Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-28969 (GCVE-0-2026-28969)
Vulnerability from cvelistv5 – Published: 2026-05-11 20:07 – Updated: 2026-09-14 20:48
VLAI
EPSS
VEX
Summary
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.7, macOS Sequoia 15.8, macOS Sonoma 14.8.7, macOS Tahoe 26.5, macOS Tahoe 26.7, tvOS 26.5, tvOS 27, visionOS 26.5, visionOS 27, watchOS 26.5, watchOS 27. An app may be able to cause unexpected system termination.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-12 13:23 UTC
CWE
- An app may be able to cause unexpected system termination
- CWE-416 - Use After Free
Assigner
References
15 references
Impacted products
5 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Apple | iOS and iPadOS |
Affected:
0 , < 18.7.9
(custom)
Affected: 0 , < 26.5 (custom) Affected: 0 , < 27 (custom) |
guessed | |
| Apple | macOS |
Affected:
0 , < 14.8.7
(custom)
Affected: 0 , < 15.7.7 (custom) Affected: 0 , < 15.8 (custom) Affected: 0 , < 26.5 (custom) Affected: 0 , < 26.7 (custom) Affected: 0 , < 27 (custom) |
guessed | |
| Apple | tvOS |
Affected:
0 , < 26.5
(custom)
Affected: 0 , < 27 (custom) |
guessed | |
| Apple | visionOS |
Affected:
0 , < 26.5
(custom)
Affected: 0 , < 27 (custom) |
guessed | |
| Apple | watchOS |
Affected:
0 , < 26.5
(custom)
Affected: 0 , < 27 (custom) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-28969",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-12T13:23:17.375854Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-12T13:23:22.141Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "18.7.9",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "26.5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "14.8.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "15.7.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "15.8",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "26.5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "26.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "tvOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "visionOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "watchOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.7, macOS Sequoia 15.8, macOS Sonoma 14.8.7, macOS Tahoe 26.5, macOS Tahoe 26.7, tvOS 26.5, tvOS 27, visionOS 26.5, visionOS 27, watchOS 26.5, watchOS 27. An app may be able to cause unexpected system termination."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to cause unexpected system termination",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:48:32.905Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/127110"
},
{
"url": "https://support.apple.com/en-us/127111"
},
{
"url": "https://support.apple.com/en-us/127115"
},
{
"url": "https://support.apple.com/en-us/127116"
},
{
"url": "https://support.apple.com/en-us/127117"
},
{
"url": "https://support.apple.com/en-us/127118"
},
{
"url": "https://support.apple.com/en-us/127119"
},
{
"url": "https://support.apple.com/en-us/127120"
},
{
"url": "https://support.apple.com/en-us/149034"
},
{
"url": "https://support.apple.com/en-us/149035"
},
{
"url": "https://support.apple.com/en-us/149036"
},
{
"url": "https://support.apple.com/en-us/149037"
},
{
"url": "https://support.apple.com/en-us/149038"
},
{
"url": "https://support.apple.com/en-us/149042"
},
{
"url": "https://support.apple.com/en-us/149043"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-28969",
"datePublished": "2026-05-11T20:07:55.362Z",
"dateReserved": "2026-03-03T16:36:03.992Z",
"dateUpdated": "2026-09-14T20:48:32.905Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-28969",
"date": "2026-10-04",
"epss": "0.0064",
"percentile": "0.48831"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "18.7.9",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "26.5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "14.8.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "15.7.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "15.8",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "26.5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "26.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "tvOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "visionOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "watchOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"source": "product-security@apple.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F3968B76-E6DE-416D-A0FB-E4833FFAAE0F",
"versionEndExcluding": "18.7.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
"matchCriteriaId": "20644D7E-2AB6-48CA-AED4-C474A9867986",
"versionEndExcluding": "26.5",
"versionStartIncluding": "26.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B6431EAF-B395-4C19-9AB6-A2F45991C897",
"versionEndExcluding": "18.7.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1BE54A3B-D667-43BA-AB71-BCF8438054E0",
"versionEndExcluding": "26.5",
"versionStartIncluding": "26.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DD9E7FAE-30DA-4B2B-A63A-6DFEA7A29933",
"versionEndExcluding": "14.8.7",
"versionStartIncluding": "14.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2984C440-3DC2-413A-B5FA-1FAB21078DB8",
"versionEndExcluding": "15.7.7",
"versionStartIncluding": "15.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6CB91417-90A8-4A9B-A1D0-1D94B80EF837",
"versionEndExcluding": "26.5",
"versionStartIncluding": "26.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "176C47FD-FA25-437B-9061-A81CAA367AEF",
"versionEndExcluding": "26.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C8F45D80-0DF8-444E-9AF1-703A1075F046",
"versionEndExcluding": "26.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "057B244F-5485-4108-8E23-FE15F5256EE7",
"versionEndExcluding": "26.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.7, macOS Sequoia 15.8, macOS Sonoma 14.8.7, macOS Tahoe 26.5, macOS Tahoe 26.7, tvOS 26.5, tvOS 27, visionOS 26.5, visionOS 27, watchOS 26.5, watchOS 27. An app may be able to cause unexpected system termination."
}
],
"id": "CVE-2026-28969",
"lastModified": "2026-09-14T21:17:06.153",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-28969",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-12T13:23:17.375854Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-05-11T21:18:57.700",
"references": [
{
"source": "product-security@apple.com",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://support.apple.com/en-us/127110"
},
{
"source": "product-security@apple.com",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://support.apple.com/en-us/127111"
},
{
"source": "product-security@apple.com",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://support.apple.com/en-us/127115"
},
{
"source": "product-security@apple.com",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://support.apple.com/en-us/127116"
},
{
"source": "product-security@apple.com",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://support.apple.com/en-us/127117"
},
{
"source": "product-security@apple.com",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://support.apple.com/en-us/127118"
},
{
"source": "product-security@apple.com",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://support.apple.com/en-us/127119"
},
{
"source": "product-security@apple.com",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://support.apple.com/en-us/127120"
},
{
"source": "product-security@apple.com",
"url": "https://support.apple.com/en-us/149034"
},
{
"source": "product-security@apple.com",
"url": "https://support.apple.com/en-us/149035"
},
{
"source": "product-security@apple.com",
"url": "https://support.apple.com/en-us/149036"
},
{
"source": "product-security@apple.com",
"url": "https://support.apple.com/en-us/149037"
},
{
"source": "product-security@apple.com",
"url": "https://support.apple.com/en-us/149038"
},
{
"source": "product-security@apple.com",
"url": "https://support.apple.com/en-us/149042"
},
{
"source": "product-security@apple.com",
"url": "https://support.apple.com/en-us/149043"
}
],
"sourceIdentifier": "product-security@apple.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-416"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
},
"redhat_vex": {
"current_release_date": "2026-06-05T19:46:07+00:00",
"cve": "CVE-2026-28969",
"id": "CVE-2026-28969",
"initial_release_date": "2026-01-01T00:00:00+00:00",
"product_status:known_not_affected": "1",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "CVE-2026-28969",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28969.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-28969",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-12T13:23:17.375854Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-12T13:23:13.314Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "18.7.9",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "26.5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "14.8.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "15.7.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "15.8",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "26.5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "26.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "tvOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "visionOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "watchOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.7, macOS Sequoia 15.8, macOS Sonoma 14.8.7, macOS Tahoe 26.5, macOS Tahoe 26.7, tvOS 26.5, tvOS 27, visionOS 26.5, visionOS 27, watchOS 26.5, watchOS 27. An app may be able to cause unexpected system termination."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to cause unexpected system termination",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:48:32.905Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/127110"
},
{
"url": "https://support.apple.com/en-us/127111"
},
{
"url": "https://support.apple.com/en-us/127115"
},
{
"url": "https://support.apple.com/en-us/127116"
},
{
"url": "https://support.apple.com/en-us/127117"
},
{
"url": "https://support.apple.com/en-us/127118"
},
{
"url": "https://support.apple.com/en-us/127119"
},
{
"url": "https://support.apple.com/en-us/127120"
},
{
"url": "https://support.apple.com/en-us/149034"
},
{
"url": "https://support.apple.com/en-us/149035"
},
{
"url": "https://support.apple.com/en-us/149036"
},
{
"url": "https://support.apple.com/en-us/149037"
},
{
"url": "https://support.apple.com/en-us/149038"
},
{
"url": "https://support.apple.com/en-us/149042"
},
{
"url": "https://support.apple.com/en-us/149043"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-28969",
"datePublished": "2026-05-11T20:07:55.362Z",
"dateReserved": "2026-03-03T16:36:03.992Z",
"dateUpdated": "2026-09-14T20:48:32.905Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
GCVE-1988-2026-0338
Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 11:28
VLAI
EPSS
VEX
Title
APPLE-SA-05-11-2026-11 visionOS 26.5
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-05-11-2026-11 visionOS 26.5
visionOS 26.5 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/127120.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accelerate
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause a denial-of-service
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-28991: Seiji Sakurai (@HeapSmasher)
Accounts
Available for: Apple Vision Pro (all models)
Impact: An app may be able to bypass certain Privacy preferences
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-28988: Asaf Cohen
APFS
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause unexpected system termination
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-28959: Dave G.
App Intents
Available for: Apple Vision Pro (all models)
Impact: A malicious app may be able to break out of its sandbox
Description: A logic issue was addressed with improved restrictions.
CVE-2026-28995: Vamshi Paili, Tony Gorez (@tonygo_) for Reverse Society
AppleJPEG
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted image may lead to a
denial-of-service
Description: This is a vulnerability in open source code and Apple
Software is among the affected projects. The CVE-ID was assigned by a
third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2026-1837
AppleJPEG
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted media file may lead to
unexpected app termination or corrupt process memory
Description: A memory corruption issue was addressed with improved input
validation.
CVE-2026-28956: impost0r (ret2plt)
Audio
Available for: Apple Vision Pro (all models)
Impact: Processing an audio stream in a maliciously crafted media file
may terminate the process
Description: The issue was addressed with improved memory handling.
CVE-2026-39869: David Ige of Beryllium Security
CoreAnimation
Available for: Apple Vision Pro (all models)
Impact: An app may be able to access sensitive user data
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2026-28964: Alan Wang, Christopher W. Fletcher, Hovav Shacham, David
Kohlbrenner, Riccardo Paccagnella
CoreServices
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: The issue was addressed with improved checks.
CVE-2026-28936: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
CoreSymbolication
Available for: Apple Vision Pro (all models)
Impact: Parsing a maliciously crafted file may lead to an unexpected app
termination
Description: An out-of-bounds access issue was addressed with improved
bounds checking.
CVE-2026-28918: Niels Hofmans, Anonymous working with TrendAI Zero Day
Initiative
FileProvider
Available for: Apple Vision Pro (all models)
Impact: An app may be able to access sensitive user data
Description: A race condition was addressed with additional validation.
CVE-2026-43659: Alex Radocea
ImageIO
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: The issue was addressed with improved bounds checks.
CVE-2026-28977: Suresh Sundaram
ImageIO
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted image may corrupt process
memory
Description: The issue was addressed with improved memory handling.
CVE-2026-28990: Jiri Ha, Arni Hardarson
IOHIDFamily
Available for: Apple Vision Pro (all models)
Impact: An attacker may be able to cause unexpected app termination
Description: A memory corruption vulnerability was addressed with
improved locking.
CVE-2026-28992: Johnny Franks (@zeroxjf)
IOKit
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-28969: Mihalis Haatainen, Ari Hawking, Ashish Kunwar
Kernel
Available for: Apple Vision Pro (all models)
Impact: An app may be able to disclose kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43654: Vaagn Vardanian, Nathaniel Oh (@calysteon)
Kernel
Available for: Apple Vision Pro (all models)
Impact: A local user may be able to cause unexpected system termination
or read kernel memory
Description: A buffer overflow was addressed with improved input
validation.
CVE-2026-28897: popku1337, Billy Jheng Bing Jhong and Pan Zhenpeng
(@Peterpan0927) of STAR Labs SG Pte. Ltd., Robert Tran, Aswin kumar
Gokulakannan
Kernel
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause unexpected system termination or
write kernel memory
Description: An out-of-bounds write issue was addressed with improved
input validation.
CVE-2026-28972: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)
of STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)
LaunchServices
Available for: Apple Vision Pro (all models)
Impact: A remote attacker may be able to cause a denial of service
Description: A type confusion issue was addressed with improved checks.
CVE-2026-28983: Ruslan Dautov
mDNSResponder
Available for: Apple Vision Pro (all models)
Impact: A remote attacker may be able to cause unexpected system
termination or corrupt kernel memory
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-43668: Anton Pakhunov, Ricardo Prado
mDNSResponder
Available for: Apple Vision Pro (all models)
Impact: An attacker on the local network may be able to cause a
denial-of-service
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43666: Ian van der Wurff (ian.nl)
Model I/O
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted image may corrupt process
memory
Description: The issue was addressed with improved memory handling.
