2026\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-43822: Eddy Tsalolikhin, Michal Kosiorek\n\nCVE-2026-64729: Josh Maine of Calif.io, beist, Adam Doupé of ASU SEFCOM, Dun, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Johnny Franks (@0xjohnny)\n\nCVE-2026-43814: Somair Ansar, Huy Nguyen (@34306) of Calif.io\n\nCVE-2026-64700: Asjid Kalam (@odinshell)\n\nCVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nEntry updated September 14, 2026\n\n### Kernel\n\nImpact: Connecting to a malicious NFS server may lead to kernel memory corruption\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-28931: Redon Gashi, Abhijeet Singh (linkedin.com/in/abhiunix/), Peter Malone, Omar Cerrito\n\nEntry updated September 14, 2026\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-43817: Huy Nguyen (@34306) of Calif.io\n\nCVE-2026-43809: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nCVE-2026-43757: Wang Yu, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A type confusion issue was addressed with improved memory handling.\n\nCVE-2026-64727: Ye Zhang (@VAR10CK) of Baidu Security\n\n### Kernel\n\nImpact: A remote user may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-43810: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-64775: Ryan Hileman via Xint Code (xint.io)\n\n### Kernel\n\nCVE-2026-64723: Ji'an Zhou, Mingxuan Yang, Ye Zhang\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-64720: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., an anonymous researcher, Asjid Kalam (@odinshell), Jian Zhou and Ye Zhang\n\nEntry updated September 14, 2026\n\n### Kernel\n\nCVE-2026-43754: Calif Research, Ernesto Martínez García\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nCVE-2026-64751: N.M.Praveen Nawarathne (@zblockrat)\n\n### Kernel\n\nCVE-2026-64721: Lukas Gerlach\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nCVE-2026-65357: YingMuo (@YingMuo) of DEVCORE Research Team, Tristan Rousseau, James Duffy (@0x4A616D657344)\n\nEntry added September 14, 2026\n\n### Kernel\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to disclose kernel memory\n\nDescription: This issue was addressed with improved redaction of sensitive information.\n\nCVE-2026-65371: Vladislav Shevchenko (Positive Technologies)\n\nEntry added September 14, 2026\n\n### Kernel\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-43808: Dun, deepsec of DARKNAVY (@DarkNavyOrg)\n\nEntry added September 14, 2026\n\n### Kernel\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-64717: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nEntry added September 14, 2026\n\n### libarchive\n\nAvailable for: macOS Tahoe\n\nImpact: Processing a maliciously crafted file may result in disclosure of process memory\n\nDescription: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.\n\n### libc\n\nImpact: A malicious app may be able to break out of its sandbox\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-28973: an anonymous researcher\n\n### Libnotify\n\nImpact: An attacker may be able to cause unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64739: Feng Xue and XGPT of ThreatBook, Dun\n\n### LoginWindow\n\nImpact: An attacker with physical access to a locked device may be able to view sensitive user information\n\nCVE-2026-43766: Amy (amys.website)\n\n### Managed Configuration\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-64743: Daniel Febrero\n\n### Maps\n\nImpact: A malicious app may be able to break out of its sandbox\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-64738: Nathaniel Oh (@calysteon), Robert Mindo\n\n### mDNSResponder\n\nImpact: A local attacker may be able to cause a denial of service\n\nDescription: A denial of service issue was addressed by removing the vulnerable code.\n\nCVE-2026-43806: He Wei (ギカク), 章鱼哥 (@aipy) of aipyaipy.com, Jex Amro, Cem Onat Karagun\n\n### mDNSResponder\n\nImpact: An attacker on the local network may be able to cause a denial-of-service\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64724: Daisuke Hatakeyama (@SYZD Research)\n\n### MediaRemote\n\nImpact: An app may be able to gain root privileges\n\nCVE-2026-43723: Richard Zana, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### Metal\n\nImpact: A malicious app may be able to corrupt memory of a system process\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-28911: yk lin of @pixiepointsec\n\n### Model I/O\n\nImpact: Processing a maliciously crafted image may corrupt process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43733: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative\n\nCVE-2026-43729: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative\n\n### Model I/O\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nCVE-2026-64772: stratan (@5tratan), wh0am1i\n\n### Model I/O\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-64771: wh0am1i\n\n### Model I/O\n\nDescription: A buffer overflow issue was addressed with improved memory handling.\n\n### Model I/O\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nCVE-2026-64774: stratan (@5tratan)\n\n### Model I/O\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nCVE-2026-64770: stratan (@5tratan)\n\nCVE-2026-64769: stratan (@5tratan)\n\n### Model I/O\n\nImpact: A remote attacker may cause an unexpected app termination\n\nCVE-2026-64768: stratan (@5tratan)\n\n### Net-SNMP\n\nImpact: An app may be able to cause a denial-of-service\n\nDescription: A stack overflow was addressed with improved input validation.\n\nCVE-2026-43771: Robert Tran\n\n### NetFSFramework\n\nCVE-2026-43772: Mickey Jin (@patch1t)\n\n### NSColorPanel\n\nCVE-2026-64711: Koh M. Nakagawa (@tsunek0h) of FFRI Security, Inc.\n\n### PackageKit\n\nCVE-2026-28912: Matej Moravec (@MacejkoMoravec)\n\n### PackageKit\n\nImpact: An app may be able to modify protected parts of the file system\n\nCVE-2026-43765: Mickey Jin (@patch1t)\n\n### ppp\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-28933: Aethel-Systems, Chanwit Muenprakoddee (ChemIndy), 九宫格 of Chongqing Telecom\n\nEntry added September 14, 2026\n\n### Printing\n\nImpact: A malicious app may be able to break out of its sandbox\n\nCVE-2026-64731: Narcis Oliveras Fontàs, Sindre Sorhus, Richard Zana\n\nEntry updated September 14, 2026\n\n### Pro Res\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43812: Francisco Knabe\n\n### quarantine\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nCVE-2026-43694: Zachary Neal, Hcamael and 章鱼哥@aipy (aipyaipy.com), JC Alvarado of Stripe, Jacob Hazak\n\nEntry updated September 14, 2026\n\n### Remote Management\n\nCVE-2026-39874: @pixiepointsec\n\n### Safari\n\nCVE-2026-43792: Ilya Andr (andrd3v)\n\n### SceneKit\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nCVE-2026-64766: stratan (@5tratan)\n\nCVE-2026-64765: Nik Tsytsarkin, stratan (@5tratan)\n\nEntry updated September 14, 2026\n\n### SceneKit\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64764: stratan (@5tratan)\n\n### SceneKit\n\nAvailable for: macOS Tahoe\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nDescription: An out-of-bounds write issue was addressed by removing the vulnerable code.\n\nCVE-2026-64763: stratan (@5tratan)\n\n### Screen Sharing Server\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to intercept network connections intended for another process\n\nDescription: A logic issue was addressed with improved restrictions.\n\nCVE-2026-43779: Dave G., Asaf Cohen\n\n### Screen Sharing Server\n\nAvailable for: macOS Tahoe\n\nImpact: A remote attacker may be able to cause a denial of service\n\nCVE-2026-43777: Junming C.(Chapoly1305)\n\n### Screen Sharing Server\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to access user-sensitive data\n\nCVE-2026-43760: Alfredo Pesoli (@__rev) of Bynar.io, wdszzml and Atuin Automated Vulnerability Discovery Engine\n\n### Security\n\nImpact: An attacker may be able to modify the state of the Keychain\n\nCVE-2026-43728: Bob Gendler of the National Institute of Standards and Technology\n\n### SecurityAgent\n\nImpact: An app may be able to gain root privileges\n\nDescription: A race condition was addressed with improved state management.\n\nCVE-2026-43755: Mickey Jin (@patch1t)\n\n### Single Sign-On\n\nCVE-2026-43762: RedRays Security Team\n\nEntry added September 14, 2026\n\n### Siri\n\nImpact: A person with physical access to a locked device may be able to access contacts and photos\n\nDescription: This issue was addressed with additional restrictions on the lock screen.\n\nCVE-2026-64745: Vivek Dhar, ASI (RM) in Border Security Force, FTR HQ BSF Kashmir\n\n### Siri\n\nCVE-2026-43800: Stanislav Jelezoglo\n\n### SMB\n\nImpact: Connecting to a malicious SMB server may lead to unexpected system termination\n\nCVE-2026-39873: Feng Xue and XGPT of ThreatBook, Peter Malone\n\nCVE-2026-64696: Feng Xue and XGPT of ThreatBook, Peter Malone\n\nEntry updated September 14, 2026\n\n### SMB\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A type confusion issue was addressed with improved memory handling.\n\nCVE-2026-64704: He Wei (ギカク), Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Aswin Kumar Gokulakannan, Kitten Food, Peter Malone, Calif.io in collaboration with Claude and Anthropic Research\n\nEntry updated September 14, 2026\n\n### Spotlight\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-43774: Csaba Fitzl (@theevilbit) of Iru\n\n### StorageKit\n\nCVE-2026-43770: Tien-Chih Lin of CyCraft Technology\n\n### udf\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43768: Hyunwoo Kim (@v4bel)\n\n### Virtualization\n\nCVE-2026-84562: Tien-Chih Lin\n\nEntry added September 14, 2026\n\n### WebDAV\n\nCVE-2026-64703: Bruce Dang of Calif.io in collaboration with Claude and Anthropic Research\n\n### WebDAV\n\nCVE-2026-64699: Bruce Dang of Calif.io\n\n### WebDAV\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-65375: YingMuo (@YingMuo) of DEVCORE Research Team, Bruce Dang of Calif.io in collaboration with Claude and Anthropic Research\n\nEntry added September 14, 2026\n\n### WebKit\n\nImpact: Websites may know if the user has visited a given link\n\nCVE-2026-64713: Kwak Kiyong, Song Nuri\n\n### WebKit\n\nImpact: Visiting a website that frames malicious content may lead to UI spoofing\n\nWebKit Bugzilla: 311660\n\nCVE-2026-64730: Kagami Rosylight of Mozilla\n\n### WebKit\n\nImpact: Maliciously crafted web content may violate iframe sandboxing policy\n\nCVE-2026-64728: an anonymous researcher \n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nCVE-2026-64783: Luke Francis, Francisco Alonso (@revskills), Shubham Chaskar, Jiyong Yang (@Sy2n0), 杉山 壮太, lattice, Behzad Najjarpour Jabbari (@_G4ru_), Junyeong Lee, Mooth.ai, OGINOME Tomohito, Using GLM From Z.AI, Gia Bui (@yabeow) from Calif.io\n\nEntry updated September 14, 2026\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nCVE-2026-64757: Milad Nasr and Nicholas Carlini with Claude, Anthropic\n\n### WebKit\n\nImpact: Visiting a website may lead to an app denial-of-service\n\nCVE-2026-43804: Heiko Kiesel of SEEMOO, TU Darmstadt\n\n### WebKit\n\nImpact: An app may be able to read files outside of its sandbox\n\nCVE-2026-43821: Brian Carpenter\n\n### WebKit Canvas\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nWebKit Bugzilla: 313935\n\nCVE-2026-64718: Niels Hofmans, OGINOME Tomohito, an anonymous researcher\n\nEntry updated September 14, 2026\n\n### WebRTC\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nCVE-2026-64719: Shaheen Fazim\n\n### Wi-Fi\n\nImpact: An attacker in physical proximity may be able to corrupt process memory\n\nCVE-2026-64726: Mathis Mansière, Peter Malone\n\n### Wi‑Fi\n\nImpact: An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-43750: an anonymous researcher\n\n### xar\n\nImpact: An app may be able to cause a denial of service\n\nDescription: A logic issue existed resulting in memory corruption. This was addressed with improved state management.\n\nCVE-2026-28932: Mathis Mansière\n\n## Additional recognition\n\n### App Intents\n\nWe would like to acknowledge Fnu Pradumna for their assistance.\n\nEntry added September 14, 2026\n\n### Apple Neural Engine\n\nWe would like to acknowledge Ye Zhang (@VAR10CK) of Baidu Security for their assistance.\n\nEntry added September 14, 2026\n\n### Audio\n\nWe would like to acknowledge Niels Hofmans for their assistance.\n\n### copyfile\n\nWe would like to acknowledge Keisuke Hosoda for their assistance.\n\n### CoreAnalytics\n\nWe would like to acknowledge Alan Banderas (@creeper4004) for their assistance.\n\n### CoreMedia\n\nWe would like to acknowledge yaohway for their assistance.\n\n### dcerpc\n\nWe would like to acknowledge Surya Narayan Kushwaha for their assistance.\n\n### Disk Images\n\nWe would like to acknowledge Jordy Zomer (@pwningsystems), Phillip Groves, Richard Zana for their assistance.\n\n### DriverKit\n\nWe would like to acknowledge Niels Hofmans for their assistance.\n\n### Foundation\n\nWe would like to acknowledge Nick Cook, Sentry Flag for their assistance.\n\n### Heimdal\n\nWe would like to acknowledge Surya Narayan Kushwaha for their assistance.\n\n### IOStorageFamily\n\nWe would like to acknowledge Aswin Kumar Gokula Kannan, Surya Narayan Kushwaha, Yatin Taneja, Fábio Luís @scanpt for their assistance.\n\nEntry updated September 14, 2026\n\n### Kerberos v5 PAM module\n\nWe would like to acknowledge Hiroki Imai, Ricerca Security, Inc. for their assistance.\n\nEntry added September 14, 2026\n\n### Kernel\n\nWe would like to acknowledge Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Chris Betz, Hiroki Imai (LAC Co., Ltd.), Mathis Mansière, Yeojin Kim for their assistance.\n\nEntry updated September 14, 2026\n\n### PluginKit\n\nWe would like to acknowledge Asaf Cohen, Ashish Kunwar for their assistance.\n\n### Printing UIKit\n\nWe would like to acknowledge Jacolon Walker ( @call_eax ) for their assistance.\n\n### RemoteServiceDiscovery\n\nWe would like to acknowledge Maliq Barnard, Tommy DeVoss from Braze Security Team (@thedawgyg), Willard Jansen for their assistance.\n\n### ReplayKit\n\nWe would like to acknowledge an anonymous researcher for their assistance.\n\n### Safari Downloads\n\nWe would like to acknowledge Alfaz Hossain for their assistance.\n\n### Screen Sharing Server\n\nWe would like to acknowledge Ayaan Ahmad, XlabAI Team of Tencent Xuanwu Lab, Atuin Automated Vulnerability Discovery Engine, Guannan Wang, Zhanpeng Liu, Jiashuo Liang, Guancheng Li for their assistance.\n\n### Security\n\nWe would like to acknowledge Aswin Kumar Gokula Kannan, John Lussier, Joseph Shamoon, Oleh Konko of 1seal (1seal.org), Surya Narayan Kushwaha, alick, an anonymous researcher for their assistance.\n\nEntry updated September 14, 2026\n\n### Spotlight\n\nWe would like to acknowledge Ilya Andr (andrd3v) and nkhmelni for their assistance.\n\n### System Settings\n\nWe would like to acknowledge Masaki Moriguchi, Omar Cerrito for their assistance.\n\n### Time Machine\n\nWe would like to acknowledge Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs for their assistance.\n\n### WebKit\n\nWe would like to acknowledge Jaya Surya Kommireddy, Lukas Knittel (@kunte_ctf) of Ruhr-University Bochum, Nikos Fanourakis of Technical University of Crete, Sotiris Ioannidis of Technical University of Crete, Panagiotis Ilia of Cyprus University of Technology, and Kostas Drakonakis of Technical University of Crete, Tony Gorez (@tonygo_) for Reverse Society, Vitaly Simonovich, Youngjoon Kim of Team-Atlanta & sslab at Georgia Tech, s3zer0, Junyeong Lee, Yuma Takeuchi for their assistance.\n\nEntry updated September 14, 2026\n\n### WebKit Canvas\n\nWe would like to acknowledge Codex Security - Khai Tran, Daisuke Hatakeyama and Ryohei Ueki (@SYZD Research), David Bors at Snyk Security Labs, Giovanni Vignone and Robert van Eijk of Octane Security (octane.security), Kwak Kiyong, Song Nuri, Luat Nguyen (CyberJutsu Academy), Tom Van Goethem, an anonymous researcher, dr3dd, Henock Habte, Marouane Dahmani for their assistance.\n\nEntry updated September 14, 2026\n\n### WebKit Storage\n\nWe would like to acknowledge Gurpreet Shergill, Luke Francis, Milad Nasr and Nicholas Carlini with Claude, Anthropic, Oleh Konko of 1seal (1seal.org), Vitaly Simonovich for their assistance.\n\n### xar\n\nWe would like to acknowledge Anurag Bohra of Microsoft, Cem Onat Karagun, Feng Xue and XGPT of ThreatBook, Kubilay Berk ALKAN, s3zer0, Parth Raval for their assistance.