APPLE IPADOS · CVE-2026-65371 · Vendor
FIX → 26.6 · 15.8
Apple's security notes for macOS Sequoia 15.8 list dozens of flaws across system components such as APFS, CoreMedia, Bluetooth, autofs and CUPS. Some entries let a local app break its sandbox, read protected data, or gain root, and some let a remote or nearby attacker crash processes or run code.
first public Sep 14, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Every Mac running macOS Sequoia before 15.8 is covered by this release. The advisory lists local-app and remote-attacker entries across many components, so the exposure depends on which entries apply to the machine; the sources do not say which specific CVE affects a given configuration. Machines already on 15.8 or later are not affected by these entries.
already-on-15.8
About the security content of macOS Sequoia 15.8 - Apple Support
This document describes the security content of macOS Sequoia 15.8.
For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.
Apple security documents reference vulnerabilities by CVE-ID when possible.
For more information about security, see the Apple Product Security page.
Released September 14, 2026
Available for: macOS Sequoia
Impact: Processing a maliciously crafted image may lead to unexpected process termination
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-86882: Peter Malone
Available for: macOS Sequoia
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved data protection.
CVE-2026-43664: Stuart Wallace, Rosyna Keller of Totally Not Malicious Software, Jian Lee (@speedyfriend433), Ilya Andr (andrd3v), Gongyu Ma (@Mezone0), David Strnadel, Daniel Febrero, CJ Vana, Asaf Cohen
Available for: macOS Sequoia
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with additional entitlement checks.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Who cares apple, macos, macos-sequoia, vendor-advisory
sw_vers -productVersionUpgrade to 26.6 · 15.8
15.8 and later, as stated by the Apple advisory (the advisory does not give a per-CVE fix beyond this release)CVE-2026-112446: Sindre Sorhus, LiangWei
Entry added October 26, 2026
Available for: macOS Sequoia
Impact: An app may be able to elevate privileges
Description: The issue was addressed with improved checks.
CVE-2026-28853: f00l (@PPPF00L) and 3ndy1(@_3ndy1)
Entry added October 19, 2026
Available for: macOS Sequoia
Impact: An application may be able to access restricted files
Description: A permissions issue was addressed with improved path validation.
CVE-2026-86910: an anonymous researcher
Available for: macOS Sequoia
Impact: An app may be able to cause unexpected system termination or write kernel memory
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-84523: Cem Onat Karagun, an anonymous researcher
Available for: macOS Sequoia
Impact: An app may be able to cause unexpected system termination
Description: A buffer overflow was addressed with improved size validation.
CVE-2026-65396: Bhaswanth Chigurupati
Entry added October 19, 2026
Impact: An app may be able to access protected user data
Description: A permissions issue was addressed with additional restrictions.
CVE-2026-84587: an anonymous researcher
Available for: macOS Sequoia
Impact: An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account
Description: An authentication issue was addressed with improved state management.
CVE-2026-20683: Lehan Dilusha Jayasingha (Sri Lanka), Jasminder Pal Singh, Dem0ns (@天府简易信工作室), Abdelhak Kherroubi
Impact: An app may be able to cause unexpected system termination
Description: An integer overflow was addressed with improved input validation.
CVE-2026-65408: tamdao
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory management.
CVE-2026-65407: Franco Belman at Blackwing Intelligence
Impact: Mounting a disk image with maliciously crafted files may lead to unexpected system termination
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-84519: Richard Zana
Impact: A malicious app may be able to break out of its sandbox
Description: A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement.
CVE-2026-65381: Mickey Jin (@patch1t)
Impact: An app may be able to read files outside of its sandbox
Description: A permissions issue was addressed by removing the vulnerable code.
CVE-2026-43763: Pavan Nallamothu, Jared Reyes
Impact: An app may be able to access user-sensitive data
Description: A logging issue was addressed with improved data redaction.
CVE-2026-84525: D4rthL
Impact: An app may be able to access sensitive user data
Description: A permissions issue was addressed with improved validation.
CVE-2026-65342: Mohamad Dawoud / Abodi Dawoud, Ahmed Alwardani
Impact: An app may be able to leak sensitive user information
CVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik Tsytsarkin
Impact: A local app may be able to read a persistent account identifier
Description: A permissions issue was addressed with additional restrictions.
CVE-2026-84583: Zhongcheng Li from IES Red Team
Impact: An attacker with control of a network directory server may be able to execute arbitrary code with root privileges
Description: A path traversal issue was addressed with improved path validation.
CVE-2026-84568: Mr.Gedik (@h4ck2s3c) of Turkish Technology
Impact: An app may be able to bypass Gatekeeper checks
CVE-2026-84570: Mr.Gedik (@h4ck2s3c)
Impact: An app may be able to break out of its sandbox
Description: An authorization issue was addressed with improved state management.
CVE-2026-84535: Sindre Sorhus, Oren Yomtov, Morris Richman (@morrisinlife), Kun Peeks (@SwayZGl1tZyyy)
Impact: An app may be able to cause unexpected system termination
Description: A type confusion issue was addressed with improved memory handling.
CVE-2026-84616: Peter Malone
Impact: A sandboxed app may be able to execute arbitrary code with kernel privileges
Description: A race condition was addressed with improved state management.
CVE-2026-84607: Ruslan Dautov
Impact: An app may be able to access sensitive user data
CVE-2026-65406: Ye Zhang (@VAR10CK) of Baidu Security
Impact: A remote attacker may be able to cause unexpected app termination or arbitrary code execution
Description: An out-of-bounds write issue was addressed with improved bounds checking.
Impact: An attacker in physical proximity may be able to corrupt process memory
Description: A memory corruption issue was addressed with improved input validation.
CVE-2026-84547: Marc Newlin of SkySafe
Entry added October 19, 2026
Impact: An attacker in radio range may be able to cause unexpected system termination
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-84613: jioundai
Entry added October 19, 2026
Impact: An app may be able to cause unexpected system termination
Description: The issue was addressed with improved memory handling.
CVE-2026-84567: Sanny Mitra, Sihyun Roh (Compsec, SNU), ngockhanh from Cystack, 정우 하 (@0xfa11babe), Suresh Sundaram, Surej Sekhar, Kun Peeks (@SwayZGl1tZyyy), Hari Shanmugam (The Hxr1), Ataberk Yavuzer
Available for: macOS Sequoia
Impact: An app with admin privileges may be able to modify the System Keychain
Description: An authorization issue was addressed with improved entitlement checks.
CVE-2026-86907: Roman Zabicki
Entry added October 19, 2026
Available for: macOS Sequoia
Impact: An archive may be able to bypass Gatekeeper
Description: A file quarantine bypass was addressed with additional checks.
CVE-2026-65399: Rishabh Jain (rjcyber) of cyberplanet, Pasquale Scola, an anonymous researcher
Available for: macOS Sequoia
Impact: An app may be able to access Bluetooth device information
Description: An authorization issue was addressed with improved state management.
CVE-2026-86891: Dawuge of Shuffle Team
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.