CVE-2026-28940: Michael DePlante (@izobashi) of TrendAI Zero Day
Initiative
Networking
Available for: Apple Vision Pro (all models)
Impact: An attacker may be able to track users through their IP address
Description: This issue was addressed through improved state management.
CVE-2026-28906: Ilya Sc. Jowell A.
SceneKit
Available for: Apple Vision Pro (all models)
Impact: A remote attacker may be able to cause unexpected app
termination
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-28846: Peter Malone
Shortcuts
Available for: Apple Vision Pro (all models)
Impact: An app may be able to access user-sensitive data
Description: This issue was addressed by adding an additional prompt for
user consent.
CVE-2026-28993: Doron Assness
Spotlight
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause a denial-of-service
Description: This issue was addressed with improved checks to prevent
unauthorized actions.
CVE-2026-28974: Andy Koo (@andykoo) of Hexens
Status Bar
Available for: Apple Vision Pro (all models)
Impact: An app may be able to capture a user's screen
Description: An issue with app access to camera metadata was addressed
with improved logic.
CVE-2026-28957: Adriatik Raci
Storage
Available for: Apple Vision Pro (all models)
Impact: An app may be able to access sensitive user data
Description: A race condition was addressed with additional validation.
CVE-2026-28996: Alex Radocea
WebKit
Available for: Apple Vision Pro (all models)
Impact: Processing maliciously crafted web content may prevent Content
Security Policy from being enforced
Description: A validation issue was addressed with improved logic.
WebKit Bugzilla: 308906
CVE-2026-43660: Cantina
WebKit
Available for: Apple Vision Pro (all models)
Impact: Processing maliciously crafted web content may prevent Content
Security Policy from being enforced
Description: The issue was addressed with improved input validation.
WebKit Bugzilla: 308675
CVE-2026-28907: Cantina
WebKit
Available for: Apple Vision Pro (all models)
Impact: Processing maliciously crafted web content may disclose
sensitive user information
Description: This issue was addressed with improved access restrictions.
WebKit Bugzilla: 309698
CVE-2026-28962: Luke Francis, Vaagn Vardanian, kwak kiyong / kakaogames,
Vitaly Simonovich, Adel Bouachraoui, greenbynox
WebKit
Available for: Apple Vision Pro (all models)
Impact: Processing maliciously crafted web content may lead to an
unexpected Safari crash
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 307669
CVE-2026-43658: Do Young Park
WebKit
Available for: Apple Vision Pro (all models)
Impact: Processing maliciously crafted web content may lead to an
unexpected process crash
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 308545
CVE-2026-28905: Yuhao Hu, Yuanming Lai, Chenggang Wu, and Zhe Wang
WebKit Bugzilla: 308707
CVE-2026-28847: DARKNAVY (@DarkNavyOrg), Anonymous working with TrendAI
Zero Day Initiative, Daniel Rhea
WebKit Bugzilla: 309601
CVE-2026-28904: Luka Rački
WebKit Bugzilla: 310880
CVE-2026-28955: wac and Kookhwan Lee working with TrendAI Zero Day
Initiative
WebKit Bugzilla: 310303
CVE-2026-28903: Mateusz Krzywicki (iVerify.io)
WebKit Bugzilla: 309628
CVE-2026-28953: Maher Azzouzi
WebKit Bugzilla: 309861
CVE-2026-28902: Tristan Madani (@TristanInSec) from Talence Security,
Nathaniel Oh (@calysteon)
WebKit Bugzilla: 310207
CVE-2026-28901: Aisle offensive security research team (Joshua Rogers,
Luigino Camastra, Igor Morgenstern, and Guido Vranken), Maher Azzouzi,
Ngan Nguyen of Calif.io
WebKit
Available for: Apple Vision Pro (all models)
Impact: Processing maliciously crafted web content may lead to an
unexpected process crash
Description: A use-after-free issue was addressed with improved memory
management.
WebKit Bugzilla: 313939
CVE-2026-28883: kwak kiyong / kakaogames
WebKit
Available for: Apple Vision Pro (all models)
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved data protection.
WebKit Bugzilla: 311228
CVE-2026-28958: Cantina
WebKit
Available for: Apple Vision Pro (all models)
Impact: A malicious iframe may use another website’s download settings
Description: The issue was addressed with improved UI handling.
WebKit Bugzilla: 311288
CVE-2026-28971: Khiem Tran
WebKit
Available for: Apple Vision Pro (all models)
Impact: Processing maliciously crafted web content may lead to an
unexpected Safari crash
Description: A use-after-free issue was addressed with improved memory
management.
WebKit Bugzilla: 312180
CVE-2026-28942: Milad Nasr and Nicholas Carlini with Claude, Anthropic
WebKit Bugzilla: 310234
CVE-2026-28947: dr3dd
WebKit
Available for: Apple Vision Pro (all models)
Impact: Processing maliciously crafted web content may lead to an
unexpected process crash
Description: The issue was addressed with improved input validation.
WebKit Bugzilla: 310527
CVE-2026-28917: Vitaly Simonovich
WebRTC
Available for: Apple Vision Pro (all models)
Impact: Processing maliciously crafted web content may lead to an
unexpected process crash
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 311131
CVE-2026-28944: Kenneth Hsu of Palo Alto Networks, Jérôme DJOUDER, dr3dd
zlib
Available for: Apple Vision Pro (all models)
Impact: Visiting a maliciously crafted website may leak sensitive data
Description: An information leakage was addressed with additional
validation.
CVE-2026-28920: Brendon Tiszka of Google Project Zero
Additional recognition
App Intents
We would like to acknowledge Mi
Severity
No CVSS data available.
Assigner
References
8 references
Relationships
reference
GCVE-1988-2026-0338 (this record)
- related CVE-2026-1837
- related CVE-2026-28846
- related CVE-2026-28847
- related CVE-2026-28883
- related CVE-2026-28897
- related CVE-2026-28901
- related CVE-2026-28902
- related CVE-2026-28903
- related CVE-2026-28904
- related CVE-2026-28905
- related CVE-2026-28906
- related CVE-2026-28907
- related CVE-2026-28917
- related CVE-2026-28918
- related CVE-2026-28920
- related CVE-2026-28936
- related CVE-2026-28940
- related CVE-2026-28942
- related CVE-2026-28944
- related CVE-2026-28947
- related CVE-2026-28953
- related CVE-2026-28955
- related CVE-2026-28956
- related CVE-2026-28957
- related CVE-2026-28958
- related CVE-2026-28959
- related CVE-2026-28962
- related CVE-2026-28964
- related CVE-2026-28969
- related CVE-2026-28971
- related CVE-2026-28972
- related CVE-2026-28974
- related CVE-2026-28977
- related CVE-2026-28983
- related CVE-2026-28988
- related CVE-2026-28990
- related CVE-2026-28991
- related CVE-2026-28992
- related CVE-2026-28993
- related CVE-2026-28995
- related CVE-2026-28996
- related CVE-2026-39869
- related CVE-2026-43654
- related CVE-2026-43658
- related CVE-2026-43659
- related CVE-2026-43660
- related CVE-2026-43666
- related CVE-2026-43668
{
"containers": {
"cna": {
"affected": [
{
"product": "Visionos",
"vendor": "Apple",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-05-11-2026-11 visionOS 26.5\n\nvisionOS 26.5 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/127120.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccelerate\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-28991: Seiji Sakurai (@HeapSmasher)\n\nAccounts\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to bypass certain Privacy preferences\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28988: Asaf Cohen\n\nAPFS\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28959: Dave G.\n\nApp Intents\nAvailable for: Apple Vision Pro (all models)\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A logic issue was addressed with improved restrictions.\nCVE-2026-28995: Vamshi Paili, Tony Gorez (@tonygo_) for Reverse Society\n\nAppleJPEG\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may lead to a\ndenial-of-service\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-1837\n\nAppleJPEG\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted media file may lead to\nunexpected app termination or corrupt process memory\nDescription: A memory corruption issue was addressed with improved input\nvalidation.\nCVE-2026-28956: impost0r (ret2plt)\n\nAudio\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-39869: David Ige of Beryllium Security\n\nCoreAnimation\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: An inconsistent user interface issue was addressed with\nimproved state management.\nCVE-2026-28964: Alan Wang, Christopher W. Fletcher, Hovav Shacham, David\nKohlbrenner, Riccardo Paccagnella\n\nCoreServices\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved checks.\nCVE-2026-28936: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nCoreSymbolication\nAvailable for: Apple Vision Pro (all models)\nImpact: Parsing a maliciously crafted file may lead to an unexpected app\ntermination\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-28918: Niels Hofmans, Anonymous working with TrendAI Zero Day\nInitiative\n\nFileProvider\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with additional validation.\nCVE-2026-43659: Alex Radocea\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-28977: Suresh Sundaram\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-28990: Jiri Ha, Arni Hardarson\n\nIOHIDFamily\nAvailable for: Apple Vision Pro (all models)\nImpact: An attacker may be able to cause unexpected app termination\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nCVE-2026-28992: Johnny Franks (@zeroxjf)\n\nIOKit\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28969: Mihalis Haatainen, Ari Hawking, Ashish Kunwar\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43654: Vaagn Vardanian, Nathaniel Oh (@calysteon)\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: A local user may be able to cause unexpected system termination\nor read kernel memory\nDescription: A buffer overflow was addressed with improved input\nvalidation.\nCVE-2026-28897: popku1337, Billy Jheng Bing Jhong and Pan Zhenpeng\n(@Peterpan0927) of STAR Labs SG Pte. Ltd., Robert Tran, Aswin kumar\nGokulakannan\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\ninput validation.\nCVE-2026-28972: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)\n\nLaunchServices\nAvailable for: Apple Vision Pro (all models)\nImpact: A remote attacker may be able to cause a denial of service\nDescription: A type confusion issue was addressed with improved checks.\nCVE-2026-28983: Ruslan Dautov\n\nmDNSResponder\nAvailable for: Apple Vision Pro (all models)\nImpact: A remote attacker may be able to cause unexpected system\ntermination or corrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43668: Anton Pakhunov, Ricardo Prado\n\nmDNSResponder\nAvailable for: Apple Vision Pro (all models)\nImpact: An attacker on the local network may be able to cause a\ndenial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43666: Ian van der Wurff (ian.nl)\n\nModel I/O\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-28940: Michael DePlante (@izobashi) of TrendAI Zero Day\nInitiative\n\nNetworking\nAvailable for: Apple Vision Pro (all models)\nImpact: An attacker may be able to track users through their IP address\nDescription: This issue was addressed through improved state management.\nCVE-2026-28906: Ilya Sc. Jowell A.\n\nSceneKit\nAvailable for: Apple Vision Pro (all models)\nImpact: A remote attacker may be able to cause unexpected app\ntermination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28846: Peter Malone\n\nShortcuts\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access user-sensitive data\nDescription: This issue was addressed by adding an additional prompt for\nuser consent.\nCVE-2026-28993: Doron Assness\n\nSpotlight\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause a denial-of-service\nDescription: This issue was addressed with improved checks to prevent\nunauthorized actions.\nCVE-2026-28974: Andy Koo (@andykoo) of Hexens\n\nStatus Bar\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to capture a user\u0027s screen\nDescription: An issue with app access to camera metadata was addressed\nwith improved logic.\nCVE-2026-28957: Adriatik Raci\n\nStorage\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with additional validation.\nCVE-2026-28996: Alex Radocea\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may prevent Content\nSecurity Policy from being enforced\nDescription: A validation issue was addressed with improved logic.\nWebKit Bugzilla: 308906\nCVE-2026-43660: Cantina\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may prevent Content\nSecurity Policy from being enforced\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 308675\nCVE-2026-28907: Cantina\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may disclose\nsensitive user information\nDescription: This issue was addressed with improved access restrictions.