\n\nEntry updated September 14, 2026\n\n### XprotectFramework\n\nWe would like to acknowledge Ferdous Saljooki (@malwarezoo) of Jamf for their assistance.\n\n Published Date: September 14, 2026","published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":62496,"url":"https://support.apple.com/en-us/128066","title":"Apple: About the security content of iOS 26.6 and iPadOS 26.6 - Apple Support","kind":"vendor","source":"nvd","publisher":"vendor","text":"About the security content of iOS 26.6 and iPadOS 26.6 - Apple Support\n\n# About the security content of iOS 26.6 and iPadOS 26.6\n\nThis document describes the security content of iOS 26.6 and iPadOS 26.6.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## iOS 26.6 and iPadOS 26.6\n\nReleased July 27, 2026\n\n### Accessibility\n\nAvailable for: iPhone 11 and later\n\nImpact: An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n\nDescription: This issue was addressed through improved state management.\n\nCVE-2026-64732: Jorge Welch (@jorgwelch)\n\n### Accounts Framework\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to fingerprint the user\n\nDescription: This issue was addressed with improved data protection.\n\nCVE-2026-64733: Rosyna Keller of Totally Not Malicious Software (paradisefacade.com)\n\n### App Store\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to access sensitive user data\n\nDescription: This issue was addressed with improved checks.\n\nCVE-2026-43801: Rahul Raj\n\n### Apple Account\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-65353: 章鱼哥@aipyaipy.com, Chris Bailey - Short Circuit, N.M.Praveen Nawarathne (@zblockrat), Stuart Wallace\n\nEntry added September 14, 2026\n\n### Apple Neural Engine\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-28928: Dun\n\n### Apple Neural Engine\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43748: Vladislav Shevchenko (Positive Technologies), an anonymous researcher, tamdao, Franco Belman at Blackwing Intelligence\n\nEntry added September 14, 2026\n\n### AppleAVD\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-65407: Franco Belman at Blackwing Intelligence\n\nEntry added September 14, 2026\n\n### AppleDouble\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-43776: Irvin Wang, Peter Malone, Nicolas Rabrenovic, Rishabh Jain (rjcyber) of cyberplanet\n\nEntry updated September 14, 2026\n\n### Audio\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause a denial-of-service\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\n### AuthKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to fingerprint the user\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-43730: David Strnadel\n\n### AVEVideoEncoder\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to execute arbitrary code with kernel privileges\n\nDescription: A buffer overflow was addressed with improved size validation.\n\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\n### BackgroundAssets\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to delete files for which it does not have permission\n\nDescription: A permissions issue was addressed with improved validation.\n\nCVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab\n\n### Books\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to modify protected parts of the file system\n\nDescription: A race condition was addressed with improved checks.\n\nCVE-2026-43811: Rodolphe Brunetti (@eisw0lf) of Lupus Nova\n\n### CloudAttestation\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A maliciously crafted app may be able to bypass code signing enforcement\n\nDescription: A validation issue was addressed with improved input sanitization.\n\nCVE-2026-43813: Anton Pakhunov\n\n### Contacts\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to add contacts without user authorization\n\nDescription: An authorization issue was addressed with improved validation.\n\nCVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel Febrero\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted contact may leak sensitive data\n\nDescription: The issue was addressed with improved checks.\n\nCVE-2026-64734: Daniel Williams\n\n### Contacts\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to access information about a user's contacts\n\nCVE-2026-43797: Arni Hardarson (Neonix Security)\n\n### CoreAudio\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted audio file may corrupt process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\n### CoreAudio\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing an audio stream in a maliciously crafted media file may terminate the process\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43744: ret2happy, Mathis Mansière, an anonymous researcher\n\nEntry updated September 14, 2026\n\n### CoreAudio\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A remote attacker may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43803: Rahul Raj\n\n### CoreMedia\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\n### CoreMedia Video Toolbox\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43702: Nathaniel Oh (@calysteon)\n\nEntry added September 14, 2026\n\n### curl\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Authentication credentials may be sent to a server on another origin\n\n### DriverKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An attacker with physical access to a locked device may be able to view sensitive user information\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-43753: Niels Hofmans\n\n### Foundation\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A malicious app may be able to access protected user data\n\nDescription: The issue was addressed with improved input sanitization.\n\nCVE-2026-43714: an anonymous researcher\n\n### FrontBoard\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to access sensitive user data\n\nDescription: This issue was addressed by using HTTPS when sending information over the network.\n\nCVE-2026-64742: Huỳnh Tấn Ngàn\n\n### Game Center\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A malicious app may be able to break out of its sandbox\n\nDescription: A parsing issue in the handling of directory paths was addressed with improved path validation.\n\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\n### Game Center\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to access sensitive user data\n\nDescription: This issue was addressed with improved data protection.\n\nCVE-2026-43796: Ilya Andr (andrd3v) of Positive Technologies, Stanislav Jelezoglo\n\n### Heimdal\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause a denial-of-service\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-64692: Redon Gashi\n\n### HFS\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-64705: Surya Kushwaha, Peter Malone, Dave G.\n\nEntry added September 14, 2026\n\n### ImageIO\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted texture may lead to unexpected app termination\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative\n\n### ImageIO\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted image may lead to arbitrary code execution\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-43818: an anonymous researcher\n\n### ImageIO\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted image may corrupt process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64716: Arni Hardarson, Jonathan Alush-Aben, Peter Malone\n\n### ImageIO\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: The issue was addressed with improved bounds checks.\n\nCVE-2026-64758: 진규정 (Gyujeong Jin, @G1uN4sh)\n\n### ImageIO\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted file may lead to a denial-of-service\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64754: PETOWORKS의 Bugeun Choi (@Bugeun), Rahul Raj\n\n### ImageIO\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted image may lead to a denial-of-service\n\nDescription: A type confusion issue was addressed with improved checks.\n\nCVE-2026-64693: Geonha Lee (@leegn4a)\n\n### IOKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-43805: 이재영\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64749: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ashish Kunwar, Hiroki Imai (LAC Co., Ltd.), hxr1\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-43778: Ashish Kunwar, f0r of MurphySec, Feng Xue and XGPT of ThreatBook, Mahmoud Abdelmoniem, an anonymous researcher, Wang Yu, Lyutoon, Hiroki Imai (LAC Co., Ltd.), DARKNAVY (@DarkNavyOrg), Fábio Luís @scanpt, Nicolas Rabrenovic\n\nEntry updated September 14, 2026\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to disclose kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64709: Pasquale Scola, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A remote attacker may be able to bypass network filters\n\nDescription: An inconsistent user interface issue was addressed with improved state management.\n\nCVE-2026-64735: Gor Aleksanyan\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43739: impost0r (ret2plt), Ruslan Dautov, Aleksandr Tarasikov, jay, Dhiyanesh Selvaraj (@redroot97), Vinay Kumar Rasala (Xplo8E) from Appknox, Lyutoon, DongJun Kim (smlijun) with UIUC, Hwiwon Lee (hwiwonl) with UIUC, Jongseong Kim (nevul37) with UIUC, Younggi Park (grill66) with UIUC, Peter Malone, an anonymous researcher, Hari Shanmugam (The Hxr1), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Marco Grassi, Dun, Daniele Castronovo, Michal Kosiorek\n\nCVE-2026-43816: Josh Maine of Calif.io, Ruslan Dautov, 재영 정, @rootxran (Rao Ali Nawaz), Chanwit Muenprakoddee (ChemIndy), an anonymous researcher, Ye Zhang (@VAR10CK) of Baidu Security, Franco Belman at Blackwing Intelligence, Christian Figueroa, Johnny Franks (@0xjohnny), Ashmit Sharma & Atul RV, Peter Malone, Muhamad Syaiful, Muneeb Amin Bhat, Dhiyanesh Selvaraj (@redroot97), Ali Marzouq, Bountyy Oy - Mihalis Haatainen, Huy Nguyen (@34306) of Calif.io\n\nEntry updated September 14, 2026\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-43822: Eddy Tsalolikhin, Michal Kosiorek\n\nCVE-2026-64729: Josh Maine of Calif.io, beist, Adam Doupé of ASU SEFCOM, Dun, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Johnny Franks (@0xjohnny)\n\nCVE-2026-43814: Somair Ansar, Huy Nguyen (@34306) of Calif.io\n\nCVE-2026-64700: Asjid Kalam (@odinshell)\n\nCVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nEntry updated September 14, 2026\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Connecting to a malicious NFS server may lead to kernel memory corruption\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-28931: Redon Gashi, Abhijeet Singh (linkedin.com/in/abhiunix/), Peter Malone, Omar Cerrito\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-43817: Huy Nguyen (@34306) of Calif.io\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A remote user may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43810: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A memory initialization issue was addressed with improved memory handling.\n\nCVE-2026-64775: Ryan Hileman via Xint Code (xint.io)\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-64720: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., an anonymous researcher, Asjid Kalam (@odinshell), Jian Zhou and Ye Zhang\n\nEntry updated September 14, 2026\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-64751: N.M.Praveen Nawarathne (@zblockrat)\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to access sensitive user data\n\nDescription: This issue was addressed through improved state management.\n\nCVE-2026-64721: Lukas Gerlach\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-65357: YingMuo (@YingMuo) of DEVCORE Research Team, Tristan Rousseau, James Duffy (@0x4A616D657344)\n\nEntry added September 14, 2026\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to disclose kernel memory\n\nDescription: This issue was addressed with improved redaction of sensitive information.\n\nCVE-2026-65371: Vladislav Shevchenko (Positive Technologies)\n\nEntry added September 14, 2026\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-43808: Dun, deepsec of DARKNAVY (@DarkNavyOrg)\n\nEntry added September 14, 2026\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-64717: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nEntry added September 14, 2026\n\n### libarchive\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted file may result in disclosure of process memory\n\nDescription: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.\n\n### libc\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A malicious app may be able to break out of its sandbox\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-28973: an anonymous researcher\n\n### Libnotify\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An attacker may be able to cause unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64739: Feng Xue and XGPT of ThreatBook, Dun\n\n### Managed Configuration\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-64743: Daniel Febrero\n\n### mDNSResponder\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An attacker on the local network may be able to cause a denial-of-service\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64724: Daisuke Hatakeyama (@SYZD Research)\n\n### MediaRemote\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to gain root privileges\n\nDescription: A path handling issue was addressed with improved validation.\n\nCVE-2026-43723: Richard Zana, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### Model I/O\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted image may corrupt process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43733: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative\n\nCVE-2026-43729: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative\n\n### Model I/O\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nDescription: An out-of-bounds write issue was addressed with improved input validation.\n\nCVE-2026-64772: stratan (@5tratan), wh0am1i\n\n### Model I/O\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\n### Model I/O\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a 3D model may result in disclosure of process memory\n\nDescription: A buffer overflow issue was addressed with improved memory handling.\n\n### Model I/O\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-64774: stratan (@5tratan)\n\n### Model I/O\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64770: stratan (@5tratan)\n\nCVE-2026-64769: stratan (@5tratan)\n\n### Model I/O\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A remote attacker may cause an unexpected app termination\n\nDescription: An out-of-bounds read issue was addressed with improved input validation.\n\nCVE-2026-64768: stratan (@5tratan)\n\n### NSColorPanel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to leak sensitive user information\n\nCVE-2026-64711: Koh M. Nakagawa (@tsunek0h) of FFRI Security, Inc.\n\n### Pro Res\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-43812: Francisco Knabe\n\n### Sandbox Profiles\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to read a persistent device identifier\n\nDescription: A permissions issue was addressed with additional restrictions.\n\n### SceneKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-64766: stratan (@5tratan)\n\nCVE-2026-64765: Nik Tsytsarkin, stratan (@5tratan)\n\nEntry updated September 14, 2026\n\n### SceneKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64764: stratan (@5tratan)\n\n### SceneKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nDescription: An out-of-bounds write issue was addressed by removing the vulnerable code.\n\nCVE-2026-64763: stratan (@5tratan)\n\n### Single Sign-On\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to access user-sensitive data\n\nDescription: The issue was addressed with improved checks.\n\nCVE-2026-43762: RedRays Security Team\n\nEntry added September 14, 2026\n\n### Siri\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An information disclosure issue was addressed by removing the vulnerable code.\n\nCVE-2026-43800: Stanislav Jelezoglo\n\n### Watch App\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to fingerprint the user\n\nDescription: A privacy issue was addressed by moving sensitive data.\n\nCVE-2026-28938: Morris Richman (@morrisinlife), Asaf Cohen, Gongyu Ma (@Mezone0)\n\nEntry added September 14, 2026\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Websites may know if the user has visited a given link\n\nDescription: This issue was addressed with improved checks.