--- id: "CVE-2026-65346" page: "https://infrastack.ai/live/CVE-2026-65346" kind: "vulnerability" aliases: ["CVE-2026-65346"] title: "An integer overflow was addressed with improved input validation" severity: "high" cvss: 8.8 epss: null exploited: false status: "open" category: "vendor" products: [{"name": "apple ipados", "fixed": ["26.6.1"], "affected": "< 26.6.1", "ecosystem": "vendor"}, {"name": "apple iphone os", "fixed": ["26.6.1"], "affected": "< 26.6.1", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["26.6.2"], "affected": ">= 26.0, < 26.6.2", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["apple", "macos", "macos-sequoia", "vendor", "vendor-advisory"] not_affected_if: ["already-on-macos-15.8"] published_at: "2026-08-17T22:17:25+00:00" first_seen_at: "2026-11-10T00:17:00+00:00" updated_at: "2026-11-10T00:28:45+00:00" sources: [{"source": "lab", "url": "https://support.apple.com/en-us/149043", "first_seen_at": "2026-11-10T00:17:00+00:00"}, {"source": "lab", "url": "https://support.apple.com/en-us/149036", "first_seen_at": "2026-11-10T00:17:02+00:00"}, {"source": "lab", "url": "https://support.apple.com/en-us/149037", "first_seen_at": "2026-11-10T00:17:03+00:00"}, {"source": "lab", "url": "https://support.apple.com/en-us/149038", "first_seen_at": "2026-11-10T00:17:04+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65346", "first_seen_at": "2026-11-10T00:28:45+00:00"}] exploit_sources: [] --- # An integer overflow was addressed with improved input validation Link for people: https://infrastack.ai/live/CVE-2026-65346 (this .md is for agents) Apple's macOS Sequoia 15.8 security notes list many fixed flaws across system components, several of which let an app gain root privileges, break out of its sandbox, or run code with kernel privileges. The page covers CVE-2026-65346 only as one of many advisory entries and does not describe a single flaw that this record targets. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:apple ipados affected < 26.6.1 fixed 26.6.1 - vendor:apple iphone os affected < 26.6.1 fixed 26.6.1 - vendor:apple macos affected >= 26.0, < 26.6.2 fixed 26.6.2 ## How to check - Run `sw_vers` and confirm the ProductVersion is `15.8` or later on Macs running macOS Sequoia. - Check System Settings > General > Software Update for pending macOS updates. ## Fix - macOS Sequoia: `15.8`, per the advisory's "Available for: macOS Sequoia" entries. ## Timeline - 2026-11-10T00:17:00+00:00 lab https://support.apple.com/en-us/149043 — Apple: About the security content of macOS Sequoia 15.8 - Apple Support - 2026-11-10T00:17:02+00:00 lab https://support.apple.com/en-us/149036 — Apple: About the security content of tvOS 27 - Apple Support - 2026-11-10T00:17:03+00:00 lab https://support.apple.com/en-us/149037 — Apple: About the security content of watchOS 27 - Apple Support - 2026-11-10T00:17:04+00:00 lab https://support.apple.com/en-us/149038 — Apple: About the security content of visionOS 27 - Apple Support - 2026-11-10T00:28:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-65346 ## Documents - [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/148281 - [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/148282 - [mentions] Apple: About the security content of tvOS 27 - Apple Support https://support.apple.com/en-us/149036 - [mentions] Apple: About the security content of visionOS 27 - Apple Support https://support.apple.com/en-us/149038 - [mentions] Apple: About the security content of macOS Sequoia 15.8 - Apple Support https://support.apple.com/en-us/149043 - [mentions] Apple: About the security content of watchOS 27 - Apple Support https://support.apple.com/en-us/149037 ## From the sources About the security content of macOS Sequoia 15.8 - Apple Support # About the security content of macOS Sequoia 15.8 This document describes the security content of macOS Sequoia 15.8. ## About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page. Apple security documents reference vulnerabilities by CVE-ID when possible. For more information about security, see the Apple Product Security page. ## macOS Sequoia 15.8 Released September 14, 2026 ### Accelerate Framework Available for: macOS Sequoia Impact: Processing a maliciously crafted image may lead to unexpected process termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-86882: Peter Malone ### Accessibility Available for: macOS Sequoia Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved data protection. CVE-2026-43664: Stuart Wallace, Rosyna Keller of Totally Not Malicious Software, Jian Lee (@speedyfriend433), Ilya Andr (andrd3v), Gongyu Ma (@Mezone0), David Strnadel, Daniel Febrero, CJ Vana, Asaf Cohen ### Accounts Available for: macOS Sequoia Impact: An app may be able to access sensitive user data Description: This issue was addressed with additional entitlement checks. CVE-2026-112446: Sindre Sorhus, LiangWei Entry added October 26, 2026 ### AMD Available for: macOS Sequoia Impact: An app may be able to elevate privileges Description: The issue was addressed with improved checks. CVE-2026-28853: f00l (@PPPF00L) and 3ndy1(@_3ndy1) Entry added October 19, 2026 ### APFS Available for: macOS Sequoia Impact: An application may be able to access restricted files Description: A permissions issue was addressed with improved path validation. CVE-2026-86910: an anonymous researcher ### APFS Available for: macOS Sequoia Impact: An app may be able to