\nWebKit Bugzilla: 309698\nCVE-2026-28962: Luke Francis, Vaagn Vardanian, kwak kiyong / kakaogames,\nVitaly Simonovich, Adel Bouachraoui, greenbynox\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 307669\nCVE-2026-43658: Do Young Park\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 308545\nCVE-2026-28905: Yuhao Hu, Yuanming Lai, Chenggang Wu, and Zhe Wang\nWebKit Bugzilla: 308707\nCVE-2026-28847: DARKNAVY (@DarkNavyOrg), Anonymous working with TrendAI\nZero Day Initiative, Daniel Rhea\nWebKit Bugzilla: 309601\nCVE-2026-28904: Luka Ra\u010dki\nWebKit Bugzilla: 310880\nCVE-2026-28955: wac and Kookhwan Lee working with TrendAI Zero Day\nInitiative\nWebKit Bugzilla: 310303\nCVE-2026-28903: Mateusz Krzywicki (iVerify.io)\nWebKit Bugzilla: 309628\nCVE-2026-28953: Maher Azzouzi\nWebKit Bugzilla: 309861\nCVE-2026-28902: Tristan Madani (@TristanInSec) from Talence Security,\nNathaniel Oh (@calysteon)\nWebKit Bugzilla: 310207\nCVE-2026-28901: Aisle offensive security research team (Joshua Rogers,\nLuigino Camastra, Igor Morgenstern, and Guido Vranken), Maher Azzouzi,\nNgan Nguyen of Calif.io\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313939\nCVE-2026-28883: kwak kiyong / kakaogames\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nWebKit Bugzilla: 311228\nCVE-2026-28958: Cantina\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: A malicious iframe may use another website\u2019s download settings\nDescription: The issue was addressed with improved UI handling.\nWebKit Bugzilla: 311288\nCVE-2026-28971: Khiem Tran\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 312180\nCVE-2026-28942: Milad Nasr and Nicholas Carlini with Claude, Anthropic\nWebKit Bugzilla: 310234\nCVE-2026-28947: dr3dd\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 310527\nCVE-2026-28917: Vitaly Simonovich\n\nWebRTC\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 311131\nCVE-2026-28944: Kenneth Hsu of Palo Alto Networks, J\u00e9r\u00f4me DJOUDER, dr3dd\n\nzlib\nAvailable for: Apple Vision Pro (all models)\nImpact: Visiting a maliciously crafted website may leak sensitive data\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-28920: Brendon Tiszka of Google Project Zero\n\nAdditional recognition\n\nApp Intents\nWe would like to acknowledge Mi"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:28:31Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/15"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/May/15"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/en-us/127120"
},
{
"url": "https://support.apple.com/kb/HT214009"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/May/15"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-05-11-2026-11 visionOS 26.5",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-1837",
"type": "related"
},
{
"destId": "CVE-2026-28846",
"type": "related"
},
{
"destId": "CVE-2026-28847",
"type": "related"
},
{
"destId": "CVE-2026-28883",
"type": "related"
},
{
"destId": "CVE-2026-28897",
"type": "related"
},
{
"destId": "CVE-2026-28901",
"type": "related"
},
{
"destId": "CVE-2026-28902",
"type": "related"
},
{
"destId": "CVE-2026-28903",
"type": "related"
},
{
"destId": "CVE-2026-28904",
"type": "related"
},
{
"destId": "CVE-2026-28905",
"type": "related"
},
{
"destId": "CVE-2026-28906",
"type": "related"
},
{
"destId": "CVE-2026-28907",
"type": "related"
},
{
"destId": "CVE-2026-28917",
"type": "related"
},
{
"destId": "CVE-2026-28918",
"type": "related"
},
{
"destId": "CVE-2026-28920",
"type": "related"
},
{
"destId": "CVE-2026-28936",
"type": "related"
},
{
"destId": "CVE-2026-28940",
"type": "related"
},
{
"destId": "CVE-2026-28942",
"type": "related"
},
{
"destId": "CVE-2026-28944",
"type": "related"
},
{
"destId": "CVE-2026-28947",
"type": "related"
},
{
"destId": "CVE-2026-28953",
"type": "related"
},
{
"destId": "CVE-2026-28955",
"type": "related"
},
{
"destId": "CVE-2026-28956",
"type": "related"
},
{
"destId": "CVE-2026-28957",
"type": "related"
},
{
"destId": "CVE-2026-28958",
"type": "related"
},
{
"destId": "CVE-2026-28959",
"type": "related"
},
{
"destId": "CVE-2026-28962",
"type": "related"
},
{
"destId": "CVE-2026-28964",
"type": "related"
},
{
"destId": "CVE-2026-28969",
"type": "related"
},
{
"destId": "CVE-2026-28971",
"type": "related"
},
{
"destId": "CVE-2026-28972",
"type": "related"
},
{
"destId": "CVE-2026-28974",
"type": "related"
},
{
"destId": "CVE-2026-28977",
"type": "related"
},
{
"destId": "CVE-2026-28983",
"type": "related"
},
{
"destId": "CVE-2026-28988",
"type": "related"
},
{
"destId": "CVE-2026-28990",
"type": "related"
},
{
"destId": "CVE-2026-28991",
"type": "related"
},
{
"destId": "CVE-2026-28992",
"type": "related"
},
{
"destId": "CVE-2026-28993",
"type": "related"
},
{
"destId": "CVE-2026-28995",
"type": "related"
},
{
"destId": "CVE-2026-28996",
"type": "related"
},
{
"destId": "CVE-2026-39869",
"type": "related"
},
{
"destId": "CVE-2026-43654",
"type": "related"
},
{
"destId": "CVE-2026-43658",
"type": "related"
},
{
"destId": "CVE-2026-43659",
"type": "related"
},
{
"destId": "CVE-2026-43660",
"type": "related"
},
{
"destId": "CVE-2026-43666",
"type": "related"
},
{
"destId": "CVE-2026-43668",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0338",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/15",
"automated": true,
"contentSha256": "d41d3eeafa51fab79df0402daf905e08347a3f2461a9cade5a868886101bbfb8",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/May/15",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-05-11T22:35:21Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0338"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-11T07:55:56Z",
"dateUpdated": "2026-09-11T11:28:31Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0338"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0391
Vulnerability from gna-1988 – Published: 2026-10-02 04:57 – Updated: 2026-10-02 04:57
VLAI
EPSS
VEX
Title
APPLE-SA-09-14-2026-1 iOS 27 and iPadOS 27
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-09-14-2026-1 iOS 27 and iPadOS 27
iOS 27 and iPadOS 27 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149034.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accelerate Framework
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: Processing a maliciously crafted image may lead to unexpected
process termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-86882: Peter Malone
Accessibility
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved data protection.
CVE-2026-43664: Stuart Wallace, Ilya Andr (andrd3v), Rosyna Keller of
Totally Not Malicious Software, CJ Vana, David Strnadel, Daniel Febrero,
Asaf Cohen, Gongyu Ma (@Mezone0), Jian Lee (@speedyfriend433)
Accessibility
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: An app may be able to identify what other apps a user has
installed
Description: A privacy issue was addressed with improved handling of
user preferences.
CVE-2026-64761: Stuart Wallace, Sindre Sorhus
Accounts
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: A malicious application may be able to bypass Privacy
preferences
Description: An authorization issue was addressed with improved state
management.
CVE-2026-65404: Arni Hardarson (Neonix Security), Vinay Kumar Rasala
(Xplo8E) from Appknox, Stuart Wallace, 이재영
APFS
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: An app may be able to cause unexpected system termination or
write kernel memory
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84523: Cem Onat Karagun, an anonymous researcher
App Store
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: A local app may be able to read a persistent account identifier
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-86888: Zhongcheng Li (CK01)
Apple Account
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: An app may be able to use the Sign In With Apple authentication
flow to access the user's Apple Account
Description: An authentication issue was addressed with improved state
management.
CVE-2026-20683: Dem0ns (@天府简易信工作室), Abdelhak Kherroubi, Jasminder Pal
Singh, Lehan Dilusha Jayasingha (Sri Lanka)
Apple Neural Engine
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: An app may be able to cause unexpected system termination
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-65408: tamdao
AppleAVD
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-65407: Franco Belman at Blackwing Intelligence
AppleDouble
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: Mounting a disk image with maliciously crafted files may lead to
unexpected system termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84519: Richard Zana
AppleKeyStore
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-84593: Meta Red Team X - Nik Tsytsarkin, Alexandre Borges
Authentication Services
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: An app may be able to delete credentials stored in Keychain
Description: This issue was addressed by removing the vulnerable code.
CVE-2026-86905: Ilya Andr (andrd3v)
AuthKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: A local app may be able to read a persistent account identifier
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-84583: Zhongcheng Li from IES Red Team
AVEVideoEncoder
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: An app may be able to cause unexpected system termination
Description: The issue was addressed with improved checks.
CVE-2026-65410: Calif.io <http://calif.io/> in collaboration with Claude and Anthropic
Research
AVEVideoEncoder
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: An app may be able to cause unexpected system termination
Description: A type confusion issue was addressed with improved memory
handling.
CVE-2026-84616: Peter Malone
AVEVideoEncoder
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: A sandboxed app may be able to execute arbitrary code with
kernel privileges
Description: A race condition was addressed with improved state
management.
CVE-2026-84607: Ruslan Dautov
BackgroundAssets
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: An app may be able to access sensitive user data
Description: A logic issue was addressed with improved validation.
CVE-2026-65406: Ye Zhang (@VAR10CK) of Baidu Security
Baseband
Available for: iPhone 11 and later
Impact: An attacker in radio range may be able to cause unexpected
system termination
Description: An input validation issue was addressed with improved input
validation.
CVE-2026-86885: Tuan D. Hoang, Hazem Issa, and Yongdae Kim @ KAIST
SysSec Lab
Baseband
Available for: iPhone 11 and later
Impact: A remote attacker may be able to cause a denial-of-service
Description: A denial-of-service issue was addressed with improved input
validation.
CVE-2026-86879: Hazem Issa and Yongdae Kim @ SysSec, KAIST
Bluetooth
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: A remote attacker may be able to cause unexpected app
termination or arbitrary code execution
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-65414
Bluetooth
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: An app may gain unauthorized access to Bluetooth
Description: An authorization issue was addressed with improved state
management.
CVE-2026-84560: an anonymous researcher
Camera
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: An app may be able to access sensitive user data
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-86878: Sindre Sorhus, Ilya Andr (andrd3v) of Positive
Technologies, Asaf Cohen
CloudKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: A local app may be able to read a persistent account identifier
Description: An information disclosure issue was addressed with improved
state management.
CVE-2026-86895: Stanislav Jelezoglo
CloudKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: An app may be able to read device name
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-86893: Heiner Gerdes
copyfile
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: An archive may be able to bypass Gatekeeper
Description: A file quarantine bypass was addressed with additional
checks.
CVE-2026-65399: Rishabh Jain (rjcyber) of cyberplanet, Pasquale Scola,
an anonymous researcher
CoreMedia
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: Processing a maliciously crafted image may lead to arbitrary
code execution
Description: A memory corruption issue was addressed by removing the
vulnerable code.
CVE-2026-64752: Nik Tsytsarkin
CoreMedia
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9
Severity
No CVSS data available.