\n\nWebKit Bugzilla: 316827\n\nCVE-2026-64713: Kwak Kiyong, Song Nuri\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Visiting a website that frames malicious content may lead to UI spoofing\n\nDescription: The issue was addressed with improved UI.\n\nWebKit Bugzilla: 311660\n\nCVE-2026-64730: Kagami Rosylight of Mozilla\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Maliciously crafted web content may violate iframe sandboxing policy\n\nDescription: A permissions issue was addressed with improved validation.\n\nWebKit Bugzilla: 313220\n\nCVE-2026-64728: an anonymous researcher \n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 313521\n\nCVE-2026-64783: Luke Francis, Francisco Alonso (@revskills), Shubham Chaskar, Jiyong Yang (@Sy2n0), 杉山 壮太, lattice, Behzad Najjarpour Jabbari (@_G4ru_), Junyeong Lee, Mooth.ai, OGINOME Tomohito, Using GLM From Z.AI, Gia Bui (@yabeow) from Calif.io\n\nEntry updated September 14, 2026\n\n### WebKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and la","published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: support.apple.com"},{"id":14241,"url":"https://support.apple.com/en-us/128067","title":"macOS Tahoe 26.6 security content","kind":"advisory","source":"nvd","publisher":"vendor","text":"About the security content of macOS Tahoe 26.6 - Apple Support\n\n# About the security content of macOS Tahoe 26.6\n\nThis document describes the security content of macOS Tahoe 26.6.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## macOS Tahoe 26.6\n\nReleased July 27, 2026\n\n### Accounts\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An access issue was addressed with additional sandbox restrictions.\n\nCVE-2026-43819: Vinay Kumar Rasala (Xplo8E) from Appknox, Chris Bailey - Short Circuit, Omar Cerrito\n\nEntry updated September 14, 2026\n\n### Accounts\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to gain root privileges\n\nDescription: A parsing issue in the handling of directory paths was addressed with improved path validation.\n\nCVE-2026-43749: Adam Franke, Ashish Kunwar, Trung Nguyen (@everping) of CyStack\n\n### Accounts Framework\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to fingerprint the user\n\nDescription: This issue was addressed with improved data protection.\n\nCVE-2026-64733: Rosyna Keller of Totally Not Malicious Software (paradisefacade.com)\n\n### afpfs\n\nAvailable for: macOS Tahoe\n\nImpact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-64767: Dave G.\n\n### afpfs\n\nImpact: Connecting to a malicious afpfs server may lead to kernel memory corruption\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-43815: Dave G.\n\nEntry added September 14, 2026\n\n### apache\n\nImpact: A remote attacker may be able to cause a denial-of-service\n\nDescription: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.\n\nCVE-2026-23918: Bartlomiej Dmitruk of striga.ai, Stanislaw Strzalkowski of isec.pl\n\nEntry updated September 14, 2026\n\n### APFS\n\nImpact: A remote user may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64695: Narendra Singh (@_3P1C), Peter Malone\n\nEntry updated September 14, 2026\n\n### App Store\n\nCVE-2026-43801: Rahul Raj\n\n### Apple Account\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-43781: Pinak Oza\n\n### Apple Account\n\nImpact: A malicious app may be able to break out of its sandbox\n\nCVE-2026-64737: Robert Mindo\n\n### Apple Account\n\nCVE-2026-65353: 章鱼哥@aipyaipy.com, Chris Bailey - Short Circuit, N.M.Praveen Nawarathne (@zblockrat), Stuart Wallace\n\nEntry added September 14, 2026\n\n### Apple Neural Engine\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43748: Vladislav Shevchenko (Positive Technologies), an anonymous researcher, tamdao, Franco Belman at Blackwing Intelligence\n\nEntry updated September 14, 2026\n\n### Apple Neural Engine\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-28928: Dun\n\n### AppleAVD\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-65407: Franco Belman at Blackwing Intelligence\n\nEntry added September 14, 2026\n\n### AppleDouble\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-43776: Rishabh Jain (rjcyber) of cyberplanet, Irvin Wang, Peter Malone, Nicolas Rabrenovic\n\nEntry updated September 14, 2026\n\n### AppleRAID\n\nImpact: A local user may be able to read kernel memory\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-43681: impost0r (ret2plt), David Ige - Beryllium Security\n\n### AppleRAID\n\nImpact: Mounting a malicious disk image may cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43761: lokerxx, Narendra Singh (@_3P1C), Lyutoon, Jordy Zomer (@pwningsystems), Richard Zana, Aswin Kumar Gokulakannan, George Stergiopoulos, InfoSec lab, Athens University of Economics and Business, Greece\n\nEntry added September 14, 2026\n\n### Assets\n\nImpact: A malicious application may be able to bypass Privacy preferences\n\nCVE-2026-43672: 이재영\n\n### ATS\n\nImpact: An app may be able to read files outside of its sandbox\n\nDescription: A permissions issue was addressed by removing the vulnerable code.\n\nCVE-2026-43763: Pavan Nallamothu, Jared Reyes\n\n### Audio\n\nImpact: An app may be able to break out of its sandbox\n\nCVE-2026-64702: John Lussier\n\n### Audio\n\nImpact: An app may be able to cause a denial-of-service\n\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\n### AuthKit\n\nCVE-2026-43730: David Strnadel\n\n### AVEVideoEncoder\n\nImpact: An app may be able to execute arbitrary code with kernel privileges\n\nDescription: A buffer overflow was addressed with improved size validation.\n\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\n### AVEVideoEncoder\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-64762: Dun, Franco Belman at Blackwing Intelligence\n\n### BackgroundAssets\n\nImpact: An app may be able to delete files for which it does not have permission\n\nCVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab\n\n### cd9660\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nCVE-2026-64698: an anonymous researcher, Richard Zana, Nathaniel Oh (@calysteon), Peter Malone\n\n### CloudAttestation\n\nImpact: A maliciously crafted app may be able to bypass code signing enforcement\n\nDescription: A validation issue was addressed with improved input sanitization.\n\nCVE-2026-43813: Anton Pakhunov\n\n### Contacts\n\nImpact: An app may be able to add contacts without user authorization\n\nCVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel Febrero\n\n### Contacts\n\nImpact: Processing a maliciously crafted contact may leak sensitive data\n\nCVE-2026-64734: Daniel Williams\n\n### Contacts\n\nCVE-2026-43797: Arni Hardarson (Neonix Security)\n\n### Control Center\n\nCVE-2026-43756: 이재영\n\n### Core Services\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to gain root privileges\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-43693: Gergely Kalman (@gergely_kalman)\n\n### CoreAudio\n\nAvailable for: macOS Tahoe\n\nImpact: Processing a maliciously crafted audio file may corrupt process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\n### CoreAudio\n\nAvailable for: macOS Tahoe\n\nImpact: Processing an audio stream in a maliciously crafted media file may terminate the process\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43744: ret2happy, Mathis Mansière, an anonymous researcher\n\nEntry updated September 14, 2026\n\n### CoreAudio\n\nAvailable for: macOS Tahoe\n\nImpact: A remote attacker may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43803: Rahul Raj\n\n### CoreMedia\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-43775: Csaba Fitzl (@theevilbit) of Iru\n\nCVE-2026-43759: 이재영, Rajdip Dey Sarkar, Arni Hardarson (Neonix Security)\n\n### CoreMedia\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\n### CoreMedia Video Toolbox\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43702: Nathaniel Oh (@calysteon)\n\nEntry added September 14, 2026\n\n### CoreServices\n\nImpact: An app may bypass Gatekeeper checks\n\nCVE-2026-28899: Kraken Cryptocurrency Exchange, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\nEntry added September 14, 2026\n\n### CoreVideo\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43802: an anonymous researcher\n\n### Crash Reporter\n\nImpact: An app may be able to leak sensitive user information\n\nCVE-2026-64710: Matthew Schneider\n\n### CUPS\n\nImpact: A malicious app may be able to gain root privileges\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-39875: Dallas Dubs, Aaron Grattafiori - NVIDIA AI Red Team, XBreach.ai, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\nCVE-2026-64701: Yongyue WANG AKA Brian.W of OKX security, Roman Zabicki, Katika Mohaseen, Aaron Grattafiori - NVIDIA AI Red Team, an anonymous researcher, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\nEntry updated September 14, 2026\n\n### curl\n\nDescription: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.\n\n### Data Detectors UI\n\nCVE-2026-43758: HvxyZLF\n\n### DesktopServices\n\nImpact: An app may bypass Gatekeeper checks\n\nDescription: A file quarantine bypass was addressed with additional checks.\n\nCVE-2026-64708: Lance Cain - Offensive Security Engineer, SpecterOps Inc.\n\n### DesktopServices\n\nImpact: A malicious app may be able to gain root privileges\n\nDescription: A race condition was addressed with improved locking.\n\nCVE-2026-43783: Tommy DeVoss from Braze Security Team (@thedawgyg), Mahmoud Abdelmoniem, Kujtim Kryeziu, YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab, 이재영, Ilya Andr (andrd3v), Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs, beist\n\nEntry added September 14, 2026\n\n### Disk Images\n\nCVE-2026-64776: Hyunwoo Kim (@v4bel)\n\n### Disk Images\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-64694: Gil Portnoy & Henry\n\n### Disk Images\n\nImpact: Parsing a maliciously crafted file may lead to an unexpected app termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-43747: Anthony Laou Hine Tsuei (@anarcheuz)\n\n### Disk Images\n\nImpact: An app may be able to bypass network restrictions\n\nCVE-2026-28945: Ayaan Ahmad\n\n### DriverKit\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43793: erdene-och Byambabayar\n\n### DriverKit\n\nCVE-2026-43753: Niels Hofmans\n\n### Foundation\n\nCVE-2026-43714: an anonymous researcher\n\n### Game Center\n\nDescription: A parsing issue in the handling of directory paths was addressed with improved path validation.\n\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\n### Game Center\n\nCVE-2026-43796: Ilya Andr (andrd3v) of Positive Technologies, Stanislav Jelezoglo\n\n### GPU Drivers\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A buffer overflow was addressed with improved size validation.\n\nCVE-2026-64691: Somair Ansar, Josh Maine of Calif.io, Johnny Franks (@0xjohnny), hxr1, Alexandre Soleiman, Alexander Tarasikov and Ruslan Dautov\n\nEntry updated September 14, 2026\n\n### Heimdal\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-64692: Redon Gashi\n\n### HFS\n\nImpact: A remote user may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-43682: Trung Nguyen (@everping) of CyStack, Dave G., Nicolas Rabrenovic, Atul R V & Ashmit Sharma, Peter Malone\n\n### HFS\n\nImpact: Processing a maliciously crafted image may lead to arbitrary code execution\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-28981: Hcamael and 章鱼哥@aipy （aipyaipy.com）, Aswin Kumar Gokulakannan, Surya Narayan Kushwaha, Dun\n\n### HFS\n\nImpact: Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-43773: Richard Zana, Peter Malone, Surya Narayan Kushwaha, Hyunwoo Kim (@v4bel), Cem Onat Karagun\n\n### HFS\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43767: Alfredo Pesoli (@__rev) of Bynar.io, Hyunwoo Kim (@v4bel)\n\nEntry updated September 14, 2026\n\n### HFS\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43764: Tristan Madani (@TristanInSec) from Talence Security\n\n### HFS\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-64697: Peter Malone\n\n### HFS\n\nAvailable for: macOS Tahoe\n\nImpact: An attacker may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43710: Peter Malone\n\n### HFS\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-64705: Surya Kushwaha, Peter Malone, Dave G.\n\nEntry added September 14, 2026\n\n### ImageIO\n\nAvailable for: macOS Tahoe\n\nImpact: Processing a maliciously crafted texture may lead to unexpected app termination\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may lead to arbitrary code execution\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-43818: an anonymous researcher\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may corrupt process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64716: Arni Hardarson, Jonathan Alush-Aben, Peter Malone\n\n### ImageIO\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: The issue was addressed with improved bounds checks.\n\nCVE-2026-64758: 진규정 (Gyujeong Jin, @G1uN4sh)\n\n### ImageIO\n\nImpact: Processing a maliciously crafted file may lead to a denial-of-service\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64754: PETOWORKS의 Bugeun Choi (@Bugeun), Rahul Raj\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may lead to a denial-of-service\n\nDescription: A type confusion issue was addressed with improved checks.\n\nCVE-2026-64693: Geonha Lee (@leegn4a)\n\n### IOKit\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-43805: 이재영\n\n### Kernel\n\nCVE-2026-43782: Igor Ushakov\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-64749: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ashish Kunwar, Hiroki Imai (LAC Co., Ltd.), hxr1\n\n### Kernel\n\nCVE-2026-64744: Ryan Hileman via Xint Code (xint.io)\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-43778: Ashish Kunwar, f0r of MurphySec, Feng Xue and XGPT of ThreatBook, Mahmoud Abdelmoniem, an anonymous researcher, Wang Yu, Lyutoon, Hiroki Imai (LAC Co., Ltd.), DARKNAVY (@DarkNavyOrg), Fábio Luís @scanpt, Nicolas Rabrenovic\n\nEntry updated September 14, 2026\n\n### Kernel\n\nImpact: A remote user may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A race condition was addressed with improved locking.\n\nCVE-2026-28982: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Adam Doupé of ASU SEFCOM\n\n### Kernel\n\nCVE-2026-64709: Pasquale Scola, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nImpact: A remote attacker may be able to bypass network filters\n\nDescription: An inconsistent user interface issue was addressed with improved state management.\n\nCVE-2026-64735: Gor Aleksanyan\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43739: impost0r (ret2plt), Ruslan Dautov, Aleksandr Tarasikov, jay, Dhiyanesh Selvaraj (@redroot97), Vinay Kumar Rasala (Xplo8E) from Appknox, Lyutoon, DongJun Kim (smlijun) with UIUC, Hwiwon Lee (hwiwonl) with UIUC, Jongseong Kim (nevul37) with UIUC, Younggi Park (grill66) with UIUC, Peter Malone, an anonymous researcher, Hari Shanmugam (The Hxr1), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Marco Grassi, Dun, Daniele Castronovo, Michal Kosiorek\n\nCVE-2026-43816: Josh Maine of Calif.io, Ruslan Dautov, 재영 정, @rootxran (Rao Ali Nawaz), Chanwit Muenprakoddee (ChemIndy), an anonymous researcher, Ye Zhang (@VAR10CK) of Baidu Security, Franco Belman at Blackwing Intelligence, Christian Figueroa, Johnny Franks (@0xjohnny), Ashmit Sharma & Atul RV, Peter Malone, Muhamad Syaiful, Muneeb Amin Bhat, Dhiyanesh Selvaraj (@redroot97), Ali Marzouq, Bountyy Oy - Mihalis Haatainen, Huy Nguyen (@34306) of Calif.io\n\nEntry updated September 14, 2026\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-43822: Eddy Tsalolikhin, Michal Kosiorek\n\nCVE-2026-64729: Josh Maine of Calif.io, beist, Adam Doupé of ASU SEFCOM, Dun, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Johnny Franks (@0xjohnny)\n\nCVE-2026-43814: Somair Ansar, Huy Nguyen (@34306) of Calif.io\n\nCVE-2026-64700: Asjid Kalam (@odinshell)\n\nCVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nEntry updated September 14, 2026\n\n### Kernel\n\nImpact: Connecting to a malicious NFS server may lead to kernel memory corruption\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-28931: Redon Gashi, Abhijeet Singh (linkedin.com/in/abhiunix/), Peter Malone, Omar Cerrito\n\nEntry updated September 14, 2026\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-43817: Huy Nguyen (@34306) of Calif.io\n\nCVE-2026-43809: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nCVE-2026-43757: Wang Yu, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A type confusion issue was addressed with improved memory handling.