cause unexpected system termination or write kernel memory Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-84523: Cem Onat Karagun, an anonymous researcher ### APFS Available for: macOS Sequoia Impact: An app may be able to cause unexpected system termination Description: A buffer overflow was addressed with improved size validation. CVE-2026-65396: Bhaswanth Chigurupati Entry added October 19, 2026 ### AppKit Impact: An app may be able to access protected user data Description: A permissions issue was addressed with additional restrictions. CVE-2026-84587: an anonymous researcher ### Apple Account Available for: macOS Sequoia Impact: An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account Description: An authentication issue was addressed with improved state management. CVE-2026-20683: Lehan Dilusha Jayasingha (Sri Lanka), Jasminder Pal Singh, Dem0ns (@天府简易信工作室), Abdelhak Kherroubi ### Apple Neural Engine Impact: An app may be able to cause unexpected system termination Description: An integer overflow was addressed with improved input validation. CVE-2026-65408: tamdao ### AppleAVD Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-65407: Franco Belman at Blackwing Intelligence ### AppleDouble Impact: Mounting a disk image with maliciously crafted files may lead to unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-84519: Richard Zana ### AppleMobileFileIntegrity Impact: A malicious app may be able to break out of its sandbox Description: A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement. CVE-2026-65381: Mickey Jin (@patch1t) ### ATS Impact: An app may be able to read files outside of its sandbox Description: A permissions issue was addressed by removing the vulnerable code. CVE-2026-43763: Pavan Nallamothu, Jared Reyes ### ATS Impact: An app may be able to access user-sensitive data Description: A logging issue was addressed with improved data redaction. CVE-2026-84525: D4rthL ### ATS Impact: An app may be able to access sensitive user data Description: A permissions issue was addressed with improved validation. CVE-2026-65342: Mohamad Dawoud / Abodi Dawoud, Ahmed Alwardani ### Audio Impact: An app may be able to leak sensitive user information CVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik Tsytsarkin ### AuthKit Impact: A local app may be able to read a persistent account identifier Description: A permissions issue was addressed with additional restrictions. CVE-2026-84583: Zhongcheng Li from IES Red Team ### autofs Impact: An attacker with control of a network directory server may be able to execute arbitrary code with root privileges Description: A path traversal issue was addressed with improved path validation. CVE-2026-84568: Mr.Gedik (@h4ck2s3c) of Turkish Technology ### autofs Impact: An app may be able to bypass Gatekeeper checks CVE-2026-84570: Mr.Gedik (@h4ck2s3c) ### Automator Impact: An app may be able to break out of its sandbox Description: An authorization issue was addressed with improved state management. CVE-2026-84535: Sindre Sorhus, Oren Yomtov, Morris Richman (@morrisinlife), Kun Peeks (@SwayZGl1tZyyy) ### AVEVideoEncoder Impact: An app may be able to cause unexpected system termination Description: A type confusion issue was addressed with improved memory handling. CVE-2026-84616: Peter Malone ### AVEVideoEncoder Impact: A sandboxed app may be able to execute arbitrary code with kernel privileges Description: A race condition was addressed with improved state management. CVE-2026-84607: Ruslan Dautov ### BackgroundAssets Impact: An app may be able to access sensitive user data CVE-2026-65406: Ye Zhang (@VAR10CK) of Baidu Security ### Bluetooth Impact: A remote attacker may be able to cause unexpected app termination or arbitrary code execution Description: An out-of-bounds write issue was addressed with improved bounds checking. ### Bluetooth Impact: An attacker in physical proximity may be able to corrupt process memory Description: A memory corruption issue was addressed with improved input validation. CVE-2026-84547: Marc Newlin of SkySafe Entry added October 19, 2026 ### Bluetooth Impact: An attacker in radio range may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-84613: jioundai Entry added October 19, 2026 ### cd9660 Impact: An app may be able to cause unexpected system termination Description: The issue was addressed with improved memory handling. CVE-2026-84567: Sanny Mitra, Sihyun Roh (Compsec, SNU), ngockhanh from Cystack, 정우 하 (@0xfa11babe), Suresh Sundaram, Surej Sekhar, Kun Peeks (@SwayZGl1tZyyy), Hari Shanmugam (The Hxr1), Ataberk Yavuzer ### configd Available for: macOS Sequoia Impact: An app with admin privileges may be able to modify the System Keychain Description: An authorization issue was addressed with improved entitlement checks. CVE-2026-86907: Roman Zabicki Entry added October 19, 2026 ### copyfile Available for: macOS Sequoia Impact: An archive may be able to bypass Gatekeeper Description: A file quarantine bypass was addressed with additional checks. CVE-2026-65399: Rishabh Jain (rjcyber) of cyberplanet, Pasquale Scola, an anonymous researcher ### Core Bluetooth Available for: macOS Sequoia Impact: An app may be able to access Bluetooth device information Description: An authorization issue was addressed with improved state management. CVE-2026-86891: Dawuge of Shuffle Team ## --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_