Assigner
References
22 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| unknown | iOS 27 and |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0391 (this record)
- related CVE-2026-20683
- related CVE-2026-28966
- related CVE-2026-28968
- related CVE-2026-28969
- related CVE-2026-43664
- related CVE-2026-43674
- related CVE-2026-43686
- related CVE-2026-43687
- related CVE-2026-43688
- related CVE-2026-43689
- related CVE-2026-43695
- related CVE-2026-43737
- related CVE-2026-43738
- related CVE-2026-43785
- related CVE-2026-64718
- related CVE-2026-64752
- related CVE-2026-64753
- related CVE-2026-64756
- related CVE-2026-64760
- related CVE-2026-64761
- related CVE-2026-65329
- related CVE-2026-65344
- related CVE-2026-65345
- related CVE-2026-65348
- related CVE-2026-65354
- related CVE-2026-65358
- related CVE-2026-65359
- related CVE-2026-65360
- related CVE-2026-65377
- related CVE-2026-65395
- related CVE-2026-65398
- related CVE-2026-65399
- related CVE-2026-65402
- related CVE-2026-65403
- related CVE-2026-65404
- related CVE-2026-65405
- related CVE-2026-65406
- related CVE-2026-65407
- related CVE-2026-65408
- related CVE-2026-65409
- related CVE-2026-65410
- related CVE-2026-65411
- related CVE-2026-65412
- related CVE-2026-65414
- related CVE-2026-65415
- related CVE-2026-84487
- related CVE-2026-84489
- related CVE-2026-84491
- related CVE-2026-84492
- related CVE-2026-84497
- related CVE-2026-84507
- related CVE-2026-84510
- related CVE-2026-84511
- related CVE-2026-84513
- related CVE-2026-84518
- related CVE-2026-84519
- related CVE-2026-84521
- related CVE-2026-84523
- related CVE-2026-84524
- related CVE-2026-84526
- related CVE-2026-84527
- related CVE-2026-84530
- related CVE-2026-84531
- related CVE-2026-84532
- related CVE-2026-84533
- related CVE-2026-84534
- related CVE-2026-84546
- related CVE-2026-84551
- related CVE-2026-84552
- related CVE-2026-84560
- related CVE-2026-84561
- related CVE-2026-84564
- related CVE-2026-84566
- related CVE-2026-84571
- related CVE-2026-84575
- related CVE-2026-84583
- related CVE-2026-84593
- related CVE-2026-84596
- related CVE-2026-84597
- related CVE-2026-84598
- related CVE-2026-84600
- related CVE-2026-84602
- related CVE-2026-84603
- related CVE-2026-84606
- related CVE-2026-84607
- related CVE-2026-84609
- related CVE-2026-84611
- related CVE-2026-84612
- related CVE-2026-84615
- related CVE-2026-84616
- related CVE-2026-84617
- related CVE-2026-84620
- related CVE-2026-84621
- related CVE-2026-84622
- related CVE-2026-84623
- related CVE-2026-84624
- related CVE-2026-84625
- related CVE-2026-84626
- related CVE-2026-84628
- related CVE-2026-84629
- related CVE-2026-84630
- related CVE-2026-84632
- related CVE-2026-84635
- related CVE-2026-84636
- related CVE-2026-86870
- related CVE-2026-86876
- related CVE-2026-86878
- related CVE-2026-86879
- related CVE-2026-86881
- related CVE-2026-86882
- related CVE-2026-86883
- related CVE-2026-86884
- related CVE-2026-86885
- related CVE-2026-86886
- related CVE-2026-86887
- related CVE-2026-86888
- related CVE-2026-86890
- related CVE-2026-86892
- related CVE-2026-86893
- related CVE-2026-86895
- related CVE-2026-86897
- related CVE-2026-86898
- related CVE-2026-86903
- related CVE-2026-86904
- related CVE-2026-86905
- related CVE-2026-86924
{
"containers": {
"cna": {
"affected": [
{
"product": "iOS 27 and",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-09-14-2026-1 iOS 27 and iPadOS 27\n\niOS 27 and iPadOS 27 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/149034.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccelerate Framework\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: Processing a maliciously crafted image may lead to unexpected\nprocess termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-86882: Peter Malone\n\nAccessibility\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43664: Stuart Wallace, Ilya Andr (andrd3v), Rosyna Keller of\nTotally Not Malicious Software, CJ Vana, David Strnadel, Daniel Febrero,\nAsaf Cohen, Gongyu Ma (@Mezone0), Jian Lee (@speedyfriend433)\n\nAccessibility\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: An app may be able to identify what other apps a user has\ninstalled\nDescription: A privacy issue was addressed with improved handling of\nuser preferences.\nCVE-2026-64761: Stuart Wallace, Sindre Sorhus\n\nAccounts\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: A malicious application may be able to bypass Privacy\npreferences\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-65404: Arni Hardarson (Neonix Security), Vinay Kumar Rasala\n(Xplo8E) from Appknox, Stuart Wallace, \uc774\uc7ac\uc601\n\nAPFS\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84523: Cem Onat Karagun, an anonymous researcher\n\nApp Store\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: A local app may be able to read a persistent account identifier\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-86888: Zhongcheng Li (CK01)\n\nApple Account\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: An app may be able to use the Sign In With Apple authentication\nflow to access the user\u0027s Apple Account\nDescription: An authentication issue was addressed with improved state\nmanagement.\nCVE-2026-20683: Dem0ns (@\u5929\u5e9c\u7b80\u6613\u4fe1\u5de5\u4f5c\u5ba4), Abdelhak Kherroubi, Jasminder Pal\nSingh, Lehan Dilusha Jayasingha (Sri Lanka)\n\nApple Neural Engine\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-65408: tamdao\n\nAppleAVD\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-65407: Franco Belman at Blackwing Intelligence\n\nAppleDouble\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: Mounting a disk image with maliciously crafted files may lead to\nunexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84519: Richard Zana\n\nAppleKeyStore\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-84593: Meta Red Team X - Nik Tsytsarkin, Alexandre Borges\n\nAuthentication Services\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: An app may be able to delete credentials stored in Keychain\nDescription: This issue was addressed by removing the vulnerable code.\nCVE-2026-86905: Ilya Andr (andrd3v)\n\nAuthKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: A local app may be able to read a persistent account identifier\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-84583: Zhongcheng Li from IES Red Team\n\nAVEVideoEncoder\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: An app may be able to cause unexpected system termination\nDescription: The issue was addressed with improved checks.\nCVE-2026-65410: Calif.io \u003chttp://calif.io/\u003e in collaboration with Claude and Anthropic\nResearch\n\nAVEVideoEncoder\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A type confusion issue was addressed with improved memory\nhandling.\nCVE-2026-84616: Peter Malone\n\nAVEVideoEncoder\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: A sandboxed app may be able to execute arbitrary code with\nkernel privileges\nDescription: A race condition was addressed with improved state\nmanagement.\nCVE-2026-84607: Ruslan Dautov\n\nBackgroundAssets\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: An app may be able to access sensitive user data\nDescription: A logic issue was addressed with improved validation.\nCVE-2026-65406: Ye Zhang (@VAR10CK) of Baidu Security\n\nBaseband\nAvailable for: iPhone 11 and later\nImpact: An attacker in radio range may be able to cause unexpected\nsystem termination\nDescription: An input validation issue was addressed with improved input\nvalidation.\nCVE-2026-86885: Tuan D. Hoang, Hazem Issa, and Yongdae Kim @ KAIST\nSysSec Lab\n\nBaseband\nAvailable for: iPhone 11 and later\nImpact: A remote attacker may be able to cause a denial-of-service\nDescription: A denial-of-service issue was addressed with improved input\nvalidation.\nCVE-2026-86879: Hazem Issa and Yongdae Kim @ SysSec, KAIST\n\nBluetooth\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: A remote attacker may be able to cause unexpected app\ntermination or arbitrary code execution\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-65414\n\nBluetooth\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: An app may gain unauthorized access to Bluetooth\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-84560: an anonymous researcher\n\nCamera\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: An app may be able to access sensitive user data\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-86878: Sindre Sorhus, Ilya Andr (andrd3v) of Positive\nTechnologies, Asaf Cohen\n\nCloudKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: A local app may be able to read a persistent account identifier\nDescription: An information disclosure issue was addressed with improved\nstate management.\nCVE-2026-86895: Stanislav Jelezoglo\n\nCloudKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: An app may be able to read device name\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-86893: Heiner Gerdes\n\ncopyfile\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: An archive may be able to bypass Gatekeeper\nDescription: A file quarantine bypass was addressed with additional\nchecks.\nCVE-2026-65399: Rishabh Jain (rjcyber) of cyberplanet, Pasquale Scola,\nan anonymous researcher\n\nCoreMedia\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: Processing a maliciously crafted image may lead to arbitrary\ncode execution\nDescription: A memory corruption issue was addressed by removing the\nvulnerable code.\nCVE-2026-64752: Nik Tsytsarkin\n\nCoreMedia\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T04:57:27Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/53"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/53"
},
{
"url": "http://aipyaipy.com/"
},
{
"url": "http://balintmagyar.com/"
},
{
"url": "http://calif.io/"
},
{
"url": "http://github.com/sai2fast"
},
{
"url": "http://jakederouin.com/"
},
{
"url": "http://jylab.github.io/"
},
{
"url": "http://linkedin.com/in/barathstalin"
},
{
"url": "http://linkedin.com/in/manojkumar-j-7ba35b202/"
},
{
"url": "http://onymos.com/"
},
{
"url": "http://paradisefacade.com/"
},
{
"url": "http://rokita.me/"
},
{
"url": "http://striga.ai/"
},
{
"url": "http://x.com/weezerOSINT"
},
{
"url": "http://xint.io/"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/149034"
},
{
"url": "https://www.apple.com/itunes/"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/53"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-09-14-2026-1 iOS 27 and iPadOS 27",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-20683",
"type": "related"
},
{
"destId": "CVE-2026-28966",
"type": "related"
},
{
"destId": "CVE-2026-28968",
"type": "related"
},
{
"destId": "CVE-2026-28969",
"type": "related"
},
{
"destId": "CVE-2026-43664",
"type": "related"
},
{
"destId": "CVE-2026-43674",
"type": "related"
},
{
"destId": "CVE-2026-43686",
"type": "related"
},
{
"destId": "CVE-2026-43687",
"type": "related"
},
{
"destId": "CVE-2026-43688",
"type": "related"
},
{
"destId": "CVE-2026-43689",
"type": "related"
},
{
"destId": "CVE-2026-43695",
"type": "related"
},
{
"destId": "CVE-2026-43737",
"type": "related"
},
{
"destId": "CVE-2026-43738",
"type": "related"
},
{
"destId": "CVE-2026-43785",
"type": "related"
},
{
"destId": "CVE-2026-64718",
"type": "related"
},
{
"destId": "CVE-2026-64752",
"type": "related"
},
{
"destId": "CVE-2026-64753",
"type": "related"
},
{
"destId": "CVE-2026-64756",
"type": "related"
},
{
"destId": "CVE-2026-64760",
"type": "related"
},
{
"destId": "CVE-2026-64761",
"type": "related"
},
{
"destId": "CVE-2026-65329",
"type": "related"
},
{
"destId": "CVE-2026-65344",
"type": "related"
},
{
"destId": "CVE-2026-65345",
"type": "related"
},
{
"destId": "CVE-2026-65348",
"type": "related"
},
{
"destId": "CVE-2026-65354",
"type": "related"
},
{
"destId": "CVE-2026-65358",
"type": "related"
},
{
"destId": "CVE-2026-65359",
"type": "related"
},
{
"destId": "CVE-2026-65360",
"type": "related"
},
{
"destId": "CVE-2026-65377",
"type": "related"
},
{
"destId": "CVE-2026-65395",
"type": "related"
},
{
"destId": "CVE-2026-65398",
"type": "related"
},
{
"destId": "CVE-2026-65399",
"type": "related"
},
{
"destId": "CVE-2026-65402",
"type": "related"
},
{
"destId": "CVE-2026-65403",
"type": "related"
},
{
"destId": "CVE-2026-65404",
"type": "related"
},
{
"destId": "CVE-2026-65405",
"type": "related"
},
{
"destId": "CVE-2026-65406",
"type": "related"
},
{
"destId": "CVE-2026-65407",
"type": "related"
},
{
"destId": "CVE-2026-65408",
"type": "related"
},
{
"destId": "CVE-2026-65409",
"type": "related"
},
{
"destId": "CVE-2026-65410",
"type": "related"
},
{
"destId": "CVE-2026-65411",
"type": "related"
},
{
"destId": "CVE-2026-65412",
"type": "related"
},
{
"destId": "CVE-2026-65414",
"type": "related"
},
{
"destId": "CVE-2026-65415",
"type": "related"
},
{
"destId": "CVE-2026-84487",
"type": "related"
},
{
"destId": "CVE-2026-84489",
"type": "related"
},
{
"destId": "CVE-2026-84491",
"type": "related"
},
{
"destId": "CVE-2026-84492",
"type": "related"
},
{
"destId": "CVE-2026-84497",
"type": "related"
},
{
"destId": "CVE-2026-84507",
"type": "related"
},
{
"destId": "CVE-2026-84510",
"type": "related"
},
{
"destId": "CVE-2026-84511",
"type": "related"
},
{
"destId": "CVE-2026-84513",
"type": "related"
},
{
"destId": "CVE-2026-84518",
"type": "related"
},
{
"destId": "CVE-2026-84519",
"type": "related"
},
{
"destId": "CVE-2026-84521",
"type": "related"
},
{
"destId": "CVE-2026-84523",
"type": "related"
},
{
"destId": "CVE-2026-84524",
"type": "related"
},
{
"destId": "CVE-2026-84526",
"type": "related"
},
{
"destId": "CVE-2026-84527",
"type": "related"
},
{
"destId": "CVE-2026-84530",
"type": "related"
},
{
"destId": "CVE-2026-84531",
"type": "related"
},
{
"destId": "CVE-2026-84532",
"type": "related"
},
{
"destId": "CVE-2026-84533",
"type": "related"
},
{
"destId": "CVE-2026-84534",
"type": "related"
},
{
"destId": "CVE-2026-84546",
"type": "related"
},
{
"destId": "CVE-2026-84551",
"type": "related"
},
{
"destId": "CVE-2026-84552",
"type": "related"
},
{
"destId": "CVE-2026-84560",
"type": "related"
},
{
"destId": "CVE-2026-84561",
"type": "related"
},
{
"destId": "CVE-2026-84564",
"type": "related"
},
{
"destId": "CVE-2026-84566",
"type": "related"
},
{
"destId": "CVE-2026-84571",
"type": "related"
},
{
"destId": "CVE-2026-84575",
"type": "related"
},
{
"destId": "CVE-2026-84583",
"type": "related"
},
{
"destId": "CVE-2026-84593",
"type": "related"
},
{
"destId": "CVE-2026-84596",
"type": "related"
},
{
"destId": "CVE-2026-84597",
"type": "related"
},
{
"destId": "CVE-2026-84598",
"type": "related"
},
{
"destId": "CVE-2026-84600",
"type": "related"
},
{
"destId": "CVE-2026-84602",
"type": "related"
},
{
"destId": "CVE-2026-84603",
"type": "related"
},
{
"destId": "CVE-2026-84606",
"type": "related"
},
{
"destId": "CVE-2026-84607",
"type": "related"
},
{
"destId": "CVE-2026-84609",
"type": "related"
},
{
"destId": "CVE-2026-84611",
"type": "related"
},
{
"destId": "CVE-2026-84612",
"type": "related"
},
{
"destId": "CVE-2026-84615",
"type": "related"
},
{
"destId": "CVE-2026-84616",
"type": "related"
},
{
"destId": "CVE-2026-84617",
"type": "related"
},
{
"destId": "CVE-2026-84620",
"type": "related"
},
{
"destId": "CVE-2026-84621",
"type": "related"
},
{
"destId": "CVE-2026-84622",
"type": "related"
},
{
"destId": "CVE-2026-84623",
"type": "related"
},
{
"destId": "CVE-2026-84624",
"type": "related"
},
{
"destId": "CVE-2026-84625",
"type": "related"
},
{
"destId": "CVE-2026-84626",
"type": "related"
},
{
"destId": "CVE-2026-84628",
"type": "related"
},
{
"destId": "CVE-2026-84629",
"type": "related"
},
{
"destId": "CVE-2026-84630",
"type": "related"
},
{
"destId": "CVE-2026-84632",
"type": "related"
},
{
"destId": "CVE-2026-84635",
"type": "related"
},
{
"destId": "CVE-2026-84636",
"type": "related"
},
{
"destId": "CVE-2026-86870",
"type": "related"
},
{
"destId": "CVE-2026-86876",
"type": "related"
},
{
"destId": "CVE-2026-86878",
"type": "related"
},
{
"destId": "CVE-2026-86879",
"type": "related"
},
{
"destId": "CVE-2026-86881",
"type": "related"
},
{
"destId": "CVE-2026-86882",
"type": "related"
},
{
"destId": "CVE-2026-86883",
"type": "related"
},
{
"destId": "CVE-2026-86884",
"type": "related"
},
{
"destId": "CVE-2026-86885",
"type": "related"
},
{
"destId": "CVE-2026-86886",
"type": "related"
},
{
"destId": "CVE-2026-86887",
"type": "related"
},
{
"destId": "CVE-2026-86888",
"type": "related"
},
{
"destId": "CVE-2026-86890",
"type": "related"
},
{
"destId": "CVE-2026-86892",
"type": "related"
},
{
"destId": "CVE-2026-86893",
"type": "related"
},
{
"destId": "CVE-2026-86895",
"type": "related"
},
{
"destId": "CVE-2026-86897",
"type": "related"
},
{
"destId": "CVE-2026-86898",
"type": "related"
},
{
"destId": "CVE-2026-86903",
"type": "related"
},
{
"destId": "CVE-2026-86904",
"type": "related"
},
{
"destId": "CVE-2026-86905",
"type": "related"
},
{
"destId": "CVE-2026-86924",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0391",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/53",
"automated": true,
"contentSha256": "15ade8acdb821fc448b0669e7818dc9fd9bf0f7a21a864c8824d69f216fd4157",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/53",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-09-14T21:46:43Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0391"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-10-02T04:57:27Z",
"dateUpdated": "2026-10-02T04:57:27Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0391"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0393
Vulnerability from gna-1988 – Published: 2026-10-02 04:57 – Updated: 2026-10-02 04:57
VLAI
EPSS
VEX
Title
APPLE-SA-09-14-2026-3 macOS Golden Gate 27
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-09-14-2026-3 macOS Golden Gate 27
macOS Golden Gate 27 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149035.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accelerate Framework
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020
and later), MacBook Pro with Apple silicon (2020 and later), iMac with
Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and
later), Mac Studio (2022 and later), and Mac Pro with Apple silicon
(2023)
Impact: Processing a maliciously crafted image may lead to unexpected
process termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-86882: Peter Malone
Accessibility
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020
and later), MacBook Pro with Apple silicon (2020 and later), iMac with
Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and
later), Mac Studio (2022 and later), and Mac Pro with Apple silicon
(2023)
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved data protection.