\n\nCVE-2026-64727: Ye Zhang (@VAR10CK) of Baidu Security\n\n### Kernel\n\nImpact: A remote user may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-43810: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-64775: Ryan Hileman via Xint Code (xint.io)\n\n### Kernel\n\nCVE-2026-64723: Ji'an Zhou, Mingxuan Yang, Ye Zhang\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-64720: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., an anonymous researcher, Asjid Kalam (@odinshell), Jian Zhou and Ye Zhang\n\nEntry updated September 14, 2026\n\n### Kernel\n\nCVE-2026-43754: Calif Research, Ernesto Martínez García\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nCVE-2026-64751: N.M.Praveen Nawarathne (@zblockrat)\n\n### Kernel\n\nCVE-2026-64721: Lukas Gerlach\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nCVE-2026-65357: YingMuo (@YingMuo) of DEVCORE Research Team, Tristan Rousseau, James Duffy (@0x4A616D657344)\n\nEntry added September 14, 2026\n\n### Kernel\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to disclose kernel memory\n\nDescription: This issue was addressed with improved redaction of sensitive information.\n\nCVE-2026-65371: Vladislav Shevchenko (Positive Technologies)\n\nEntry added September 14, 2026\n\n### Kernel\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-43808: Dun, deepsec of DARKNAVY (@DarkNavyOrg)\n\nEntry added September 14, 2026\n\n### Kernel\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-64717: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nEntry added September 14, 2026\n\n### libarchive\n\nAvailable for: macOS Tahoe\n\nImpact: Processing a maliciously crafted file may result in disclosure of process memory\n\nDescription: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.\n\n### libc\n\nImpact: A malicious app may be able to break out of its sandbox\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-28973: an anonymous researcher\n\n### Libnotify\n\nImpact: An attacker may be able to cause unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64739: Feng Xue and XGPT of ThreatBook, Dun\n\n### LoginWindow\n\nImpact: An attacker with physical access to a locked device may be able to view sensitive user information\n\nCVE-2026-43766: Amy (amys.website)\n\n### Managed Configuration\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-64743: Daniel Febrero\n\n### Maps\n\nImpact: A malicious app may be able to break out of its sandbox\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-64738: Nathaniel Oh (@calysteon), Robert Mindo\n\n### mDNSResponder\n\nImpact: A local attacker may be able to cause a denial of service\n\nDescription: A denial of service issue was addressed by removing the vulnerable code.\n\nCVE-2026-43806: He Wei (ギカク), 章鱼哥 (@aipy) of aipyaipy.com, Jex Amro, Cem Onat Karagun\n\n### mDNSResponder\n\nImpact: An attacker on the local network may be able to cause a denial-of-service\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64724: Daisuke Hatakeyama (@SYZD Research)\n\n### MediaRemote\n\nImpact: An app may be able to gain root privileges\n\nCVE-2026-43723: Richard Zana, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### Metal\n\nImpact: A malicious app may be able to corrupt memory of a system process\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-28911: yk lin of @pixiepointsec\n\n### Model I/O\n\nImpact: Processing a maliciously crafted image may corrupt process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43733: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative\n\nCVE-2026-43729: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative\n\n### Model I/O\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nCVE-2026-64772: stratan (@5tratan), wh0am1i\n\n### Model I/O\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-64771: wh0am1i\n\n### Model I/O\n\nDescription: A buffer overflow issue was addressed with improved memory handling.\n\n### Model I/O\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nCVE-2026-64774: stratan (@5tratan)\n\n### Model I/O\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nCVE-2026-64770: stratan (@5tratan)\n\nCVE-2026-64769: stratan (@5tratan)\n\n### Model I/O\n\nImpact: A remote attacker may cause an unexpected app termination\n\nCVE-2026-64768: stratan (@5tratan)\n\n### Net-SNMP\n\nImpact: An app may be able to cause a denial-of-service\n\nDescription: A stack overflow was addressed with improved input validation.\n\nCVE-2026-43771: Robert Tran\n\n### NetFSFramework\n\nCVE-2026-43772: Mickey Jin (@patch1t)\n\n### NSColorPanel\n\nCVE-2026-64711: Koh M. Nakagawa (@tsunek0h) of FFRI Security, Inc.\n\n### PackageKit\n\nCVE-2026-28912: Matej Moravec (@MacejkoMoravec)\n\n### PackageKit\n\nImpact: An app may be able to modify protected parts of the file system\n\nCVE-2026-43765: Mickey Jin (@patch1t)\n\n### ppp\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-28933: Aethel-Systems, Chanwit Muenprakoddee (ChemIndy), 九宫格 of Chongqing Telecom\n\nEntry added September 14, 2026\n\n### Printing\n\nImpact: A malicious app may be able to break out of its sandbox\n\nCVE-2026-64731: Narcis Oliveras Fontàs, Sindre Sorhus, Richard Zana\n\nEntry updated September 14, 2026\n\n### Pro Res\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43812: Francisco Knabe\n\n### quarantine\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nCVE-2026-43694: Zachary Neal, Hcamael and 章鱼哥@aipy (aipyaipy.com), JC Alvarado of Stripe, Jacob Hazak\n\nEntry updated September 14, 2026\n\n### Remote Management\n\nCVE-2026-39874: @pixiepointsec\n\n### Safari\n\nCVE-2026-43792: Ilya Andr (andrd3v)\n\n### SceneKit\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nCVE-2026-64766: stratan (@5tratan)\n\nCVE-2026-64765: Nik Tsytsarkin, stratan (@5tratan)\n\nEntry updated September 14, 2026\n\n### SceneKit\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64764: stratan (@5tratan)\n\n### SceneKit\n\nAvailable for: macOS Tahoe\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nDescription: An out-of-bounds write issue was addressed by removing the vulnerable code.\n\nCVE-2026-64763: stratan (@5tratan)\n\n### Screen Sharing Server\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to intercept network connections intended for another process\n\nDescription: A logic issue was addressed with improved restrictions.\n\nCVE-2026-43779: Dave G., Asaf Cohen\n\n### Screen Sharing Server\n\nAvailable for: macOS Tahoe\n\nImpact: A remote attacker may be able to cause a denial of service\n\nCVE-2026-43777: Junming C.(Chapoly1305)\n\n### Screen Sharing Server\n\nAvailable for: macOS Tahoe\n\nImpact: An app may be able to access user-sensitive data\n\nCVE-2026-43760: Alfredo Pesoli (@__rev) of Bynar.io, wdszzml and Atuin Automated Vulnerability Discovery Engine\n\n### Security\n\nImpact: An attacker may be able to modify the state of the Keychain\n\nCVE-2026-43728: Bob Gendler of the National Institute of Standards and Technology\n\n### SecurityAgent\n\nImpact: An app may be able to gain root privileges\n\nDescription: A race condition was addressed with improved state management.\n\nCVE-2026-43755: Mickey Jin (@patch1t)\n\n### Single Sign-On\n\nCVE-2026-43762: RedRays Security Team\n\nEntry added September 14, 2026\n\n### Siri\n\nImpact: A person with physical access to a locked device may be able to access contacts and photos\n\nDescription: This issue was addressed with additional restrictions on the lock screen.\n\nCVE-2026-64745: Vivek Dhar, ASI (RM) in Border Security Force, FTR HQ BSF Kashmir\n\n### Siri\n\nCVE-2026-43800: Stanislav Jelezoglo\n\n### SMB\n\nImpact: Connecting to a malicious SMB server may lead to unexpected system termination\n\nCVE-2026-39873: Feng Xue and XGPT of ThreatBook, Peter Malone\n\nCVE-2026-64696: Feng Xue and XGPT of ThreatBook, Peter Malone\n\nEntry updated September 14, 2026\n\n### SMB\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A type confusion issue was addressed with improved memory handling.\n\nCVE-2026-64704: He Wei (ギカク), Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Aswin Kumar Gokulakannan, Kitten Food, Peter Malone, Calif.io in collaboration with Claude and Anthropic Research\n\nEntry updated September 14, 2026\n\n### Spotlight\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-43774: Csaba Fitzl (@theevilbit) of Iru\n\n### StorageKit\n\nCVE-2026-43770: Tien-Chih Lin of CyCraft Technology\n\n### udf\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43768: Hyunwoo Kim (@v4bel)\n\n### Virtualization\n\nCVE-2026-84562: Tien-Chih Lin\n\nEntry added September 14, 2026\n\n### WebDAV\n\nCVE-2026-64703: Bruce Dang of Calif.io in collaboration with Claude and Anthropic Research\n\n### WebDAV\n\nCVE-2026-64699: Bruce Dang of Calif.io\n\n### WebDAV\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-65375: YingMuo (@YingMuo) of DEVCORE Research Team, Bruce Dang of Calif.io in collaboration with Claude and Anthropic Research\n\nEntry added September 14, 2026\n\n### WebKit\n\nImpact: Websites may know if the user has visited a given link\n\nCVE-2026-64713: Kwak Kiyong, Song Nuri\n\n### WebKit\n\nImpact: Visiting a website that frames malicious content may lead to UI spoofing\n\nWebKit Bugzilla: 311660\n\nCVE-2026-64730: Kagami Rosylight of Mozilla\n\n### WebKit\n\nImpact: Maliciously crafted web content may violate iframe sandboxing policy\n\nCVE-2026-64728: an anonymous researcher \n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nCVE-2026-64783: Luke Francis, Francisco Alonso (@revskills), Shubham Chaskar, Jiyong Yang (@Sy2n0), 杉山 壮太, lattice, Behzad Najjarpour Jabbari (@_G4ru_), Junyeong Lee, Mooth.ai, OGINOME Tomohito, Using GLM From Z.AI, Gia Bui (@yabeow) from Calif.io\n\nEntry updated September 14, 2026\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nCVE-2026-64757: Milad Nasr and Nicholas Carlini with Claude, Anthropic\n\n### WebKit\n\nImpact: Visiting a website may lead to an app denial-of-service\n\nCVE-2026-43804: Heiko Kiesel of SEEMOO, TU Darmstadt\n\n### WebKit\n\nImpact: An app may be able to read files outside of its sandbox\n\nCVE-2026-43821: Brian Carpenter\n\n### WebKit Canvas\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nWebKit Bugzilla: 313935\n\nCVE-2026-64718: Niels Hofmans, OGINOME Tomohito, an anonymous researcher\n\nEntry updated September 14, 2026\n\n### WebRTC\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nCVE-2026-64719: Shaheen Fazim\n\n### Wi-Fi\n\nImpact: An attacker in physical proximity may be able to corrupt process memory\n\nCVE-2026-64726: Mathis Mansière, Peter Malone\n\n### Wi‑Fi\n\nImpact: An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-43750: an anonymous researcher\n\n### xar\n\nImpact: An app may be able to cause a denial of service\n\nDescription: A logic issue existed resulting in memory corruption. This was addressed with improved state management.\n\nCVE-2026-28932: Mathis Mansière\n\n## Additional recognition\n\n### App Intents\n\nWe would like to acknowledge Fnu Pradumna for their assistance.\n\nEntry added September 14, 2026\n\n### Apple Neural Engine\n\nWe would like to acknowledge Ye Zhang (@VAR10CK) of Baidu Security for their assistance.\n\nEntry added September 14, 2026\n\n### Audio\n\nWe would like to acknowledge Niels Hofmans for their assistance.\n\n### copyfile\n\nWe would like to acknowledge Keisuke Hosoda for their assistance.\n\n### CoreAnalytics\n\nWe would like to acknowledge Alan Banderas (@creeper4004) for their assistance.\n\n### CoreMedia\n\nWe would like to acknowledge yaohway for their assistance.\n\n### dcerpc\n\nWe would like to acknowledge Surya Narayan Kushwaha for their assistance.\n\n### Disk Images\n\nWe would like to acknowledge Jordy Zomer (@pwningsystems), Phillip Groves, Richard Zana for their assistance.\n\n### DriverKit\n\nWe would like to acknowledge Niels Hofmans for their assistance.\n\n### Foundation\n\nWe would like to acknowledge Nick Cook, Sentry Flag for their assistance.\n\n### Heimdal\n\nWe would like to acknowledge Surya Narayan Kushwaha for their assistance.\n\n### IOStorageFamily\n\nWe would like to acknowledge Aswin Kumar Gokula Kannan, Surya Narayan Kushwaha, Yatin Taneja, Fábio Luís @scanpt for their assistance.\n\nEntry updated September 14, 2026\n\n### Kerberos v5 PAM module\n\nWe would like to acknowledge Hiroki Imai, Ricerca Security, Inc. for their assistance.\n\nEntry added September 14, 2026\n\n### Kernel\n\nWe would like to acknowledge Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Chris Betz, Hiroki Imai (LAC Co., Ltd.), Mathis Mansière, Yeojin Kim for their assistance.\n\nEntry updated September 14, 2026\n\n### PluginKit\n\nWe would like to acknowledge Asaf Cohen, Ashish Kunwar for their assistance.\n\n### Printing UIKit\n\nWe would like to acknowledge Jacolon Walker ( @call_eax ) for their assistance.\n\n### RemoteServiceDiscovery\n\nWe would like to acknowledge Maliq Barnard, Tommy DeVoss from Braze Security Team (@thedawgyg), Willard Jansen for their assistance.\n\n### ReplayKit\n\nWe would like to acknowledge an anonymous researcher for their assistance.\n\n### Safari Downloads\n\nWe would like to acknowledge Alfaz Hossain for their assistance.\n\n### Screen Sharing Server\n\nWe would like to acknowledge Ayaan Ahmad, XlabAI Team of Tencent Xuanwu Lab, Atuin Automated Vulnerability Discovery Engine, Guannan Wang, Zhanpeng Liu, Jiashuo Liang, Guancheng Li for their assistance.\n\n### Security\n\nWe would like to acknowledge Aswin Kumar Gokula Kannan, John Lussier, Joseph Shamoon, Oleh Konko of 1seal (1seal.org), Surya Narayan Kushwaha, alick, an anonymous researcher for their assistance.\n\nEntry updated September 14, 2026\n\n### Spotlight\n\nWe would like to acknowledge Ilya Andr (andrd3v) and nkhmelni for their assistance.\n\n### System Settings\n\nWe would like to acknowledge Masaki Moriguchi, Omar Cerrito for their assistance.\n\n### Time Machine\n\nWe would like to acknowledge Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs for their assistance.\n\n### WebKit\n\nWe would like to acknowledge Jaya Surya Kommireddy, Lukas Knittel (@kunte_ctf) of Ruhr-University Bochum, Nikos Fanourakis of Technical University of Crete, Sotiris Ioannidis of Technical University of Crete, Panagiotis Ilia of Cyprus University of Technology, and Kostas Drakonakis of Technical University of Crete, Tony Gorez (@tonygo_) for Reverse Society, Vitaly Simonovich, Youngjoon Kim of Team-Atlanta & sslab at Georgia Tech, s3zer0, Junyeong Lee, Yuma Takeuchi for their assistance.\n\nEntry updated September 14, 2026\n\n### WebKit Canvas\n\nWe would like to acknowledge Codex Security - Khai Tran, Daisuke Hatakeyama and Ryohei Ueki (@SYZD Research), David Bors at Snyk Security Labs, Giovanni Vignone and Robert van Eijk of Octane Security (octane.security), Kwak Kiyong, Song Nuri, Luat Nguyen (CyberJutsu Academy), Tom Van Goethem, an anonymous researcher, dr3dd, Henock Habte, Marouane Dahmani for their assistance.\n\nEntry updated September 14, 2026\n\n### WebKit Storage\n\nWe would like to acknowledge Gurpreet Shergill, Luke Francis, Milad Nasr and Nicholas Carlini with Claude, Anthropic, Oleh Konko of 1seal (1seal.org), Vitaly Simonovich for their assistance.\n\n### xar\n\nWe would like to acknowledge Anurag Bohra of Microsoft, Cem Onat Karagun, Feng Xue and XGPT of ThreatBook, Kubilay Berk ALKAN, s3zer0, Parth Raval for their assistance.\n\nEntry updated September 14, 2026\n\n### XprotectFramework\n\nWe would like to acknowledge Ferdous Saljooki (@malwarezoo) of Jamf for their assistance.\n\n Published Date: September 14, 2026","published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: support.apple.com"},{"id":62498,"url":"https://support.apple.com/en-us/128068","title":"Vendor advisory: support.apple.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: support.apple.com"},{"id":62499,"url":"https://support.apple.com/en-us/128069","title":"Apple: About the security content of tvOS 26.6 - Apple Support","kind":"vendor","source":"nvd","publisher":"vendor","text":"About the security content of tvOS 26.6 - Apple Support\n\n# About the security content of tvOS 26.6\n\nThis document describes the security content of tvOS 26.6.