APPLE MACOS · CVE-2026-86902 · Infrastructure
FIX → 27.0 · 14.8.8
Apple's macOS Sonoma 14.8.8 security advisory lists many fixed flaws, including ones that let an app gain root privileges or corrupt kernel memory. The excerpt does not show CVE-2026-86902 itself, so its specific effect is unconfirmed.
first public Sep 14, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Mac users running macOS Sonoma, where the advisory lists local app flaws and some remote ones. The excerpt does not confirm that CVE-2026-86902 is one of the listed entries, so its exact reach is unknown. Machines on other macOS versions are outside this advisory.
Not affected if other-macos-versions
Who cares apple, macos, macos-sonoma, vendor-advisory
14.8.8Upgrade to 27.0 · 14.8.8
14.8.8, the release Apple's advisory describesAbout the security content of macOS Sonoma 14.8.8 - Apple Support
This document describes the security content of macOS Sonoma 14.8.8.
For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.
Apple security documents reference vulnerabilities by CVE-ID when possible.
For more information about security, see the Apple Product Security page.
Released July 27, 2026
Available for: macOS Sonoma
Impact: An app may be able to gain root privileges
Description: A parsing issue in the handling of directory paths was addressed with improved path validation.
CVE-2026-43749: Adam Franke, Trung Nguyen (@everping) of CyStack, Ashish Kunwar
Available for: macOS Sonoma
Impact: A malicious application may be able to bypass Privacy preferences
Description: An authorization issue was addressed with improved state management.
CVE-2026-65404: 이재영, Vinay Kumar Rasala (Xplo8E) from Appknox, Stuart Wallace, Arni Hardarson (Neonix Security)
Entry added September 14, 2026
Available for: macOS Sonoma
Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Description: A buffer overflow was addressed with improved bounds checking.
CVE-2026-64767: Dave G.
Available for: macOS Sonoma
Impact: Connecting to a malicious afpfs server may lead to kernel memory corruption
Description: A buffer overflow was addressed with improved bounds checking.
CVE-2026-43815: Dave G.
Entry added September 14, 2026
Impact: A remote attacker may be able to cause a denial-of-service
Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2026-23918: Bartlomiej Dmitruk of striga.ai, Stanislaw Strzalkowski of isec.pl
Entry updated September 14, 2026
Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64695: Narendra Singh (@_3P1C), Peter Malone
Entry updated September 14, 2026
Impact: An app may be able to access sensitive user data
CVE-2026-43801: Rahul Raj
Description: A race condition was addressed with improved state handling.
CVE-2026-43781: Pinak Oza
Impact: A malicious app may be able to break out of its sandbox
Description: An authorization issue was addressed with improved state management.
CVE-2026-64737: Robert Mindo
Description: A buffer overflow was addressed with improved bounds checking.
CVE-2026-43681: impost0r (ret2plt), David Ige - Beryllium Security
Impact: Mounting a malicious disk image may cause unexpected system termination
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-43761: lokerxx, Narendra Singh (@_3P1C), Lyutoon, Jordy Zomer (@pwningsystems), Richard Zana, George Stergiopoulos, InfoSec lab, Athens University of Economics and Business, Greece, Aswin Kumar Gokulakannan
Entry added September 14, 2026
Impact: A malicious application may be able to bypass Privacy preferences
CVE-2026-43672: 이재영
Impact: An app may be able to read files outside of its sandbox
Description: A permissions issue was addressed by removing the vulnerable code.
CVE-2026-43763: Pavan Nallamothu, Jared Reyes
Impact: An app may be able to break out of its sandbox
CVE-2026-64702: John Lussier
Impact: An app may be able to cause a denial-of-service
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)
Impact: An app may be able to execute arbitrary code with kernel privileges
Description: A buffer overflow was addressed with improved size validation.
CVE-2026-64747: Franco Belman at Blackwing Intelligence
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds read was addressed with improved bounds checking.
CVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun
Impact: An app may be able to delete files for which it does not have permission
CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab
Impact: A maliciously crafted ZIP archive may bypass Gatekeeper checks
CVE-2026-28849: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
Impact: An app may be able to cause unexpected system termination or read kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64698: Richard Zana, Peter Malone, Nathaniel Oh (@calysteon), an anonymous researcher
Impact: Processing a maliciously crafted contact may leak sensitive data
CVE-2026-64734: Daniel Williams
CVE-2026-43756: 이재영
Impact: An app may be able to gain root privileges
Description: A race condition was addressed with improved state handling.
CVE-2026-43693: Gergely Kalman (@gergely_kalman)
CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative
Impact: Processing an audio stream in a maliciously crafted media file may terminate the process
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-43744: ret2happy, Mathis Mansière, an anonymous researcher
Entry updated September 14, 2026
Impact: A remote attacker may be able to cause unexpected system termination
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-43803: Rahul Raj
Impact: Processing a maliciously crafted video file may lead to unexpected app termination
CVE-2026-43711: James Duffy (@0x4A616D657344)
Impact: Processing a maliciously crafted file may lead to unexpected app termination
CVE-2026-28936: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
Impact: Processing a maliciously crafted asset catalog may result in disclosure of process memory
CVE-2026-43738: Peter Malone
Description: A buffer overflow was addressed with improved bounds checking.
CVE-2026-84489: stratan (@5tratan), Peter Malone
Entry added September 14, 2026
Impact: An app may be able to cause unexpected system termination
CVE-2026-43802: an anonymous researcher
Impact: An app may be able to leak sensitive user information
Description: A privacy issue was addressed by removing sensitive data.
CVE-2026-64710: Matthew Schneider
Available for: macOS Sonoma
Impact: A malicious app may be able to gain root privileges
Description: A permissions issue was addressed with additional restrictions.
CVE-2026-39875: XBreach.ai, Dallas Dubs, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs, Aaron Grattafiori - NVIDIA AI Red Team
Available for: macOS Sonoma
Impact: An app may be able to gain root privileges
Description: An injection issue was addressed with improved validation.
CVE-2026-43698: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
Available for: macOS Sonoma
Impact: Authentication credentials may be sent to a server on another origin
Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.
Available for: macOS Sonoma
Impact: Multiple issues in curl
Descriptio
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.