CVE-2026-43664: Stuart Wallace, Ilya Andr (andrd3v), Rosyna Keller of
Totally Not Malicious Software, CJ Vana, David Strnadel, Daniel Febrero,
Asaf Cohen, Gongyu Ma (@Mezone0), Jian Lee (@speedyfriend433)
Accounts
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020
and later), MacBook Pro with Apple silicon (2020 and later), iMac with
Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and
later), Mac Studio (2022 and later), and Mac Pro with Apple silicon
(2023)
Impact: A malicious application may be able to bypass Privacy
preferences
Description: An authorization issue was addressed with improved state
management.
CVE-2026-65404: Arni Hardarson (Neonix Security), Vinay Kumar Rasala
(Xplo8E) from Appknox, Stuart Wallace, 이재영
APFS
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020
and later), MacBook Pro with Apple silicon (2020 and later), iMac with
Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and
later), Mac Studio (2022 and later), and Mac Pro with Apple silicon
(2023)
Impact: An application may be able to access restricted files
Description: A permissions issue was addressed with improved path
validation.
CVE-2026-86910: an anonymous researcher
APFS
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020
and later), MacBook Pro with Apple silicon (2020 and later), iMac with
Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and
later), Mac Studio (2022 and later), and Mac Pro with Apple silicon
(2023)
Impact: An app may be able to cause unexpected system termination or
write kernel memory
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84523: Cem Onat Karagun, an anonymous researcher
App Store
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020
and later), MacBook Pro with Apple silicon (2020 and later), iMac with
Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and
later), Mac Studio (2022 and later), and Mac Pro with Apple silicon
(2023)
Impact: A local app may be able to read a persistent account identifier
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-86888: Zhongcheng Li (CK01)
AppKit
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020
and later), MacBook Pro with Apple silicon (2020 and later), iMac with
Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and
later), Mac Studio (2022 and later), and Mac Pro with Apple silicon
(2023)
Impact: An app may be able to access protected user data
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-84587: an anonymous researcher
Apple Account
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020
and later), MacBook Pro with Apple silicon (2020 and later), iMac with
Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and
later), Mac Studio (2022 and later), and Mac Pro with Apple silicon
(2023)
Impact: A malicious application may be able to leak sensitive user
information
Description: An information disclosure issue was addressed with improved
state management.
CVE-2026-84586: Prashan Samarathunge, Zhongcheng Li (CK01)
Apple Account
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020
and later), MacBook Pro with Apple silicon (2020 and later), iMac with
Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and
later), Mac Studio (2022 and later), and Mac Pro with Apple silicon
(2023)
Impact: An app may be able to use the Sign In With Apple authentication
flow to access the user's Apple Account
Description: An authentication issue was addressed with improved state
management.
CVE-2026-20683: Dem0ns (@天府简易信工作室), Abdelhak Kherroubi, Jasminder Pal
Singh, Lehan Dilusha Jayasingha (Sri Lanka)
Apple Intelligence
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020
and later), MacBook Pro with Apple silicon (2020 and later), iMac with
Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and
later), Mac Studio (2022 and later), and Mac Pro with Apple silicon
(2023)
Impact: An app may be able to bypass Apple Intelligence security prompts
Description: A permissions issue was addressed with improved state
management.
CVE-2026-84601: Nick Cook, Sentry Flag
Apple Neural Engine
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020
and later), MacBook Pro with Apple silicon (2020 and later), iMac with
Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and
later), Mac Studio (2022 and later), and Mac Pro with Apple silicon
(2023)
Impact: An app may be able to cause unexpected system termination
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-65408: tamdao
AppleAVD
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020
and later), MacBook Pro with Apple silicon (2020 and later), iMac with
Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and
later), Mac Studio (2022 and later), and Mac Pro with Apple silicon
(2023)
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-65407: Franco Belman at Blackwing Intelligence
AppleDouble
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020
and later), MacBook Pro with Apple silicon (2020 and later), iMac with
Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and
later), Mac Studio (2022 and later), and Mac Pro with Apple silicon
(2023)
Impact: Mounting a disk image with maliciously crafted files may lead to
unexpected system termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84519: Richard Zana
AppleFDEKeyStore
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020
and later), MacBook Pro with Apple silicon (2020 and later), iMac with
Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and
later), Mac Studio (2022 and later), and Mac Pro with Apple silicon
(2023)
Impact: A local attacker may be able to cause unexpected system
termination or corrupt kernel memory
Description: A buffer overflow was addressed with improved size
validation.
CVE-2026-84520: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)
of STAR Labs SG Pte. Ltd.
AppleMobileFileIntegrity
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020
and later), MacBook Pro with Apple silicon (2020 and later), iMac with
Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and
later), Mac Studio (2022 and later), and Mac Pro with Apple silicon
(2023)
Impact: A malicious app may be able to break out of its sandbox
Description: A validation issue existed in the entitlement verification.
This issue was addressed with improved validation of the process
entitlement.
CVE-2026-65381: Mickey Jin (@patch1t)
Archive Utility
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020
and later), MacBook Pro with Apple silicon (2020 and later), iMac with
Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and
later), Mac Studio (2022 and later), and Mac Pro with Apple silicon
(2023)
Impact: An app may be able to break out of its sandbox
Description: This issue was addressed with improved handling of
symlinks.
CVE-2026-84584: Mickey Jin (@patch1t)
Archive Utility
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020
and later), MacBook Pro with Apple silicon (2020 and later), iMac with
Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and
later), Mac Studio (2022 and later), and Mac Pro with Apple silicon
(2023)
Impact: An app may be able to access sensitive user data
Description: A race condition was addressed with improved state
management.
CVE-2026-84522: Mickey Jin (@patch1t)
ATS
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020
and later), MacBook Pro with Apple silicon (2020 and later), iMac with
Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and
later), Mac Studio (2022 and later), and Mac Pro with Apple silicon
(2023)
Impact: An app may be able to access user-sensitive data
Description: A logging issue was addressed with improved data redaction.
CVE-2026-84525: D4rthL
ATS
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020
and later), MacBook Pro with Apple silicon (2020 and later), iMac with
Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and
later), Mac Studio (2022 and later), and Mac Pro with Apple silicon
(2023)
Impact: An app may be able to access sensitive user data
Description: A permissions issue was addressed with improved validation.
CVE-2026-65342: Ahmed Alwardani, Mohamad Dawoud / Abodi Dawoud
Authentication Services
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020
and later), MacBook Pro with Apple silicon (2020 and later), iMac with
Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and
later), Mac Studio (2022 and later), and Mac Pro with Apple silicon
(2023)
Impact: An app may be able to delete credentials stored in Keychain
Description: This issue was addressed by removing the vulnerable code.
CVE-2026-86905: Ilya Andr (andrd3v)
AuthKit
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020
and later), MacBook Pro with Apple silicon (2020 and later), iMac with
Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and
later), Mac Studio (2022 and later), and Mac Pro with Apple silicon
(2023)
Impact: A local app may be able to read a persistent account identifier
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-84583: Zhongcheng Li from IES Red Team
autofs
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020
and later), MacBook Pro with Apple silicon (2020 and later), iMac with
Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and
later), Mac Studio (2022 and later), and Mac Pro with Apple silicon
(2023)
Impact: An app may be able to bypass Gatekeeper checks
Description: A logic issue was addressed with improved checks.