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## tvOS 26.6\n\nReleased July 27, 2026\n\n### Accounts Framework\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to fingerprint the user\n\nDescription: This issue was addressed with improved data protection.\n\nCVE-2026-64733: Rosyna Keller of Totally Not Malicious Software (paradisefacade.com)\n\n### App Store\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to access sensitive user data\n\nDescription: This issue was addressed with improved checks.\n\nCVE-2026-43801: Rahul Raj\n\n### Apple Neural Engine\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-28928: Dun\n\n### AppleAVD\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-65407: Franco Belman at Blackwing Intelligence\n\nEntry added September 14, 2026\n\n### Audio\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to cause a denial-of-service\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\n### AuthKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to fingerprint the user\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-43730: David Strnadel\n\n### AVEVideoEncoder\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to execute arbitrary code with kernel privileges\n\nDescription: A buffer overflow was addressed with improved size validation.\n\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\n### CloudAttestation\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: A maliciously crafted app may be able to bypass code signing enforcement\n\nDescription: A validation issue was addressed with improved input sanitization.\n\nCVE-2026-43813: Anton Pakhunov\n\n### CoreAudio\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing a maliciously crafted audio file may corrupt process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\n### CoreAudio\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing an audio stream in a maliciously crafted media file may terminate the process\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43744: ret2happy, Mathis Mansière, an anonymous researcher\n\nEntry updated September 14, 2026\n\n### CoreAudio\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: A remote attacker may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43803: Rahul Raj\n\n### CoreMedia\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\n### CoreMedia Video Toolbox\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43702: Nathaniel Oh (@calysteon)\n\nEntry added September 14, 2026\n\n### curl\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Authentication credentials may be sent to a server on another origin\n\nDescription: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.\n\n### FrontBoard\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to access sensitive user data\n\nCVE-2026-64742: Huỳnh Tấn Ngàn\n\n### Game Center\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: A malicious app may be able to break out of its sandbox\n\nDescription: A parsing issue in the handling of directory paths was addressed with improved path validation.\n\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\n### Game Center\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to access sensitive user data\n\nCVE-2026-43796: Ilya Andr (andrd3v) of Positive Technologies, Stanislav Jelezoglo\n\n### Heimdal\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to cause a denial-of-service\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-64692: Redon Gashi\n\n### ImageIO\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing a maliciously crafted texture may lead to unexpected app termination\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative\n\n### ImageIO\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing a maliciously crafted image may corrupt process memory\n\nCVE-2026-64716: Arni Hardarson, Jonathan Alush-Aben, Peter Malone\n\n### ImageIO\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: The issue was addressed with improved bounds checks.\n\nCVE-2026-64758: 진규정 (Gyujeong Jin, @G1uN4sh)\n\n### ImageIO\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing a maliciously crafted file may lead to a denial-of-service\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64754: PETOWORKS의 Bugeun Choi (@Bugeun), Rahul Raj\n\n### ImageIO\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing a maliciously crafted image may lead to a denial-of-service\n\nCVE-2026-64693: Geonha Lee (@leegn4a)\n\n### IOGPUFamily\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-43743: Lyutoon, Dun\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-43778: Ashish Kunwar, f0r of MurphySec, Feng Xue and XGPT of ThreatBook, Mahmoud Abdelmoniem, an anonymous researcher, Wang Yu, Lyutoon, Hiroki Imai (LAC Co., Ltd.), DARKNAVY (@DarkNavyOrg), Fábio Luís @scanpt, Nicolas Rabrenovic\n\nEntry updated September 14, 2026\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to disclose kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64709: Pasquale Scola, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: A remote attacker may be able to bypass network filters\n\nDescription: An inconsistent user interface issue was addressed with improved state management.\n\nCVE-2026-64735: Gor Aleksanyan\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43739: impost0r (ret2plt), Ruslan Dautov, Aleksandr Tarasikov, jay, Dhiyanesh Selvaraj (@redroot97), Vinay Kumar Rasala (Xplo8E) from Appknox, Lyutoon, DongJun Kim (smlijun) with UIUC, Hwiwon Lee (hwiwonl) with UIUC, Jongseong Kim (nevul37) with UIUC, Younggi Park (grill66) with UIUC, Peter Malone, an anonymous researcher, Hari Shanmugam (The Hxr1), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Marco Grassi, Dun, Daniele Castronovo, Michal Kosiorek\n\nCVE-2026-43816: Josh Maine of Calif.io, Ruslan Dautov, 재영 정, @rootxran (Rao Ali Nawaz), Chanwit Muenprakoddee (ChemIndy), an anonymous researcher, Ye Zhang (@VAR10CK) of Baidu Security, Franco Belman at Blackwing Intelligence, Christian Figueroa, Johnny Franks (@0xjohnny), Ashmit Sharma & Atul RV, Peter Malone, Muhamad Syaiful, Muneeb Amin Bhat, Dhiyanesh Selvaraj (@redroot97), Ali Marzouq, Bountyy Oy - Mihalis Haatainen, Huy Nguyen (@34306) of Calif.io\n\nEntry updated September 14, 2026\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-43822: Eddy Tsalolikhin, Michal Kosiorek\n\nCVE-2026-64729: Josh Maine of Calif.io, beist, Adam Doupé of ASU SEFCOM, Dun, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Johnny Franks (@0xjohnny)\n\nCVE-2026-43814: Somair Ansar, Huy Nguyen (@34306) of Calif.io\n\nCVE-2026-64700: Asjid Kalam (@odinshell)\n\nCVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nEntry updated September 14, 2026\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Connecting to a malicious NFS server may lead to kernel memory corruption\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-28931: Redon Gashi, Abhijeet Singh (linkedin.com/in/abhiunix/), Peter Malone, Omar Cerrito\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-43817: Huy Nguyen (@34306) of Calif.io\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: The issue was addressed with improved input sanitization.\n\nCVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel)\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A type confusion issue was addressed with improved memory handling.\n\nCVE-2026-64727: Ye Zhang (@VAR10CK) of Baidu Security\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: A remote user may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43810: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A memory initialization issue was addressed with improved memory handling.\n\nCVE-2026-64775: Ryan Hileman via Xint Code (xint.io)\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-39868: Vladislav Shevchenko (Positive Technologies), Ye Zhang (@VAR10CK) of Baidu Security, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-64720: an anonymous researcher, Asjid Kalam (@odinshell), Jian Zhou and Ye Zhang\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-64751: N.M.Praveen Nawarathne (@zblockrat)\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to access sensitive user data\n\nCVE-2026-64721: Lukas Gerlach\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-65357: YingMuo (@YingMuo) of DEVCORE Research Team, Tristan Rousseau, James Duffy (@0x4A616D657344)\n\nEntry added September 14, 2026\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to disclose kernel memory\n\nCVE-2026-65371: Vladislav Shevchenko (Positive Technologies)\n\nEntry added September 14, 2026\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-43808: Dun, deepsec of DARKNAVY (@DarkNavyOrg)\n\nEntry added September 14, 2026\n\n### Kernel\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-64717: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nEntry added September 14, 2026\n\n### Libnotify\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An attacker may be able to cause unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64739: Dun\n\n### libxslt\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process crash\n\nDescription: A double free issue was addressed with improved memory management.\n\nCVE-2026-43706: Tristan Madani (@TristanInSec) from Talence Security\n\n### libxslt\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process crash\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43703: Tristan Madani (@TristanInSec) from Talence Security\n\n### Managed Configuration\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-64743: Daniel Febrero\n\n### mDNSResponder\n\nImpact: An attacker on the local network may be able to cause a denial-of-service\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64724: Daisuke Hatakeyama (@SYZD Research)\n\n### MediaRemote\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to gain root privileges\n\nCVE-2026-43723: Richard Zana, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### MobileAccessoryUpdater\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: A malicious accessory may be able to cause unexpected app termination\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-43807: Tristan Madani (@TristanInSec) from Talence Security\n\n### Model I/O\n\nImpact: Processing a maliciously crafted image may corrupt process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43729: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative\n\n### Model I/O\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nCVE-2026-64772: stratan (@5tratan), wh0am1i\n\n### Model I/O\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\n### Model I/O\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-64774: stratan (@5tratan)\n\n### Model I/O\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64770: stratan (@5tratan)\n\nCVE-2026-64769: stratan (@5tratan)\n\n### Model I/O\n\nImpact: A remote attacker may cause an unexpected app termination\n\nCVE-2026-64768: stratan (@5tratan)\n\n### Pro Res\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-43812: Francisco Knabe\n\n### Sandbox Profiles\n\nImpact: An app may be able to read a persistent device identifier\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-64741: 彦辰\n\n### SceneKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-64766: stratan (@5tratan)\n\nCVE-2026-64765: Nik Tsytsarkin, stratan (@5tratan)\n\nEntry updated September 14, 2026\n\n### SceneKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64764: stratan (@5tratan)\n\n### SceneKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nDescription: An out-of-bounds write issue was addressed by removing the vulnerable code.\n\nCVE-2026-64763: stratan (@5tratan)\n\n### Siri\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An information disclosure issue was addressed by removing the vulnerable code.\n\nCVE-2026-43800: Stanislav Jelezoglo\n\n### StorageKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to access sensitive user data\n\nDescription: A race condition was addressed with additional validation.\n\nCVE-2026-43770: Tien-Chih Lin of CyCraft Technology\n\n### Web Extensions\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: A malicious web extension may be able to cause an unexpected process crash\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 314642\n\nCVE-2026-43704: dr3dd\n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing maliciously crafted web content may result in the disclosure of process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nWebKit Bugzilla: 308046\n\nCVE-2026-43740: Arni Hardarson, Nathaniel Oh (@calysteon)\n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: A malicious website may exfiltrate data cross-origin\n\nDescription: The issue was addressed with improved checks.\n\nWebKit Bugzilla: 313357\n\nCVE-2026-43735: Gurpreet Shergill, Merrick Hare, Drinor Selmanaj (Sentry), Khai Tran, John Lussier, Rhyru9, Kwak Kiyong, Song Nuri\n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Websites may know if the user has visited a given link\n\nWebKit Bugzilla: 316827\n\nCVE-2026-64713: Kwak Kiyong, Song Nuri\n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process crash\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 313693\n\nCVE-2026-43734: Jonathan Alush-Aben\n\nWebKit Bugzilla: 313857\n\nCVE-2026-43726: Utkarsh Pal, stratan (@5tratan) of Almamater Technologies, Josef Korbel (Citadelo), Tristan Madani (@TristanInSec) from Talence Security, Gia Bui (@yabeow) from Calif.io, Narendra Singh (@_3P1C)\n\nWebKit Bugzilla: 314398\n\nCVE-2026-43709\n\nWebKit Bugzilla: 315161\n\nCVE-2026-43742: Юлия Мерцалова\n\nWebKit Bugzilla: 317227\n\nCVE-2026-43699: Tommy DeVoss from Braze Security Team (@thedawgyg)\n\nEntry updated September 14, 2026\n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Visiting a website that frames malicious content may lead to UI spoofing\n\nWebKit Bugzilla: 311660\n\nCVE-2026-64730: Kagami Rosylight of Mozilla\n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing maliciously crafted web content may disclose sensitive user information\n\nWebKit Bugzilla: 313085\n\nCVE-2026-43732: Nan Wang (@eternalsakura13)\n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An app may be able to read files outside of its sandbox\n\nWebKit Bugzilla: 314867\n\nCVE-2026-43821: Brian Carpenter\n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nWebKit Bugzilla: 314115\n\nCVE-2026-43731: dr3dd\n\nWebKit Bugzilla: 313577\n\nCVE-2026-43715: Milad Nasr and Nicholas Carlini with Claude, Anthropic\n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: A malicious website may be able to process restricted web content outside the sandbox\n\nWebKit Bugzilla: 312832\n\nCVE-2026-43725: Luke Francis\n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process crash\n\nDescription: The issue was addressed with improved memory handling.\n\nWebKit Bugzilla: 312781\n\nCVE-2026-43663: stratan (@5tratan) of Almamater Technologies, Soyeon Park, Amy Burnett, Khai Tran, sherkito, Kota Toda, HexRabbit (@h3xr4bb1t) and NiNi (@terrynini38514) of DEVCORE Research Team, Using GLM From Z.AI, Tristan Madani (@TristanInSec) from Talence Security, Brian Carpenter\n\nWebKit Bugzilla: 313528\n\nCVE-2026-39872: Utkarsh Pal, Ignacio Sanmillan (@ulexec)\n\nWebKit Bugzilla: 314235\n\nCVE-2026-43712: Kwak Kiyong, Song nuri, Tristan Madani (@TristanInSec) from Talence Security\n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Maliciously crafted web content may violate iframe sandboxing policy\n\nWebKit Bugzilla: 313220\n\nCVE-2026-64728: an anonymous researcher \n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Visiting a website may leak sensitive data\n\nWebKit Bugzilla: 314806\n\nCVE-2026-43713: Jody Ritonga\n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: A malicious website may exfiltrate data cross-origin\n\nWebKit Bugzilla: 315306\n\nCVE-2026-43708: Muhamad Syaiful, Behzad Najjarpour Jabbari (@_G4ru_)\n\nEntry updated September 14, 2026\n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process crash\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nWebKit Bugzilla: 315951\n\nCVE-2026-43707: stratan (@5tratan) of Almamater Technologies, OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: A type confusion issue was addressed with improved checks.