CVE-2026-84570: Mr.Gedik (@h4ck2s3c)
autofs
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020
and later), MacBook Pro with Apple silicon (2020 and later), iMac with
Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and
later), Mac Studio (2022 and later), and Mac Pro with Apple silicon
(2023)
Impact: An attacker with control of a network d
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| unknown | macOS Golden Gate |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0393 (this record)
- related CVE-2022-3437
- related CVE-2026-20683
- related CVE-2026-28899
- related CVE-2026-28934
- related CVE-2026-28937
- related CVE-2026-28966
- related CVE-2026-28968
- related CVE-2026-28969
- related CVE-2026-34979
- related CVE-2026-43664
- related CVE-2026-43677
- related CVE-2026-43683
- related CVE-2026-43684
- related CVE-2026-43686
- related CVE-2026-43687
- related CVE-2026-43688
- related CVE-2026-43689
- related CVE-2026-43690
- related CVE-2026-43691
- related CVE-2026-43692
- related CVE-2026-43695
- related CVE-2026-43696
- related CVE-2026-43697
- related CVE-2026-43698
- related CVE-2026-43719
- related CVE-2026-43737
- related CVE-2026-43738
- related CVE-2026-43741
- related CVE-2026-43785
- related CVE-2026-43786
- related CVE-2026-43787
- related CVE-2026-43788
- related CVE-2026-43789
- related CVE-2026-43790
- related CVE-2026-43791
- related CVE-2026-64712
- related CVE-2026-64714
- related CVE-2026-64718
- related CVE-2026-64752
- related CVE-2026-64753
- related CVE-2026-64756
- related CVE-2026-64760
- related CVE-2026-64790
- related CVE-2026-65342
- related CVE-2026-65344
- related CVE-2026-65345
- related CVE-2026-65348
- related CVE-2026-65354
- related CVE-2026-65358
- related CVE-2026-65359
- related CVE-2026-65360
- related CVE-2026-65361
- related CVE-2026-65362
- related CVE-2026-65364
- related CVE-2026-65365
- related CVE-2026-65369
- related CVE-2026-65374
- related CVE-2026-65375
- related CVE-2026-65376
- related CVE-2026-65377
- related CVE-2026-65378
- related CVE-2026-65380
- related CVE-2026-65381
- related CVE-2026-65382
- related CVE-2026-65383
- related CVE-2026-65393
- related CVE-2026-65395
- related CVE-2026-65398
- related CVE-2026-65399
- related CVE-2026-65400
- related CVE-2026-65401
- related CVE-2026-65402
- related CVE-2026-65403
- related CVE-2026-65404
- related CVE-2026-65405
- related CVE-2026-65406
- related CVE-2026-65407
- related CVE-2026-65408
- related CVE-2026-65409
- related CVE-2026-65410
- related CVE-2026-65412
- related CVE-2026-65413
- related CVE-2026-65414
- related CVE-2026-65415
- related CVE-2026-84487
- related CVE-2026-84489
- related CVE-2026-84491
- related CVE-2026-84492
- related CVE-2026-84497
- related CVE-2026-84505
- related CVE-2026-84506
- related CVE-2026-84507
- related CVE-2026-84509
- related CVE-2026-84510
- related CVE-2026-84511
- related CVE-2026-84512
- related CVE-2026-84513
- related CVE-2026-84514
- related CVE-2026-84515
- related CVE-2026-84516
- related CVE-2026-84517
- related CVE-2026-84518
- related CVE-2026-84519
- related CVE-2026-84520
- related CVE-2026-84521
- related CVE-2026-84522
- related CVE-2026-84523
- related CVE-2026-84524
- related CVE-2026-84525
- related CVE-2026-84526
- related CVE-2026-84527
- related CVE-2026-84530
- related CVE-2026-84531
- related CVE-2026-84532
- related CVE-2026-84533
- related CVE-2026-84534
- related CVE-2026-84535
- related CVE-2026-84536
- related CVE-2026-84537
- related CVE-2026-84538
- related CVE-2026-84540
- related CVE-2026-84541
- related CVE-2026-84543
- related CVE-2026-84544
- related CVE-2026-84546
- related CVE-2026-84548
- related CVE-2026-84549
- related CVE-2026-84550
- related CVE-2026-84551
- related CVE-2026-84552
- related CVE-2026-84553
- related CVE-2026-84554
- related CVE-2026-84555
- related CVE-2026-84556
- related CVE-2026-84558
- related CVE-2026-84559
- related CVE-2026-84560
- related CVE-2026-84561
- related CVE-2026-84563
- related CVE-2026-84564
- related CVE-2026-84565
- related CVE-2026-84566
- related CVE-2026-84567
- related CVE-2026-84568
- related CVE-2026-84569
- related CVE-2026-84570
- related CVE-2026-84571
- related CVE-2026-84572
- related CVE-2026-84573
- related CVE-2026-84574
- related CVE-2026-84575
- related CVE-2026-84576
- related CVE-2026-84577
- related CVE-2026-84578
- related CVE-2026-84580
- related CVE-2026-84581
- related CVE-2026-84583
- related CVE-2026-84584
- related CVE-2026-84585
- related CVE-2026-84586
- related CVE-2026-84587
- related CVE-2026-84588
- related CVE-2026-84589
- related CVE-2026-84596
- related CVE-2026-84597
- related CVE-2026-84600
- related CVE-2026-84601
- related CVE-2026-84602
- related CVE-2026-84606
- related CVE-2026-84607
- related CVE-2026-84609
- related CVE-2026-84611
- related CVE-2026-84612
- related CVE-2026-84616
- related CVE-2026-84617
- related CVE-2026-84618
- related CVE-2026-84619
- related CVE-2026-84620
- related CVE-2026-84621
- related CVE-2026-84622
- related CVE-2026-84624
- related CVE-2026-84625
- related CVE-2026-84626
- related CVE-2026-84628
- related CVE-2026-84630
- related CVE-2026-84631
- related CVE-2026-84632
- related CVE-2026-84635
- related CVE-2026-86869
- related CVE-2026-86870
- related CVE-2026-86876
- related CVE-2026-86881
- related CVE-2026-86882
- related CVE-2026-86884
- related CVE-2026-86888
- related CVE-2026-86889
- related CVE-2026-86891
- related CVE-2026-86894
- related CVE-2026-86897
- related CVE-2026-86898
- related CVE-2026-86900
- related CVE-2026-86901
- related CVE-2026-86902
- related CVE-2026-86903
- related CVE-2026-86905
- related CVE-2026-86909
- related CVE-2026-86910
- related CVE-2026-86911
- related CVE-2026-86917
- related CVE-2026-86924
{
"containers": {
"cna": {
"affected": [
{
"product": "macOS Golden Gate",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-09-14-2026-3 macOS Golden Gate 27\n\nmacOS Golden Gate 27 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/149035.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccelerate Framework\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: Processing a maliciously crafted image may lead to unexpected\nprocess termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-86882: Peter Malone\n\nAccessibility\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43664: Stuart Wallace, Ilya Andr (andrd3v), Rosyna Keller of\nTotally Not Malicious Software, CJ Vana, David Strnadel, Daniel Febrero,\nAsaf Cohen, Gongyu Ma (@Mezone0), Jian Lee (@speedyfriend433)\n\nAccounts\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: A malicious application may be able to bypass Privacy\npreferences\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-65404: Arni Hardarson (Neonix Security), Vinay Kumar Rasala\n(Xplo8E) from Appknox, Stuart Wallace, \uc774\uc7ac\uc601\n\nAPFS\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: An application may be able to access restricted files\nDescription: A permissions issue was addressed with improved path\nvalidation.\nCVE-2026-86910: an anonymous researcher\n\nAPFS\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84523: Cem Onat Karagun, an anonymous researcher\n\nApp Store\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: A local app may be able to read a persistent account identifier\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-86888: Zhongcheng Li (CK01)\n\nAppKit\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: An app may be able to access protected user data\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-84587: an anonymous researcher\n\nApple Account\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: A malicious application may be able to leak sensitive user\ninformation\nDescription: An information disclosure issue was addressed with improved\nstate management.\nCVE-2026-84586: Prashan Samarathunge, Zhongcheng Li (CK01)\n\nApple Account\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: An app may be able to use the Sign In With Apple authentication\nflow to access the user\u0027s Apple Account\nDescription: An authentication issue was addressed with improved state\nmanagement.\nCVE-2026-20683: Dem0ns (@\u5929\u5e9c\u7b80\u6613\u4fe1\u5de5\u4f5c\u5ba4), Abdelhak Kherroubi, Jasminder Pal\nSingh, Lehan Dilusha Jayasingha (Sri Lanka)\n\nApple Intelligence\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: An app may be able to bypass Apple Intelligence security prompts\nDescription: A permissions issue was addressed with improved state\nmanagement.\nCVE-2026-84601: Nick Cook, Sentry Flag\n\nApple Neural Engine\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-65408: tamdao\n\nAppleAVD\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-65407: Franco Belman at Blackwing Intelligence\n\nAppleDouble\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: Mounting a disk image with maliciously crafted files may lead to\nunexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84519: Richard Zana\n\nAppleFDEKeyStore\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: A local attacker may be able to cause unexpected system\ntermination or corrupt kernel memory\nDescription: A buffer overflow was addressed with improved size\nvalidation.\nCVE-2026-84520: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\n\nAppleMobileFileIntegrity\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A validation issue existed in the entitlement verification.\nThis issue was addressed with improved validation of the process\nentitlement.\nCVE-2026-65381: Mickey Jin (@patch1t)\n\nArchive Utility\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: An app may be able to break out of its sandbox\nDescription: This issue was addressed with improved handling of\nsymlinks.\nCVE-2026-84584: Mickey Jin (@patch1t)\n\nArchive Utility\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with improved state\nmanagement.\nCVE-2026-84522: Mickey Jin (@patch1t)\n\nATS\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: An app may be able to access user-sensitive data\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-84525: D4rthL\n\nATS\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: An app may be able to access sensitive user data\nDescription: A permissions issue was addressed with improved validation.\nCVE-2026-65342: Ahmed Alwardani, Mohamad Dawoud / Abodi Dawoud\n\nAuthentication Services\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: An app may be able to delete credentials stored in Keychain\nDescription: This issue was addressed by removing the vulnerable code.\nCVE-2026-86905: Ilya Andr (andrd3v)\n\nAuthKit\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: A local app may be able to read a persistent account identifier\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-84583: Zhongcheng Li from IES Red Team\n\nautofs\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: An app may be able to bypass Gatekeeper checks\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-84570: Mr.Gedik (@h4ck2s3c)\n\nautofs\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: An attacker with control of a network d"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T04:57:29Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/55"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/55"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/149035"
},
{
"url": "https://support.apple.com/downloads/"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/55"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-09-14-2026-3 macOS Golden Gate 27",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2022-3437",
"type": "related"
},
{
"destId": "CVE-2026-20683",
"type": "related"
},
{
"destId": "CVE-2026-28899",
"type": "related"
},
{
"destId": "CVE-2026-28934",
"type": "related"
},
{
"destId": "CVE-2026-28937",
"type": "related"
},
{
"destId": "CVE-2026-28966",
"type": "related"
},
{
"destId": "CVE-2026-28968",
"type": "related"
},
{
"destId": "CVE-2026-28969",
"type": "related"
},
{
"destId": "CVE-2026-34979",
"type": "related"
},
{
"destId": "CVE-2026-43664",
"type": "related"
},
{
"destId": "CVE-2026-43677",
"type": "related"
},
{
"destId": "CVE-2026-43683",
"type": "related"
},
{
"destId": "CVE-2026-43684",
"type": "related"
},
{
"destId": "CVE-2026-43686",
"type": "related"
},
{
"destId": "CVE-2026-43687",
"type": "related"
},
{
"destId": "CVE-2026-43688",
"type": "related"
},
{
"destId": "CVE-2026-43689",
"type": "related"
},
{
"destId": "CVE-2026-43690",
"type": "related"
},
{
"destId": "CVE-2026-43691",
"type": "related"
},
{
"destId": "CVE-2026-43692",
"type": "related"
},
{
"destId": "CVE-2026-43695",
"type": "related"
},
{
"destId": "CVE-2026-43696",
"type": "related"
},
{
"destId": "CVE-2026-43697",
"type": "related"
},
{
"destId": "CVE-2026-43698",
"type": "related"
},
{
"destId": "CVE-2026-43719",
"type": "related"
},
{
"destId": "CVE-2026-43737",
"type": "related"
},
{
"destId": "CVE-2026-43738",
"type": "related"
},
{
"destId": "CVE-2026-43741",
"type": "related"
},
{
"destId": "CVE-2026-43785",
"type": "related"
},
{
"destId": "CVE-2026-43786",
"type": "related"
},
{
"destId": "CVE-2026-43787",
"type": "related"
},
{
"destId": "CVE-2026-43788",
"type": "related"
},
{
"destId": "CVE-2026-43789",
"type": "related"
},
{
"destId": "CVE-2026-43790",
"type": "related"
},
{
"destId": "CVE-2026-43791",
"type": "related"
},
{
"destId": "CVE-2026-64712",
"type": "related"
},
{
"destId": "CVE-2026-64714",
"type": "related"
},
{
"destId": "CVE-2026-64718",
"type": "related"
},
{
"destId": "CVE-2026-64752",
"type": "related"
},
{
"destId": "CVE-2026-64753",
"type": "related"
},
{
"destId": "CVE-2026-64756",
"type": "related"
},
{
"destId": "CVE-2026-64760",
"type": "related"
},
{
"destId": "CVE-2026-64790",
"type": "related"
},
{
"destId": "CVE-2026-65342",
"type": "related"
},
{
"destId": "CVE-2026-65344",
"type": "related"
},
{
"destId": "CVE-2026-65345",
"type": "related"
},
{
"destId": "CVE-2026-65348",
"type": "related"
},
{
"destId": "CVE-2026-65354",
"type": "related"
},
{
"destId": "CVE-2026-65358",
"type": "related"
},
{
"destId": "CVE-2026-65359",
"type": "related"
},
{
"destId": "CVE-2026-65360",
"type": "related"
},
{
"destId": "CVE-2026-65361",
"type": "related"
},
{
"destId": "CVE-2026-65362",
"type": "related"
},
{
"destId": "CVE-2026-65364",
"type": "related"
},
{
"destId": "CVE-2026-65365",
"type": "related"
},
{
"destId": "CVE-2026-65369",
"type": "related"
},
{
"destId": "CVE-2026-65374",
"type": "related"
},
{
"destId": "CVE-2026-65375",
"type": "related"
},
{
"destId": "CVE-2026-65376",
"type": "related"
},
{
"destId": "CVE-2026-65377",
"type": "related"
},
{
"destId": "CVE-2026-65378",
"type": "related"
},
{
"destId": "CVE-2026-65380",
"type": "related"
},
{
"destId": "CVE-2026-65381",
"type": "related"
},
{
"destId": "CVE-2026-65382",
"type": "related"
},
{
"destId": "CVE-2026-65383",
"type": "related"
},
{
"destId": "CVE-2026-65393",
"type": "related"
},
{
"destId": "CVE-2026-65395",
"type": "related"
},
{
"destId": "CVE-2026-65398",
"type": "related"
},
{
"destId": "CVE-2026-65399",
"type": "related"
},
{
"destId": "CVE-2026-65400",
"type": "related"
},
{
"destId": "CVE-2026-65401",
"type": "related"
},
{
"destId": "CVE-2026-65402",
"type": "related"
},
{
"destId": "CVE-2026-65403",
"type": "related"
},
{
"destId": "CVE-2026-65404",
"type": "related"
},
{
"destId": "CVE-2026-65405",
"type": "related"
},
{
"destId": "CVE-2026-65406",
"type": "related"
},
{
"destId": "CVE-2026-65407",
"type": "related"
},
{
"destId": "CVE-2026-65408",
"type": "related"
},
{
"destId": "CVE-2026-65409",
"type": "related"
},
{
"destId": "CVE-2026-65410",
"type": "related"
},
{
"destId": "CVE-2026-65412",
"type": "related"
},
{
"destId": "CVE-2026-65413",
"type": "related"
},
{
"destId": "CVE-2026-65414",
"type": "related"
},
{
"destId": "CVE-2026-65415",
"type": "related"
},
{
"destId": "CVE-2026-84487",
"type": "related"
},
{
"destId": "CVE-2026-84489",
"type": "related"
},
{
"destId": "CVE-2026-84491",
"type": "related"
},
{
"destId": "CVE-2026-84492",
"type": "related"
},
{
"destId": "CVE-2026-84497",
"type": "related"
},
{
"destId": "CVE-2026-84505",
"type": "related"
},
{
"destId": "CVE-2026-84506",
"type": "related"
},
{
"destId": "CVE-2026-84507",
"type": "related"
},
{
"destId": "CVE-2026-84509",
"type": "related"
},
{
"destId": "CVE-2026-84510",
"type": "related"
},
{
"destId": "CVE-2026-84511",
"type": "related"
},
{
"destId": "CVE-2026-84512",
"type": "related"
},
{
"destId": "CVE-2026-84513",
"type": "related"
},
{
"destId": "CVE-2026-84514",
"type": "related"
},
{
"destId": "CVE-2026-84515",
"type": "related"
},
{
"destId": "CVE-2026-84516",
"type": "related"
},
{
"destId": "CVE-2026-84517",
"type": "related"
},
{
"destId": "CVE-2026-84518",
"type": "related"
},
{
"destId": "CVE-2026-84519",
"type": "related"
},
{
"destId": "CVE-2026-84520",
"type": "related"
},
{
"destId": "CVE-2026-84521",
"type": "related"
},
{
"destId": "CVE-2026-84522",
"type": "related"
},
{
"destId": "CVE-2026-84523",
"type": "related"
},
{
"destId": "CVE-2026-84524",
"type": "related"
},
{
"destId": "CVE-2026-84525",
"type": "related"
},
{
"destId": "CVE-2026-84526",
"type": "related"
},
{
"destId": "CVE-2026-84527",
"type": "related"
},
{
"destId": "CVE-2026-84530",
"type": "related"
},
{
"destId": "CVE-2026-84531",
"type": "related"
},
{
"destId": "CVE-2026-84532",
"type": "related"
},
{
"destId": "CVE-2026-84533",
"type": "related"
},
{
"destId": "CVE-2026-84534",
"type": "related"
},
{
"destId": "CVE-2026-84535",
"type": "related"
},
{
"destId": "CVE-2026-84536",
"type": "related"
},
{
"destId": "CVE-2026-84537",
"type": "related"
},
{
"destId": "CVE-2026-84538",
"type": "related"
},
{
"destId": "CVE-2026-84540",
"type": "related"
},
{
"destId": "CVE-2026-84541",
"type": "related"
},
{
"destId": "CVE-2026-84543",
"type": "related"
},
{
"destId": "CVE-2026-84544",
"type": "related"
},
{
"destId": "CVE-2026-84546",
"type": "related"
},
{
"destId": "CVE-2026-84548",
"type": "related"
},
{
"destId": "CVE-2026-84549",
"type": "related"
},
{
"destId": "CVE-2026-84550",
"type": "related"
},
{
"destId": "CVE-2026-84551",
"type": "related"
},
{
"destId": "CVE-2026-84552",
"type": "related"
},
{
"destId": "CVE-2026-84553",
"type": "related"
},
{
"destId": "CVE-2026-84554",
"type": "related"
},
{
"destId": "CVE-2026-84555",
"type": "related"
},
{
"destId": "CVE-2026-84556",
"type": "related"
},
{
"destId": "CVE-2026-84558",
"type": "related"
},
{
"destId": "CVE-2026-84559",
"type": "related"
},
{
"destId": "CVE-2026-84560",
"type": "related"
},
{
"destId": "CVE-2026-84561",
"type": "related"
},
{
"destId": "CVE-2026-84563",
"type": "related"
},
{
"destId": "CVE-2026-84564",
"type": "related"
},
{
"destId": "CVE-2026-84565",
"type": "related"
},
{
"destId": "CVE-2026-84566",
"type": "related"
},
{
"destId": "CVE-2026-84567",
"type": "related"
},
{
"destId": "CVE-2026-84568",
"type": "related"
},
{
"destId": "CVE-2026-84569",
"type": "related"
},
{
"destId": "CVE-2026-84570",
"type": "related"
},
{
"destId": "CVE-2026-84571",
"type": "related"
},
{
"destId": "CVE-2026-84572",
"type": "related"
},
{
"destId": "CVE-2026-84573",
"type": "related"
},
{
"destId": "CVE-2026-84574",
"type": "related"
},
{
"destId": "CVE-2026-84575",
"type": "related"
},
{
"destId": "CVE-2026-84576",
"type": "related"
},
{
"destId": "CVE-2026-84577",
"type": "related"
},
{
"destId": "CVE-2026-84578",
"type": "related"
},
{
"destId": "CVE-2026-84580",
"type": "related"
},
{
"destId": "CVE-2026-84581",
"type": "related"
},
{
"destId": "CVE-2026-84583",
"type": "related"
},
{
"destId": "CVE-2026-84584",
"type": "related"
},
{
"destId": "CVE-2026-84585",
"type": "related"
},
{
"destId": "CVE-2026-84586",
"type": "related"
},
{
"destId": "CVE-2026-84587",
"type": "related"
},
{
"destId": "CVE-2026-84588",
"type": "related"
},
{
"destId": "CVE-2026-84589",
"type": "related"
},
{
"destId": "CVE-2026-84596",
"type": "related"
},
{
"destId": "CVE-2026-84597",
"type": "related"
},
{
"destId": "CVE-2026-84600",
"type": "related"
},
{
"destId": "CVE-2026-84601",
"type": "related"
},
{
"destId": "CVE-2026-84602",
"type": "related"
},
{
"destId": "CVE-2026-84606",
"type": "related"
},
{
"destId": "CVE-2026-84607",
"type": "related"
},
{
"destId": "CVE-2026-84609",
"type": "related"
},
{
"destId": "CVE-2026-84611",
"type": "related"
},
{
"destId": "CVE-2026-84612",
"type": "related"
},
{
"destId": "CVE-2026-84616",
"type": "related"
},
{
"destId": "CVE-2026-84617",
"type": "related"
},
{
"destId": "CVE-2026-84618",
"type": "related"
},
{
"destId": "CVE-2026-84619",
"type": "related"
},
{
"destId": "CVE-2026-84620",
"type": "related"
},
{
"destId": "CVE-2026-84621",
"type": "related"
},
{
"destId": "CVE-2026-84622",
"type": "related"
},
{
"destId": "CVE-2026-84624",
"type": "related"
},
{
"destId": "CVE-2026-84625",
"type": "related"
},
{
"destId": "CVE-2026-84626",
"type": "related"
},
{
"destId": "CVE-2026-84628",
"type": "related"
},
{
"destId": "CVE-2026-84630",
"type": "related"
},
{
"destId": "CVE-2026-84631",
"type": "related"
},
{
"destId": "CVE-2026-84632",
"type": "related"
},
{
"destId": "CVE-2026-84635",
"type": "related"
},
{
"destId": "CVE-2026-86869",
"type": "related"
},
{
"destId": "CVE-2026-86870",
"type": "related"
},
{
"destId": "CVE-2026-86876",
"type": "related"
},
{
"destId": "CVE-2026-86881",
"type": "related"
},
{
"destId": "CVE-2026-86882",
"type": "related"
},
{
"destId": "CVE-2026-86884",
"type": "related"
},
{
"destId": "CVE-2026-86888",
"type": "related"
},
{
"destId": "CVE-2026-86889",
"type": "related"
},
{
"destId": "CVE-2026-86891",
"type": "related"
},
{
"destId": "CVE-2026-86894",
"type": "related"
},
{
"destId": "CVE-2026-86897",
"type": "related"
},
{
"destId": "CVE-2026-86898",
"type": "related"
},
{
"destId": "CVE-2026-86900",
"type": "related"
},
{
"destId": "CVE-2026-86901",
"type": "related"
},
{
"destId": "CVE-2026-86902",
"type": "related"
},
{
"destId": "CVE-2026-86903",
"type": "related"
},
{
"destId": "CVE-2026-86905",
"type": "related"
},
{
"destId": "CVE-2026-86909",
"type": "related"
},
{
"destId": "CVE-2026-86910",
"type": "related"
},
{
"destId": "CVE-2026-86911",
"type": "related"
},
{
"destId": "CVE-2026-86917",
"type": "related"
},
{
"destId": "CVE-2026-86924",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0393",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/55",
"automated": true,
"contentSha256": "a7e77eb5c76891a79feeb3673564a3af37b299a1d06d6e29f4c94f1b1f7e40ce",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/55",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-09-14T22:06:19Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0393"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-10-02T04:57:29Z",
"dateUpdated": "2026-10-02T04:57:29Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0393"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0394
Vulnerability from gna-1988 – Published: 2026-10-02 04:57 – Updated: 2026-10-02 04:57
VLAI
EPSS
VEX
Title
APPLE-SA-09-14-2026-4 macOS Tahoe 26.7
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-09-14-2026-4 macOS Tahoe 26.7
macOS Tahoe 26.7 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149042.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accelerate Framework
Available for: macOS Tahoe
Impact: Processing a maliciously crafted image may lead to unexpected
process termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-86882: Peter Malone
Accessibility
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved data protection.
CVE-2026-43664: Stuart Wallace, Rosyna Keller of Totally Not Malicious
Software, Jian Lee (@speedyfriend433), Ilya Andr (andrd3v), Gongyu Ma
(@Mezone0), David Strnadel, Daniel Febrero, CJ Vana, Asaf Cohen
APFS
Available for: macOS Tahoe
Impact: An application may be able to access restricted files
Description: A permissions issue was addressed with improved path
validation.
CVE-2026-86910: an anonymous researcher
APFS
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination or
write kernel memory
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84523: Cem Onat Karagun, an anonymous researcher
App Store
Available for: macOS Tahoe
Impact: A local app may be able to read a persistent account identifier
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-86888: Zhongcheng Li (CK01)
AppKit
Available for: macOS Tahoe
Impact: An app may be able to access protected user data
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-84587: an anonymous researcher
Apple Account
Available for: macOS Tahoe
Impact: An app may be able to use the Sign In With Apple authentication
flow to access the user's Apple Account
Description: An authentication issue was addressed with improved state
management.
CVE-2026-20683: Lehan Dilusha Jayasingha (Sri Lanka), Jasminder Pal
Singh, Dem0ns (@天府简易信工作室), Abdelhak Kherroubi
Apple Neural Engine
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-65408: tamdao
AppleAVD
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-65407: Franco Belman at Blackwing Intelligence
AppleDouble
Available for: macOS Tahoe
Impact: Mounting a disk image with maliciously crafted files may lead to
unexpected system termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84519: Richard Zana
AppleMobileFileIntegrity
Available for: macOS Tahoe
Impact: A malicious app may be able to break out of its sandbox
Description: A validation issue existed in the entitlement verification.
This issue was addressed with improved validation of the process
entitlement.
CVE-2026-65381: Mickey Jin (@patch1t)
ATS
Available for: macOS Tahoe
Impact: An app may be able to read files outside of its sandbox
Description: A permissions issue was addressed by removing the
vulnerable code.
CVE-2026-43763: Pavan Nallamothu, Jared Reyes
ATS
Available for: macOS Tahoe
Impact: An app may be able to access user-sensitive data
Description: A logging issue was addressed with improved data redaction.
CVE-2026-84525: D4rthL
ATS
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: A permissions issue was addressed with improved validation.
CVE-2026-65342: Mohamad Dawoud / Abodi Dawoud, Ahmed Alwardani
AuthKit
Available for: macOS Tahoe
Impact: A local app may be able to read a persistent account identifier
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-84583: Zhongcheng Li from IES Red Team
autofs
Available for: macOS Tahoe
Impact: An attacker with control of a network directory server may be
able to execute arbitrary code with root privileges
Description: A path traversal issue was addressed with improved path
validation.
CVE-2026-84568: Mr.Gedik (@h4ck2s3c) of Turkish Technology
autofs
Available for: macOS Tahoe
Impact: An app may be able to bypass Gatekeeper checks
Description: A logic issue was addressed with improved checks.
CVE-2026-84570: Mr.Gedik (@h4ck2s3c)
Automator
Available for: macOS Tahoe
Impact: An app may be able to break out of its sandbox
Description: An authorization issue was addressed with improved state
management.