\n\nCVE-2026-43705: dr3dd\n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: A malicious website may be able to process restricted web content outside the sandbox\n\nWebKit Bugzilla: 315004\n\nCVE-2026-43701: Aaron Grattafiori - NVIDIA AI Red Team\n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nWebKit Bugzilla: 315365\n\nCVE-2026-43745: OpenAI Codex Security - Amy Burnett, Khai Tran\n\n### WebKit\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing maliciously crafted web content may disclose sensitive user information\n\nDescription: A cross-origin issue was addressed with improved tracking of security origins.\n\nWebKit Bugzilla: 315368\n\nCVE-2026-43700: Vitaly Simonovich, Christian Meurer Xavier\n\n### WebKit Canvas\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 313175\n\nCVE-2026-43720: Gia Bui (@yabeow) from Calif.io, Josef Korbel\n\nWebKit Bugzilla: 313935\n\nCVE-2026-64718: Niels Hofmans, OGINOME Tomohito, an anonymous researcher\n\nEntry updated September 14, 2026\n\n### WebKit Storage\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: A malicious website may be able to silently hijack clipboard data\n\nDescription: This issue was addressed through improved state management.\n\nCVE-2026-43721: Idan Masas\n\n### WebRTC\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process crash\n\nDescription: An out-of-bounds access issue was addressed with improved bounds checking.\n\nWebKit Bugzilla: 317324\n\nCVE-2026-28979\n\n### WebRTC\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A stack overflow was addressed with improved input validation.\n\nWebKit Bugzilla: 313350\n\nCVE-2026-43718: Nan Wang (@eternalsakura13)\n\n### WebRTC\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 313351\n\nCVE-2026-43717: Nan Wang (@eternalsakura13)\n\n### WebRTC\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: An out-of-bounds access issue was addressed with improved bounds checking.\n\nWebKit Bugzilla: 319404\n\nCVE-2026-64719: Shaheen Fazim\n\n### Wi-Fi\n\nAvailable for: Apple TV HD and Apple TV 4K (all models)\n\nImpact: An attacker in physical proximity may be able to corrupt process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64726: Mathis Mansière, Peter Malone\n\n## Additional recognition\n\n### App Intents\n\nWe would like to acknowledge Fnu Pradumna for their assistance.\n\nEntry added September 14, 2026\n\n### CoreMedia\n\nWe would like to acknowledge yaohway for their assistance.\n\n### Heimdal\n\nWe would like to acknowledge Surya Narayan Kushwaha for their assistance.\n\n### Kernel\n\nWe would like to acknowledge Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Chris Betz, Hiroki Imai (LAC Co., Ltd.) for their assistance.\n\nEntry updated September 14, 2026\n\n### libxslt\n\nWe would like to acknowledge Kubilay Berk Alkan for their assistance.\n\n### Security\n\nWe would like to acknowledge Aswin Kumar Gokula Kannan, John Lussier, Joseph Shamoon, Oleh Konko of 1seal (1seal.org), Surya Narayan Kushwaha, alick, an anonymous researcher for their assistance.\n\nEntry updated September 14, 2026\n\n### WebKit\n\nWe would like to acknowledge Gurpreet Shergill, Henock Habte, Jaya Surya Kommireddy, Junyeong Lee, Lukas Knittel (@kunte_ctf) of Ruhr-University Bochum, Nikos Fanourakis of Technical University of Crete, Sotiris Ioannidis of Technical University of Crete, Panagiotis Ilia of Cyprus University of Technology, and Kostas Drakonakis of Technical University of Crete, Souta Sugiyama, Tony Gorez (@tonygo_) for Reverse Society, Vitaly Simonovich, Youngjoon Kim of Team-Atlanta & sslab at Georgia Tech, Yuma Takeuchi, s3zer0 for their assistance.\n\nEntry updated September 14, 2026\n\n### WebKit Canvas\n\nWe would like to acknowledge Codex Security - Khai Tran, Daisuke Hatakeyama and Ryohei Ueki (@SYZD Research), David Bors at Snyk Security Labs, Giovanni Vignone and Robert van Eijk of Octane Security (octane.security), Henock Habte, Kwak Kiyong, Song nuri, Luat Nguyen (CyberJutsu Academy), Marouane Dahmani, Tom Van Goethem, an anonymous researcher, dr3dd for their assistance.\n\nEntry updated September 14, 2026\n\n### WebKit Storage\n\nWe would like to acknowledge Gurpreet Shergill, Luke Francis, Milad Nasr and Nicholas Carlini with Claude, Anthropic, Oleh Konko of 1seal (1seal.org), Vitaly Simonovich for their assistance.\n\n Published Date: September 14, 2026","published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: support.apple.com"},{"id":62500,"url":"https://support.apple.com/en-us/128070","title":"Vendor advisory: support.apple.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: support.apple.com"},{"id":14242,"url":"https://support.apple.com/en-us/128071","title":"macOS Sequoia 15.7.8 security content","kind":"advisory","source":"nvd","publisher":"vendor","text":"About the security content of macOS Sequoia 15.7.8 - Apple Support\n\n# About the security content of macOS Sequoia 15.7.8\n\nThis document describes the security content of macOS Sequoia 15.7.8.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## macOS Sequoia 15.7.8\n\nReleased July 27, 2026\n\n### Accounts\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to gain root privileges\n\nDescription: A parsing issue in the handling of directory paths was addressed with improved path validation.\n\nCVE-2026-43749: Adam Franke, Trung Nguyen (@everping) of CyStack, Ashish Kunwar\n\n### Accounts\n\nAvailable for: macOS Sequoia\n\nImpact: A malicious application may be able to bypass Privacy preferences\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-65404: 이재영, Vinay Kumar Rasala (Xplo8E) from Appknox, Stuart Wallace, Arni Hardarson (Neonix Security)\n\nEntry added September 14, 2026\n\n### afpfs\n\nAvailable for: macOS Sequoia\n\nImpact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-64767: Dave G.\n\n### afpfs\n\nAvailable for: macOS Sequoia\n\nImpact: Connecting to a malicious afpfs server may lead to kernel memory corruption\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-43815: Dave G.\n\nEntry added September 14, 2026\n\n### apache\n\nImpact: A remote attacker may be able to cause a denial-of-service\n\nDescription: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.\n\nCVE-2026-23918: Bartlomiej Dmitruk of striga.ai, Stanislaw Strzalkowski of isec.pl\n\nEntry updated September 14, 2026\n\n### APFS\n\nImpact: A remote user may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64695: Narendra Singh (@_3P1C), Peter Malone\n\nEntry updated September 14, 2026\n\n### App Store\n\nImpact: An app may be able to access sensitive user data\n\nCVE-2026-43801: Rahul Raj\n\n### Apple Account\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-43781: Pinak Oza\n\n### Apple Account\n\nImpact: A malicious app may be able to break out of its sandbox\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-64737: Robert Mindo\n\n### Apple Neural Engine\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43748: Vladislav Shevchenko (Positive Technologies), an anonymous researcher, tamdao, Franco Belman at Blackwing Intelligence\n\nEntry updated September 14, 2026\n\n### AppleDouble\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-43776: Peter Malone, Nicolas Rabrenovic, Irvin Wang, Rishabh Jain (rjcyber) of cyberplanet\n\nEntry updated September 14, 2026\n\n### AppleRAID\n\nImpact: A local user may be able to read kernel memory\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-43681: impost0r (ret2plt), David Ige - Beryllium Security\n\n### AppleRAID\n\nImpact: Mounting a malicious disk image may cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43761: lokerxx, Narendra Singh (@_3P1C), Lyutoon, Jordy Zomer (@pwningsystems), Richard Zana, George Stergiopoulos, InfoSec lab, Athens University of Economics and Business, Greece, Aswin Kumar Gokulakannan\n\nEntry added September 14, 2026\n\n### Assets\n\nImpact: A malicious application may be able to bypass Privacy preferences\n\nCVE-2026-43672: 이재영\n\n### ATS\n\nImpact: An app may be able to read files outside of its sandbox\n\nDescription: A permissions issue was addressed by removing the vulnerable code.\n\nCVE-2026-43763: Pavan Nallamothu, Jared Reyes\n\n### Audio\n\nImpact: An app may be able to break out of its sandbox\n\nCVE-2026-64702: John Lussier\n\n### Audio\n\nImpact: An app may be able to cause a denial-of-service\n\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\n### AVEVideoEncoder\n\nImpact: An app may be able to execute arbitrary code with kernel privileges\n\nDescription: A buffer overflow was addressed with improved size validation.\n\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\n### AVEVideoEncoder\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun\n\n### BackgroundAssets\n\nImpact: An app may be able to delete files for which it does not have permission\n\nCVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab\n\n### BOM\n\nImpact: A maliciously crafted ZIP archive may bypass Gatekeeper checks\n\nCVE-2026-28849: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs \n\n### cd9660\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nCVE-2026-64698: Richard Zana, Peter Malone, Nathaniel Oh (@calysteon), an anonymous researcher\n\n### Contacts\n\nImpact: Processing a maliciously crafted contact may leak sensitive data\n\nCVE-2026-64734: Daniel Williams\n\n### Control Center\n\nCVE-2026-43756: 이재영\n\n### Core Services\n\nImpact: An app may be able to gain root privileges\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-43693: Gergely Kalman (@gergely_kalman)\n\n### CoreAudio\n\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\n### CoreAudio\n\nImpact: Processing an audio stream in a maliciously crafted media file may terminate the process\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43744: ret2happy, Mathis Mansière, an anonymous researcher\n\nEntry updated September 14, 2026\n\n### CoreAudio\n\nImpact: A remote attacker may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43803: Rahul Raj\n\n### CoreMedia\n\nCVE-2026-43775: Csaba Fitzl (@theevilbit) of Iru\n\n### CoreMedia\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination\n\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\n### CoreServices\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nCVE-2026-28936: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### CoreUI\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted asset catalog may result in disclosure of process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43738: Peter Malone\n\n### CoreUI\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause a denial of service\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-84489: stratan (@5tratan), Peter Malone\n\nEntry added September 14, 2026\n\n### CoreVideo\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43802: an anonymous researcher\n\n### Crash Reporter\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to leak sensitive user information\n\nDescription: A privacy issue was addressed by removing sensitive data.\n\nCVE-2026-64710: Matthew Schneider\n\n### CUPS\n\nImpact: A malicious app may be able to gain root privileges\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-39875: Dallas Dubs, Aaron Grattafiori - NVIDIA AI Red Team, XBreach.ai, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\nCVE-2026-64701: Yongyue WANG AKA Brian.W of OKX security, Roman Zabicki, Katika Mohaseen, Aaron Grattafiori - NVIDIA AI Red Team, an anonymous researcher, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs, an anonymous researcher\n\nEntry updated September 14, 2026\n\n### CUPS\n\nImpact: An app may be able to gain root privileges\n\nCVE-2026-43698: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### curl\n\nImpact: Authentication credentials may be sent to a server on another origin\n\nDescription: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.\n\n### curl\n\nDescription: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.\n\nCVE-2025-14017\n\nEntry added September 14, 2026\n\n### Data Detectors UI\n\nCVE-2026-43758: HvxyZLF\n\n### DesktopServices\n\nImpact: An app may bypass Gatekeeper checks\n\nDescription: A file quarantine bypass was addressed with additional checks.\n\nCVE-2026-64708: Lance Cain - Offensive Security Engineer, SpecterOps Inc.\n\n### Disk Images\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-28926: Jonathan Bar Or (@yo_yo_yo_jbo)\n\n### Disk Images\n\nImpact: Parsing a maliciously crafted file may lead to an unexpected app termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-43747: Anthony Laou Hine Tsuei (@anarcheuz)\n\n### Disk Images\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-64694: Gil Portnoy & Henry\n\n### Disk Images\n\nImpact: An app may be able to bypass network restrictions\n\nCVE-2026-28945: Ayaan Ahmad\n\n### Disk Images\n\nCVE-2026-64776: Hyunwoo Kim (@v4bel)\n\n### DriverKit\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43793: erdene-och Byambabayar\n\n### DriverKit\n\nCVE-2026-43753: Niels Hofmans\n\n### Foundation\n\nCVE-2026-43714: an anonymous researcher\n\n### Game Center\n\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\n### Game Center\n\nCVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive Technologies\n\n### Heimdal\n\nCVE-2026-64692: Redon Gashi\n\n### HFS\n\nImpact: A remote user may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-43682: Trung Nguyen (@everping) of CyStack, Peter Malone, Nicolas Rabrenovic, Dave G., Atul R V & Ashmit Sharma\n\n### HFS\n\nImpact: Processing a maliciously crafted image may lead to arbitrary code execution\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-28981: Hcamael and 章鱼哥@aipy （aipyaipy.com）, Aswin Kumar Gokulakannan, Surya Narayan Kushwaha, Dun\n\n### HFS\n\nImpact: Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-43773: Surya Narayan Kushwaha, Richard Zana, Peter Malone, Hyunwoo Kim (@v4bel), Cem Onat Karagun\n\n### HFS\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43767: Alfredo Pesoli (@__rev) of Bynar.io, Hyunwoo Kim (@v4bel)\n\nEntry updated September 14, 2026\n\n### HFS\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-64697: Peter Malone\n\n### HFS\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43764: Tristan Madani (@TristanInSec) from Talence Security\n\n### HFS\n\nImpact: An attacker may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-43710: Peter Malone\n\n### Icons\n\nCVE-2025-43325: an anonymous researcher\n\n### ImageIO\n\nCVE-2026-64716: Peter Malone, Jonathan Alush-Aben, Arni Hardarson\n\n### ImageIO\n\nImpact: Processing a maliciously crafted texture may lead to unexpected app termination\n\nCVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may lead to arbitrary code execution\n\nCVE-2026-43818: an anonymous researcher\n\n### ImageIO\n\nCVE-2026-43661: Gandalf4a of PKU-ICODE, Anton Pakhunov, an anonymous researcher\n\n### ImageIO\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted file may lead to a denial-of-service\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64754: Rahul Raj, PETOWORKS의 Bugeun Choi (@Bugeun)\n\n### ImageIO\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted image may lead to a denial-of-service\n\nDescription: A type confusion issue was addressed with improved checks.\n\nCVE-2026-64693: Geonha Lee (@leegn4a)\n\n### ImageIO\n\nAvailable for: macOS Sequoia\n\nImpact: Processing a maliciously crafted image may lead to a denial-of-service\n\nDescription: A memory corruption issue was addressed with improved bounds checking.\n\nCVE-2026-64714: an anonymous researcher\n\nEntry added September 14, 2026\n\n### IOKit\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-43805: 이재영\n\n### IOSkywalkFamily\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2026-39877: Richard Zana, Dhiyanesh Selvaraj (@redroot97)\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64749: hxr1, Hiroki Imai (LAC Co., Ltd.), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ashish Kunwar\n\n### Kernel\n\nCVE-2026-43782: Igor Ushakov\n\n### Kernel\n\nCVE-2026-64744: Ryan Hileman via Xint Code (xint.io)\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-64775: Ryan Hileman via Xint Code (xint.io)\n\n### Kernel\n\nImpact: A remote user may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A race condition was addressed with improved locking.\n\nCVE-2026-28982: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Adam Doupé of ASU SEFCOM\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-43778: Ashish Kunwar, f0r of MurphySec, Mahmoud Abdelmoniem, Feng Xue and XGPT of ThreatBook, Wang Yu, Nicolas Rabrenovic, Lyutoon, Hiroki Imai (LAC Co., Ltd.), Fábio Luís @scanpt, DARKNAVY (@DarkNavyOrg), an anonymous researcher\n\nEntry updated September 14, 2026\n\n### Kernel\n\nImpact: A remote attacker may be able to bypass network filters\n\nDescription: An inconsistent user interface issue was addressed with improved state management.\n\nCVE-2026-64735: Gor Aleksanyan\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-43822: Michal Kosiorek, Eddy Tsalolikhin\n\nCVE-2026-64700: Asjid Kalam (@odinshell)\n\nCVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nImpact: A remote user may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-43810: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nCVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel)\n\n### Kernel\n\nImpact: An app may be able to leak sensitive kernel state\n\nCVE-2026-43722: Hyunwoo Kim (@v4bel), Feng Xue and XGPT of ThreatBook\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43809: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nCVE-2026-43757: Wang Yu, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nCVE-2026-43754: Ernesto Martínez García, Calif Research\n\n### Kernel\n\nCVE-2026-64723: Ji'an Zhou, Mingxuan Yang, Ye Zhang\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-39868: Ye Zhang (@VAR10CK) of Baidu Security, Vladislav Shevchenko (Positive Technologies), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nCVE-2026-64709: Pasquale Scola, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nCVE-2026-64721: Lukas Gerlach\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-64717: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nEntry added September 14, 2026\n\n### LaunchServices\n\nCVE-2026-20672: Kirin (@Pwnrin) and LFY (@secsys) from Fudan University\n\n### LaunchServices\n\nImpact: A remote attacker may be able to cause a denial of service\n\nCVE-2026-28983: Ruslan Dautov\n\n### libarchive\n\nImpact: Processing a maliciously crafted file may result in disclosure of process memory\n\n### libarchive\n\nImpact: A maliciously crafted ZIP archive may bypass Gatekeeper checks\n\nCVE-2026-28900: Prathamesh Walunj (@attahasa)\n\nEntry updated September 14, 2026\n\n### libc\n\nCVE-2026-28973: an anonymous researcher\n\n### Libnotify\n\nImpact: An attacker may be able to cause unexpected app termination\n\nCVE-2026-64739: Feng Xue and XGPT of ThreatBook, Dun\n\n### libxslt\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process crash\n\nCVE-2026-43703: Tristan Madani (@TristanInSec) from Talence Security\n\n### libxslt\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process crash\n\nDescription: A double free issue was addressed with improved memory management.\n\nCVE-2026-43706: Tristan Madani (@TristanInSec) from Talence Security\n\n### LoginWindow\n\nAvailable for: macOS Sequoia\n\nImpact: An attacker with physical access to a locked device may be able to view sensitive user information\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-43766: Amy (amys.website)\n\n### Maps\n\nAvailable for: macOS Sequoia\n\nImpact: A malicious app may be able to break out of its sandbox\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-64738: Robert Mindo, Nathaniel Oh (@calysteon)\n\n### mDNSResponder\n\nAvailable for: macOS Sequoia\n\nImpact: An attacker on the local network may be able to cause a denial-of-service\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43653: Atul R V\n\nCVE-2026-64724: Daisuke Hatakeyama (@SYZD Research)\n\n### MediaRemote\n\nImpact: An app may be able to gain root privileges\n\nDescription: A path handling issue was addressed with improved validation.\n\nCVE-2026-43723: Richard Zana, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### MobileAccessoryUpdater\n\nImpact: A malicious accessory may be able to cause unexpected app termination\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-43807: Tristan Madani (@TristanInSec) from Talence Security\n\n### Model I/O\n\nImpact: Processing a maliciously crafted image may corrupt process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43733: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative\n\nCVE-2026-43729: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative\n\n### Model I/O\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nDescription: An out-of-bounds write issue was addressed with improved input validation.\n\nCVE-2026-64772: wh0am1i, stratan (@5tratan)\n\n### Model I/O\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-64774: stratan (@5tratan)\n\n### Model I/O\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64770: stratan (@5tratan)\n\nCVE-2026-64769: stratan (@5tratan)\n\n### Model I/O\n\nDescription: A buffer overflow issue was addressed with improved memory handling.\n\nCVE-2026-64722: wh0am1i\n\n### Model I/O\n\nImpact: A remote attacker may cause an unexpected app termination\n\nCVE-2026-64768: stratan (@5tratan)\n\n### Model I/O\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-64771: wh0am1i\n\n### Net-SNMP\n\nImpact: An app may be able to cause a denial-of-service\n\nDescription: A stack overflow was addressed with improved input validation.\n\nCVE-2026-43771: Robert Tran\n\n### NetFSFramework\n\nCVE-2026-43772: Mickey Jin (@patch1t)\n\n### Network Extensions\n\nCVE-2026-28961: Dan Raviv\n\n### NSColorPanel\n\nCVE-2026-64711: Koh M. Nakagawa (@tsunek0h) of FFRI Security, Inc.\n\n### PackageKit\n\nCVE-2026-28912: Matej Moravec (@MacejkoMoravec)\n\n### PackageKit\n\nCVE-2026-43765: Mickey Jin (@patch1t)\n\n### ppp\n\nImpact: An attacker may be able to cause unexpected system termination or read kernel memory\n\nCVE-2026-28896: Dave G.\n\n### ppp\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-28933: 九宫格 of Chongqing Telecom, Chanwit Muenprakoddee (ChemIndy), Aethel-Systems\n\nEntry added September 14, 2026\n\n### Printing\n\nImpact: A malicious app may be able to break out of its sandbox\n\nCVE-2026-64731: Narcis Oliveras Fontàs, Sindre Sorhus, Richard Zana\n\nEntry updated September 14, 2026\n\n### Pro Res\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43812: Francisco Knabe\n\n### quarantine\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nCVE-2026-43694: Zachary Neal, Hcamael and 章鱼哥@aipy (aipyaipy.com), JC Alvarado of Stripe, Jacob Hazak\n\nEntry updated September 14, 2026\n\n### Remote Management\n\nCVE-2026-39874: @pixiepointsec\n\n### SceneKit\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nCVE-2026-64764: stratan (@5tratan)\n\n### SceneKit\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nCVE-2026-64763: stratan (@5tratan)\n\n### SceneKit\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nCVE-2026-64766: stratan (@5tratan)\n\nCVE-2026-64765: Nik Tsytsarkin, stratan (@5tratan)\n\nEntry updated September 14, 2026\n\n### Screen Sharing Server\n\nImpact: An app may be able to intercept network connections intended for another process\n\nCVE-2026-43779: Dave G., Asaf Cohen\n\n### Screen Sharing Server\n\nImpact: A remote attacker may be able to cause a denial of service\n\nCVE-2026-43777: Junming C.(Chapoly1305)\n\n### Screen Sharing Server\n\nImpact: A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n\nCVE-2026-43665: Ayaan Ahmad\n\n### Siri\n\nImpact: A person with physical access to a locked device may be able to access contacts and photos\n\nCVE-2026-64745: Vivek Dhar, ASI (RM) in Border Security Force, FTR HQ BSF Kashmir\n\n### SMB\n\nImpact: Connecting to a malicious SMB server may lead to unexpected system termination\n\nCVE-2026-39873: Feng Xue and XGPT of ThreatBook, Peter Malone\n\nCVE-2026-64696: Feng Xue and XGPT of ThreatBook, Peter Malone\n\nEntry updated September 14, 2026\n\n### SMB\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A type confusion issue was addressed with improved memory handling.\n\nCVE-2026-64704: He Wei (ギカク), Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Aswin Kumar Gokulakannan, Kitten Food, Peter Malone, Calif.io in collaboration with Claude and Anthropic Research\n\nEntry updated September 14, 2026\n\n### Spotlight\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-43774: Csaba Fitzl (@theevilbit) of Iru\n\n### StorageKit\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to access sensitive user data\n\nDescription: A race condition was addressed with additional validation.\n\nCVE-2026-43770: Tien-Chih Lin of CyCraft Technology\n\n### udf\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43768: Hyunwoo Kim (@v4bel)\n\n### WebDAV\n\nAvailable for: macOS Sequoia\n\nImpact: An app may be able to cause a denial-of-service\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-64703: Bruce Dang of Calif.io in collaboration with Claude and Anthropic Research\n\n### WebDAV\n\nImpact: An app may be able to disclose kernel memory\n\nDescription: A memory initialization issue was addressed with improved memory handling.\n\nCVE-2026-64699: Bruce Dang of Calif.io\n\n### Wi‑Fi\n\nImpact: An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-43750: an anonymous researcher\n\n### xar\n\nImpact: An app may be able to cause a denial of service\n\nDescription: A logic issue existed resulting in memory corruption. This was addressed with improved state management.\n\nCVE-2026-28932: Mathis Mansière\n\n### zip\n\nImpact: A maliciously crafted ZIP archive may bypass Gatekeeper checks\n\nDescription: A logic issue was addressed with improved file handling.\n\nCVE-2026-28914: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs (nosebeard.co)\n\n## Additional recognition\n\n### Audio\n\nWe would like to acknowledge Niels Hofmans for their assistance.\n\n### copyfile\n\nWe would like to acknowledge Keisuke Hosoda for their assistance.\n\n### CoreMedia\n\nWe would like to acknowledge yaohway for their assistance.\n\n### Disk Images\n\nWe would like to acknowledge Jordy Zomer (@pwningsystems), Phillip Groves, Richard Zana for their assistance.\n\n### Kerberos v5 PAM module\n\nWe would like to acknowledge Hiroki Imai, Ricerca Security, Inc. for their assistance.\n\nEntry added September 14, 2026\n\n### Kernel\n\nWe would like to acknowledge Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Cem Onat Karagun, Chris Betz, James Duffy (@0x4A616D657344), Lyutoon, Mathis Mansière, Tristan Rousseau, Yeojin Kim, YingMuo (@YingMuo) of DEVCORE Research Team for their assistance.\n\nEntry updated September 14, 2026\n\n### libxslt\n\nWe would like to acknowledge Kubilay Berk Alkan for their assistance.\n\n### mDNSResponder\n\nWe would like to acknowledge Cem Onat Karagun, He Wei (ギカク), Jex Amro, 章鱼哥 (@aipy) of aipyaipy.com for their assistance.\n\n### PluginKit\n\nWe would like to acknowledge Asaf Cohen, Ashish Kunwar for their assistance.\n\n### Printing UIKit\n\nWe would like to acknowledge Jacolon Walker ( @call_eax ) for their assistance.\n\n### ReplayKit\n\nWe would like to acknowledge an anonymous researcher for their assistance.\n\n### Spotlight\n\nWe would like to acknowledge Ilya Andr (andrd3v) and nkhmelni for their assistance.\n\n### System Settings\n\nWe would like to acknowledge Masaki Moriguchi for their assistance.\n\n### Time Machine\n\nWe would like to acknowledge Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs for their assistance.\n\n Published Date: September 14, 2026","published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: support.apple.com"},{"id":14243,"url":"https://support.apple.com/en-us/128072","title":"macOS Sonoma 14.8.8 security content","kind":"advisory","source":"nvd","publisher":"vendor","text":"About the security content of macOS Sonoma 14.8.8 - Apple Support\n\n# About the security content of macOS Sonoma 14.8.8\n\nThis document describes the security content of macOS Sonoma 14.8.8.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## macOS Sonoma 14.8.8\n\nReleased July 27, 2026\n\n### Accounts\n\nAvailable for: macOS Sonoma\n\nImpact: An app may be able to gain root privileges\n\nDescription: A parsing issue in the handling of directory paths was addressed with improved path validation.\n\nCVE-2026-43749: Adam Franke, Trung Nguyen (@everping) of CyStack, Ashish Kunwar\n\n### Accounts\n\nAvailable for: macOS Sonoma\n\nImpact: A malicious application may be able to bypass Privacy preferences\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-65404: 이재영, Vinay Kumar Rasala (Xplo8E) from Appknox, Stuart Wallace, Arni Hardarson (Neonix Security)\n\nEntry added September 14, 2026\n\n### afpfs\n\nAvailable for: macOS Sonoma\n\nImpact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-64767: Dave G.\n\n### afpfs\n\nAvailable for: macOS Sonoma\n\nImpact: Connecting to a malicious afpfs server may lead to kernel memory corruption\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-43815: Dave G.\n\nEntry added September 14, 2026\n\n### apache\n\nImpact: A remote attacker may be able to cause a denial-of-service\n\nDescription: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.\n\nCVE-2026-23918: Bartlomiej Dmitruk of striga.ai, Stanislaw Strzalkowski of isec.pl\n\nEntry updated September 14, 2026\n\n### APFS\n\nImpact: A remote user may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64695: Narendra Singh (@_3P1C), Peter Malone\n\nEntry updated September 14, 2026\n\n### App Store\n\nImpact: An app may be able to access sensitive user data\n\nCVE-2026-43801: Rahul Raj\n\n### Apple Account\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-43781: Pinak Oza\n\n### Apple Account\n\nImpact: A malicious app may be able to break out of its sandbox\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-64737: Robert Mindo\n\n### AppleRAID\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-43681: impost0r (ret2plt), David Ige - Beryllium Security\n\n### AppleRAID\n\nImpact: Mounting a malicious disk image may cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43761: lokerxx, Narendra Singh (@_3P1C), Lyutoon, Jordy Zomer (@pwningsystems), Richard Zana, George Stergiopoulos, InfoSec lab, Athens University of Economics and Business, Greece, Aswin Kumar Gokulakannan\n\nEntry added September 14, 2026\n\n### Assets\n\nImpact: A malicious application may be able to bypass Privacy preferences\n\nCVE-2026-43672: 이재영\n\n### ATS\n\nImpact: An app may be able to read files outside of its sandbox\n\nDescription: A permissions issue was addressed by removing the vulnerable code.\n\nCVE-2026-43763: Pavan Nallamothu, Jared Reyes\n\n### Audio\n\nImpact: An app may be able to break out of its sandbox\n\nCVE-2026-64702: John Lussier\n\n### Audio\n\nImpact: An app may be able to cause a denial-of-service\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\n### AVEVideoEncoder\n\nImpact: An app may be able to execute arbitrary code with kernel privileges\n\nDescription: A buffer overflow was addressed with improved size validation.\n\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\n### AVEVideoEncoder\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun\n\n### BackgroundAssets\n\nImpact: An app may be able to delete files for which it does not have permission\n\nCVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab\n\n### BOM\n\nImpact: A maliciously crafted ZIP archive may bypass Gatekeeper checks\n\nCVE-2026-28849: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs \n\n### cd9660\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64698: Richard Zana, Peter Malone, Nathaniel Oh (@calysteon), an anonymous researcher\n\n### Contacts\n\nImpact: Processing a maliciously crafted contact may leak sensitive data\n\nCVE-2026-64734: Daniel Williams\n\n### Control Center\n\nCVE-2026-43756: 이재영\n\n### Core Services\n\nImpact: An app may be able to gain root privileges\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-43693: Gergely Kalman (@gergely_kalman)\n\n### CoreAudio\n\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\n### CoreAudio\n\nImpact: Processing an audio stream in a maliciously crafted media file may terminate the process\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43744: ret2happy, Mathis Mansière, an anonymous researcher\n\nEntry updated September 14, 2026\n\n### CoreAudio\n\nImpact: A remote attacker may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-43803: Rahul Raj\n\n### CoreMedia\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination\n\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\n### CoreServices\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nCVE-2026-28936: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### CoreUI\n\nImpact: Processing a maliciously crafted asset catalog may result in disclosure of process memory\n\nCVE-2026-43738: Peter Malone\n\n### CoreUI\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-84489: stratan (@5tratan), Peter Malone\n\nEntry added September 14, 2026\n\n### CoreVideo\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43802: an anonymous researcher\n\n### Crash Reporter\n\nImpact: An app may be able to leak sensitive user information\n\nDescription: A privacy issue was addressed by removing sensitive data.\n\nCVE-2026-64710: Matthew Schneider\n\n### CUPS\n\nAvailable for: macOS Sonoma\n\nImpact: A malicious app may be able to gain root privileges\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-39875: XBreach.ai, Dallas Dubs, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs, Aaron Grattafiori - NVIDIA AI Red Team\n\n### CUPS\n\nAvailable for: macOS Sonoma\n\nImpact: An app may be able to gain root privileges\n\nDescription: An injection issue was addressed with improved validation.\n\nCVE-2026-43698: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### curl\n\nAvailable for: macOS Sonoma\n\nImpact: Authentication credentials may be sent to a server on another origin\n\nDescription: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.\n\n### curl\n\nAvailable for: macOS Sonoma\n\nImpact: Multiple issues in curl\n\nDescription: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.\n\nCVE-2025-14017\n\nEntry added September 14, 2026\n\n### Data Detectors UI\n\nCVE-2026-43758: HvxyZLF\n\n### DesktopServices\n\nAvailable for: macOS Sonoma\n\nImpact: An app may bypass Gatekeeper checks\n\nDescription: A file quarantine bypass was addressed with additional checks.\n\nCVE-2026-64708: Lance Cain - Offensive Security Engineer, SpecterOps Inc.\n\n### Disk Images\n\nAvailable for: macOS Sonoma\n\nImpact: An app may be able to elevate privileges\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-28926: Jonathan Bar Or (@yo_yo_yo_jbo)\n\n### Disk Images\n\nImpact: Parsing a maliciously crafted file may lead to an unexpected app termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-43747: Anthony Laou Hine Tsuei (@anarcheuz)\n\n### Disk Images\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-64694: Gil Portnoy & Henry\n\n### Disk Images\n\nImpact: An app may be able to bypass network restrictions\n\nCVE-2026-28945: Ayaan Ahmad\n\n### Disk Images\n\nCVE-2026-64776: Hyunwoo Kim (@v4bel)\n\n### DriverKit\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43793: erdene-och Byambabayar\n\n### DriverKit\n\nImpact: An attacker with physical access to a locked device may be able to view sensitive user information\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-43753: Niels Hofmans\n\n### Find My\n\nImpact: An attacker with physical access may be able to silently persist an Apple Account on an erased device\n\nCVE-2026-28836: Pyrophoria, Estifanos Megersa, and Ahmed Uddin\n\nEntry added September 14, 2026\n\n### Foundation\n\nCVE-2026-43714: an anonymous researcher\n\n### Game Center\n\nImpact: A malicious app may be able to break out of its sandbox\n\nDescription: A parsing issue in the handling of directory paths was addressed with improved path validation.\n\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\n### Game Center\n\nCVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive Technologies\n\n### Heimdal\n\nCVE-2026-64692: Redon Gashi\n\n### HFS\n\nImpact: A remote user may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-43682: Trung Nguyen (@everping) of CyStack, Peter Malone, Nicolas Rabrenovic, Dave G., Atul R V & Ashmit Sharma\n\n### HFS\n\nImpact: Processing a maliciously crafted image may lead to arbitrary code execution\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-28981: Hcamael and 章鱼哥@aipy （aipyaipy.com）, Aswin Kumar Gokulakannan, Surya Narayan Kushwaha, Dun\n\n### HFS\n\nImpact: Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-43773: Surya Narayan Kushwaha, Richard Zana, Peter Malone, Hyunwoo Kim (@v4bel), Cem Onat Karagun\n\n### HFS\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43767: Alfredo Pesoli (@__rev) of Bynar.io, Hyunwoo Kim (@v4bel)\n\nEntry updated September 14, 2026\n\n### HFS\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-64697: Peter Malone\n\n### HFS\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43764: Tristan Madani (@TristanInSec) from Talence Security\n\n### HFS\n\nImpact: An attacker may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-43710: Peter Malone\n\n### Icons\n\nCVE-2025-43325: an anonymous researcher\n\n### ImageIO\n\nCVE-2026-64716: Peter Malone, Jonathan Alush-Aben, Arni Hardarson\n\n### ImageIO\n\nImpact: Processing a maliciously crafted texture may lead to unexpected app termination\n\nCVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may lead to arbitrary code execution\n\nCVE-2026-43818: an anonymous researcher\n\n### ImageIO\n\nCVE-2026-43661: Gandalf4a of PKU-ICODE, Anton Pakhunov, an anonymous researcher\n\n### ImageIO\n\nImpact: Processing a maliciously crafted file may lead to a denial-of-service\n\nCVE-2026-64754: Rahul Raj, PETOWORKS의 Bugeun Choi (@Bugeun)\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may lead to a denial-of-service\n\nCVE-2026-64693: Geonha Lee (@leegn4a)\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may lead to a denial-of-service\n\nCVE-2026-64714: an anonymous researcher\n\nEntry added September 14, 2026\n\n### IOKit\n\nAvailable for: macOS Sonoma\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-43805: 이재영\n\n### IOSkywalkFamily\n\nAvailable for: macOS Sonoma\n\nImpact: An app may be able to disclose kernel memory\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2026-39877: Richard Zana, Dhiyanesh Selvaraj (@redroot97)\n\n### Kernel\n\nAvailable for: macOS Sonoma\n\nImpact: An app may be able to access sensitive user data\n\nDescription: This issue was addressed with improved checks.\n\nCVE-2026-43782: Igor Ushakov\n\n### Kernel\n\nImpact: An app may be able to disclose kernel memory\n\nCVE-2026-64744: Ryan Hileman via Xint Code (xint.io)\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A memory initialization issue was addressed with improved memory handling.\n\nCVE-2026-64775: Ryan Hileman via Xint Code (xint.io)\n\n### Kernel\n\nImpact: A remote user may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A race condition was addressed with improved locking.\n\nCVE-2026-28982: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Adam Doupé of ASU SEFCOM\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-43778: Ashish Kunwar, f0r of MurphySec, Mahmoud Abdelmoniem, Feng Xue and XGPT of ThreatBook, Wang Yu, Nicolas Rabrenovic, Lyutoon, Hiroki Imai (LAC Co., Ltd.), Fábio Luís @scanpt, DARKNAVY (@DarkNavyOrg), an anonymous researcher\n\nEntry updated September 14, 2026\n\n### Kernel\n\nImpact: A remote attacker may be able to bypass network filters\n\nDescription: An inconsistent user interface issue was addressed with improved state management.\n\nCVE-2026-64735: Gor Aleksanyan\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-43822: Michal Kosiorek, Eddy Tsalolikhin\n\nCVE-2026-64700: Asjid Kalam (@odinshell)\n\nCVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nImpact: A remote user may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43810: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nCVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel)\n\n### Kernel\n\nImpact: An app may be able to leak sensitive kernel state\n\nCVE-2026-43722: Hyunwoo Kim (@v4bel), Feng Xue and XGPT of ThreatBook\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-43809: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nCVE-2026-43757: Wang Yu, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nCVE-2026-43754: Ernesto Martínez García, Calif Research\n\n### Kernel\n\nCVE-2026-64723: Ji'an Zhou, Mingxuan Yang, Ye Zhang\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-39868: Ye Zhang (@VAR10CK) of Baidu Security, Vladislav Shevchenko (Positive Technologies), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nCVE-2026-64709: Pasquale Scola, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nCVE-2026-64721: Lukas Gerlach\n\n### LaunchServices\n\nCVE-2026-20672: Kirin (@Pwnrin) and LFY (@secsys) from Fudan University\n\n### LaunchServices\n\nImpact: A remote attacker may be able to cause a denial of service\n\nCVE-2026-28983: Ruslan Dautov\n\n### libarchive\n\n### libarchive\n\nImpact: A maliciously crafted ZIP archive may bypass Gatekeeper checks\n\nCVE-2026-28900: Prathamesh Walunj (@attahasa)\n\nEntry updated September 14, 2026\n\n### libc\n\nCVE-2026-28973: an anonymous researcher\n\n### Libnotify\n\nImpact: An attacker may be able to cause unexpected app termination\n\nCVE-2026-64739: Feng Xue and XGPT of ThreatBook, Dun\n\n### libxslt\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process crash\n\nCVE-2026-43703: Tristan Madani (@TristanInSec) from Talence Security\n\n### libxslt\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process crash\n\nDescription: A double free issue was addressed with improved memory management.\n\nCVE-2026-43706: Tristan Madani (@TristanInSec) from Talence Security\n\n### LoginWindow\n\nCVE-2026-43766: Amy (amys.website)\n\n### Maps\n\nImpact: A malicious app may be able to break out of its sandbox\n\nCVE-2026-64738: Robert Mindo, Nathaniel Oh (@calysteon)\n\n### mDNSResponder\n\nImpact: An attacker on the local network may be able to cause a denial-of-service\n\nCVE-2026-64724: Daisuke Hatakeyama (@SYZD Research)\n\n### MediaRemote\n\nCVE-2026-43723: Richard Zana, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### Metal\n\nCVE-2026-28911: yk lin of @pixiepointsec\n\n### MobileAccessoryUpdater\n\nImpact: A malicious accessory may be able to cause unexpected app termination\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-43807: Tristan Madani (@TristanInSec) from Talence Security\n\n### Model I/O\n\nAvailable for: macOS Sonoma\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-64774: stratan (@5tratan)\n\n### Model I/O\n\nAvailable for: macOS Sonoma\n\nImpact: A remote attacker may be able to cause unexpected application termination or heap corruption\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64770: stratan (@5tratan)\n\nCVE-2026-64769: stratan (@5tratan)\n\n### Model I/O\n\nImpact: A remote attacker may cause an unexpected app termination\n\nDescription: An out-of-bounds read issue was addressed with improved input validation.\n\nCVE-2026-64768: stratan (@5tratan)\n\n### Net-SNMP\n\nImpact: An app may be able to cause a denial-of-service\n\nDescription: A stack overflow was addressed with improved input validation.\n\nCVE-2026-43771: Robert Tran\n\n### NetFSFramework\n\nImpact: An app may be able to break out of its sandbox\n\nDescription: A path traversal issue was addressed with improved input validation.\n\nCVE-2026-43772: Mickey Jin (@patch1t)\n\n### Network Extensions\n\nImpact: An attacker with physical access to a locked device may be able to view sensitive user information\n\nCVE-2026-28961: Dan Raviv\n\n### NSColorPanel\n\nCVE-2026-64711: Koh M. Nakagawa (@tsunek0h) of FFRI Security, Inc.\n\n### NSDocument\n\nDescription: A parsing issue in the handling of directory paths was addressed with improved path validation.\n\nCVE-2026-86902: silo\n\nEntry added September 14, 2026\n\n### PackageKit\n\nImpact: An app may be able to modify protected parts of the file system\n\nCVE-2026-43765: Mickey Jin (@patch1t)\n\n### ppp\n\nImpact: An attacker may be able to cause unexpected system termination or read kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-28896: Dave G.\n\n### ppp\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-28933: 九宫格 of Chongqing Telecom, Chanwit Muenprakoddee (ChemIndy), Aethel-Systems\n\nEntry added September 14, 2026\n\n### quarantine\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nCVE-2026-43694: Zachary Neal, Hcamael and 章鱼哥@aipy (aipyaipy.com), JC Alvarado of Stripe, Jacob Hazak\n\nEntry updated September 14, 2026\n\n### Remote Management\n\nImpact: A malicious app may be able to gain root privileges\n\nCVE-2026-39874: @pixiepointsec\n\n### SceneKit\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nCVE-2026-64764: stratan (@5tratan)\n\n### SceneKit\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nCVE-2026-64763: stratan (@5tratan)\n\n### SceneKit\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n\nCVE-2026-64766: stratan (@5tratan)\n\nCVE-2026-64765: Nik Tsytsarkin, stratan (@5tratan)\n\nEntry updated September 14, 2026\n\n### Screen Sharing Server\n\nImpact: An app may be able to intercept network connections intended for another process\n\nCVE-2026-43779: Dave G., Asaf Cohen\n\n### Screen Sharing Server\n\nImpact: A remote attacker may be able to cause a denial of service\n\nCVE-2026-43777: Junming C.(Chapoly1305)\n\n### Screen Sharing Server\n\nImpact: A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n\nCVE-2026-43665: Ayaan Ahmad\n\n### Screen Sharing Server\n\nCVE-2026-43760: wdszzml and Atuin Automated Vulnerability Discovery Engine, Alfredo Pesoli (@__rev) of Bynar.io\n\n### SecurityAgent\n\nCVE-2026-43755: Mickey Jin (@patch1t)\n\n### SMB\n\nImpact: Connecting to a malicious SMB server may lead to unexpected system termination\n\nCVE-2026-39873: Feng Xue and XGPT of ThreatBook, Peter Malone\n\nCVE-2026-64696: Feng Xue and XGPT of ThreatBook, Peter Malone\n\nEntry updated September 14, 2026\n\n### SMB\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A type confusion issue was addressed with improved memory handling.\n\nCVE-2026-64704: He Wei (ギカク), Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Aswin Kumar Gokulakannan, Kitten Food, Peter Malone, Calif.io in collaboration with Claude and Anthropic Research\n\nEntry updated September 14, 2026\n\n### Spotlight\n\nCVE-2026-43774: Csaba Fitzl (@theevilbit) of Iru\n\n### StorageKit\n\nCVE-2026-43770: Tien-Chih Lin of CyCraft Technology\n\n### udf\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-43768: Hyunwoo Kim (@v4bel)\n\n### WebDAV\n\nImpact: An app may be able to cause a denial-of-service\n\nCVE-2026-64703: Bruce Dang of Calif.io in collaboration with Claude and Anthropic Research\n\n### WebDAV\n\nCVE-2026-64699: Bruce Dang of Calif.io\n\n### Wi‑Fi\n\nImpact: An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-43750: an anonymous researcher\n\n### xar\n\nCVE-2026-28932: Mathis Mansière\n\n### zip\n\nImpact: A maliciously crafted ZIP archive may bypass Gatekeeper checks\n\nCVE-2026-28914: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs (nosebeard.co)\n\n## Additional recognition\n\n### Audio\n\nWe would like to acknowledge Niels Hofmans for their assistance.\n\n### copyfile\n\nWe would like to acknowledge Keisuke Hosoda for their assistance.\n\n### CoreMedia\n\nWe would like to acknowledge yaohway for their assistance.\n\n### Disk Images\n\nWe would like to acknowledge Jordy Zomer (@pwningsystems), Phillip Groves, Richard Zana for their assistance.\n\n### Kerberos v5 PAM module\n\nWe would like to acknowledge Hiroki Imai, Ricerca Security, Inc. for their assistance.\n\nEntry added September 14, 2026\n\n### Kernel\n\nWe would like to acknowledge Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Cem Onat Karagun, James Duffy (@0x4A616D657344), Lyutoon, Mathis Mansière, Tristan Rousseau, Yeojin Kim, YingMuo (@YingMuo) of DEVCORE Research Team for their assistance.\n\nEntry updated September 14, 2026\n\n### libxslt\n\nWe would like to acknowledge Kubilay Berk Alkan for their assistance.\n\n### mDNSResponder\n\nWe would like to acknowledge Cem Onat Karagun, He Wei (ギカク), Jex Amro, 章鱼哥 (@aipy) of aipyaipy.com for their assistance.\n\n### PluginKit\n\nWe would like to acknowledge Asaf Cohen, Ashish Kunwar for their assistance.\n\n### Printing UIKit\n\nWe would like to acknowledge Jacolon Walker ( @call_eax ) for their assistance.\n\n### ReplayKit\n\nWe would like to acknowledge an anonymous researcher for their assistance.\n\n### System Settings\n\nWe would like to acknowledge Masaki Moriguchi for their assistance.\n\n### Time Machine\n\nWe would like to acknowledge Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs for their assistance.\n\n Published Date: September 14, 2026","published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: support.apple.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}