CVE-2026-84535: Sindre Sorhus, Oren Yomtov, Morris Richman
(@morrisinlife), Kun Peeks (@SwayZGl1tZyyy)
AVEVideoEncoder
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: The issue was addressed with improved checks.
CVE-2026-65410: Calif.io in collaboration with Claude and Anthropic
Research
AVEVideoEncoder
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: A type confusion issue was addressed with improved memory
handling.
CVE-2026-84616: Peter Malone
AVEVideoEncoder
Available for: macOS Tahoe
Impact: A sandboxed app may be able to execute arbitrary code with
kernel privileges
Description: A race condition was addressed with improved state
management.
CVE-2026-84607: Ruslan Dautov
BackgroundAssets
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: A logic issue was addressed with improved validation.
CVE-2026-65406: Ye Zhang (@VAR10CK) of Baidu Security
Bluetooth
Available for: macOS Tahoe
Impact: A remote attacker may be able to cause unexpected app
termination or arbitrary code execution
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-65414
cd9660
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: The issue was addressed with improved memory handling.
CVE-2026-84567: Sanny Mitra, Sihyun Roh (Compsec, SNU), ngockhanh from
Cystack, 정우 하 (@0xfa11babe), Suresh Sundaram, Surej Sekhar, Kun Peeks
(@SwayZGl1tZyyy), Hari Shanmugam (The Hxr1), Ataberk Yavuzer
copyfile
Available for: macOS Tahoe
Impact: An archive may be able to bypass Gatekeeper
Description: A file quarantine bypass was addressed with additional
checks.
CVE-2026-65399: Rishabh Jain (rjcyber) of cyberplanet, Pasquale Scola,
an anonymous researcher
Core Bluetooth
Available for: macOS Tahoe
Impact: An app may be able to access Bluetooth device information
Description: An authorization issue was addressed with improved state
management.
CVE-2026-86891: Dawuge of Shuffle Team
CoreDrag
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected process termination or
disclose process memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-43683: Nathaniel Oh (@calysteon)
CoreMedia
Available for: macOS Tahoe
Impact: An app may be able to access user-sensitive data
Description: An access issue was addressed with additional sandbox
restrictions.
CVE-2026-43789: 이재영
CoreMedia
Available for: macOS Tahoe
Impact: Processing a maliciously crafted video file may lead to
unexpected app termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-65344: Siyeong kim
CoreMedia
Available for: macOS Tahoe
Impact: A sandboxed process may be able to circumvent sandbox
restrictions
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-86876: Chris Bailey - Short Circuit
CoreMedia Video Toolbox
Available for: macOS Tahoe
Impact: Processing a maliciously crafted video file may lead to
unexpected app termination or corrupt process memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43702: Nathaniel Oh (@calysteon)
CoreML
Available for: macOS Tahoe
Impact: A sandboxed app may be able to access restricted files
Description: A permissions issue was addressed with improved path
validation.
CVE-2026-84624: AL Najafi, tamdao
CoreMotion
Available for: macOS Tahoe
Impact: An app may be able to access motion data from headphones without
user consent
Description: An authorization issue was addressed with improved
validation.
CVE-2026-43737: Stuart Wallace
CoreServices
Available for: macOS Tahoe
Impact: An app may be able to bypass Privacy preferences
Description: A permissions issue was addressed with improved state
management.
CVE-2026-84574: Mickey Jin (@patch1t)
CoreServices
Available for: macOS Tahoe
Impact: An app may bypass Gatekeeper checks
Description: A logic issue was addressed with improved checks.
CVE-2026-28899: Kraken Cryptocurrency Exchange, Andreas Jaegersberger &
Ro Achterberg of Nosebeard Labs
CoreServices
Available for: macOS Tahoe
Impact: A malicious application may be able to access restricted files
Description: A permissions issue was addressed with improved validation.
CVE-2026-84559: Ryan Hughes
CoreServices
Available for: macOS Tahoe
Impact: An app may be able to gain root privileges
Description: This issue was addressed with additional entitlement
checks.
CVE-2026-43786: Kujtim Kryeziu (Sentry)
CoreText
Available for: macOS Tahoe
Impact: Processing web content may lead to a denial-of-service
Description: A null pointer dereference was addressed with improved
input validation.
CVE-2026-65412: Pavan Nallamothu
CoreTypes
Available for: macOS Tahoe
Impact: A malicious app may be able to break out of its sandbox
Description: A validation issue existed in the entitlement verification.
This issue was addressed with improved validation of the process
entitlement.
CVE-2026-65381: Mickey Jin (@patch1t)
CoreUI
Available for: macOS Tahoe
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84575: Mustafa Calap (@ordinal0, dbg.re)
CoreUI
Available for: macOS Tahoe
Impact: Processing a maliciously crafted asset catalog may lead to
unexpected process termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84511: stratan (@5tratan), Rahul Raj
CUPS
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: A logic issue was addressed with improved checks.
CVE-2026-84563: Yongyue WANG AKA Brian.W of OKX security, Omar Cerrito
CUPS
Available for: macOS Tahoe
Impact: An app may be able to gain elevated privileges
Description: A path handling issue was addressed with improved
validation.
CVE-2026-64790: Aaron Grattafiori - NVIDIA AI Red Team
CUPS
Available for: macOS Tahoe
Impact: A remote user may cause an unexpected app termination or
arbitrary code execution
Description: A validation issue was addressed with improved input
sanitization.
CVE-2026-43692: Aaron Grattafiori - NVIDIA AI Red Team
CUPS
Available for: macOS Tahoe
Impact: An attacker in a privileged network position may be able to
cause a denial-of-service
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-84554: Meshaal @ Darkcov, Joseph Shamoon
CUPS
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: An authorization issue was addressed with improved state
management.
CVE-2026-84540: Yongyue WANG AKA Brian.W of OKX security, 章鱼哥@aipy
（aipyaipy.com）, instantraaamen (github.com/instantraaamen) Contact:
masa.shiramizu () gmail com
CUPS
Available for: macOS Tahoe
Impact: An app may be able to gain root privileges
Description: A path handling issue was addressed with improved
validation.
CVE-2026-43691: And
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apple | Macos Tahoe |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0394 (this record)
- related CVE-2022-3437
- related CVE-2026-20683
- related CVE-2026-28899
- related CVE-2026-28934
- related CVE-2026-28966
- related CVE-2026-28968
- related CVE-2026-28969
- related CVE-2026-43664
- related CVE-2026-43677
- related CVE-2026-43683
- related CVE-2026-43686
- related CVE-2026-43687
- related CVE-2026-43690
- related CVE-2026-43691
- related CVE-2026-43692
- related CVE-2026-43695
- related CVE-2026-43697
- related CVE-2026-43698
- related CVE-2026-43702
- related CVE-2026-43719
- related CVE-2026-43737
- related CVE-2026-43741
- related CVE-2026-43743
- related CVE-2026-43760
- related CVE-2026-43763
- related CVE-2026-43785
- related CVE-2026-43786
- related CVE-2026-43787
- related CVE-2026-43789
- related CVE-2026-43790
- related CVE-2026-43791
- related CVE-2026-64712
- related CVE-2026-64756
- related CVE-2026-64790
- related CVE-2026-65342
- related CVE-2026-65344
- related CVE-2026-65345
- related CVE-2026-65348
- related CVE-2026-65358
- related CVE-2026-65359
- related CVE-2026-65360
- related CVE-2026-65361
- related CVE-2026-65362
- related CVE-2026-65364
- related CVE-2026-65365
- related CVE-2026-65369
- related CVE-2026-65374
- related CVE-2026-65376
- related CVE-2026-65377
- related CVE-2026-65378
- related CVE-2026-65381
- related CVE-2026-65382
- related CVE-2026-65395
- related CVE-2026-65399
- related CVE-2026-65400
- related CVE-2026-65401
- related CVE-2026-65402
- related CVE-2026-65403
- related CVE-2026-65405
- related CVE-2026-65406
- related CVE-2026-65407
- related CVE-2026-65408
- related CVE-2026-65409
- related CVE-2026-65410
- related CVE-2026-65412
- related CVE-2026-65413
- related CVE-2026-65414
- related CVE-2026-84487
- related CVE-2026-84492
- related CVE-2026-84497
- related CVE-2026-84505
- related CVE-2026-84506
- related CVE-2026-84507
- related CVE-2026-84509
- related CVE-2026-84510
- related CVE-2026-84511
- related CVE-2026-84512
- related CVE-2026-84513
- related CVE-2026-84514
- related CVE-2026-84515
- related CVE-2026-84516
- related CVE-2026-84517
- related CVE-2026-84519
- related CVE-2026-84521
- related CVE-2026-84523
- related CVE-2026-84524
- related CVE-2026-84525
- related CVE-2026-84526
- related CVE-2026-84527
- related CVE-2026-84530
- related CVE-2026-84532
- related CVE-2026-84534
- related CVE-2026-84535
- related CVE-2026-84536
- related CVE-2026-84537
- related CVE-2026-84538
- related CVE-2026-84540
- related CVE-2026-84541
- related CVE-2026-84543
- related CVE-2026-84544
- related CVE-2026-84546
- related CVE-2026-84548
- related CVE-2026-84549
- related CVE-2026-84550
- related CVE-2026-84552
- related CVE-2026-84553
- related CVE-2026-84554
- related CVE-2026-84556
- related CVE-2026-84559
- related CVE-2026-84561
- related CVE-2026-84563
- related CVE-2026-84564
- related CVE-2026-84565
- related CVE-2026-84566
- related CVE-2026-84567
- related CVE-2026-84568
- related CVE-2026-84570
- related CVE-2026-84572
- related CVE-2026-84573
- related CVE-2026-84574
- related CVE-2026-84575
- related CVE-2026-84576
- related CVE-2026-84577
- related CVE-2026-84578
- related CVE-2026-84580
- related CVE-2026-84581
- related CVE-2026-84583
- related CVE-2026-84587
- related CVE-2026-84602
- related CVE-2026-84607
- related CVE-2026-84609
- related CVE-2026-84611
- related CVE-2026-84612
- related CVE-2026-84616
- related CVE-2026-84617
- related CVE-2026-84618
- related CVE-2026-84619
- related CVE-2026-84620
- related CVE-2026-84621
- related CVE-2026-84622
- related CVE-2026-84624
- related CVE-2026-84626
- related CVE-2026-84630
- related CVE-2026-84632
- related CVE-2026-86876
- related CVE-2026-86881
- related CVE-2026-86882
- related CVE-2026-86888
- related CVE-2026-86889
- related CVE-2026-86891
- related CVE-2026-86910
- related CVE-2026-86917
- related CVE-2026-86924
{
"containers": {
"cna": {
"affected": [
{
"product": "Macos Tahoe",
"vendor": "Apple",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-09-14-2026-4 macOS Tahoe 26.7\n\nmacOS Tahoe 26.7 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/149042.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccelerate Framework\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted image may lead to unexpected\nprocess termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-86882: Peter Malone\n\nAccessibility\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43664: Stuart Wallace, Rosyna Keller of Totally Not Malicious\nSoftware, Jian Lee (@speedyfriend433), Ilya Andr (andrd3v), Gongyu Ma\n(@Mezone0), David Strnadel, Daniel Febrero, CJ Vana, Asaf Cohen\n\nAPFS\nAvailable for: macOS Tahoe\nImpact: An application may be able to access restricted files\nDescription: A permissions issue was addressed with improved path\nvalidation.\nCVE-2026-86910: an anonymous researcher\n\nAPFS\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84523: Cem Onat Karagun, an anonymous researcher\n\nApp Store\nAvailable for: macOS Tahoe\nImpact: A local app may be able to read a persistent account identifier\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-86888: Zhongcheng Li (CK01)\n\nAppKit\nAvailable for: macOS Tahoe\nImpact: An app may be able to access protected user data\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-84587: an anonymous researcher\n\nApple Account\nAvailable for: macOS Tahoe\nImpact: An app may be able to use the Sign In With Apple authentication\nflow to access the user\u0027s Apple Account\nDescription: An authentication issue was addressed with improved state\nmanagement.\nCVE-2026-20683: Lehan Dilusha Jayasingha (Sri Lanka), Jasminder Pal\nSingh, Dem0ns (@\u5929\u5e9c\u7b80\u6613\u4fe1\u5de5\u4f5c\u5ba4), Abdelhak Kherroubi\n\nApple Neural Engine\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-65408: tamdao\n\nAppleAVD\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-65407: Franco Belman at Blackwing Intelligence\n\nAppleDouble\nAvailable for: macOS Tahoe\nImpact: Mounting a disk image with maliciously crafted files may lead to\nunexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84519: Richard Zana\n\nAppleMobileFileIntegrity\nAvailable for: macOS Tahoe\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A validation issue existed in the entitlement verification.\nThis issue was addressed with improved validation of the process\nentitlement.\nCVE-2026-65381: Mickey Jin (@patch1t)\n\nATS\nAvailable for: macOS Tahoe\nImpact: An app may be able to read files outside of its sandbox\nDescription: A permissions issue was addressed by removing the\nvulnerable code.\nCVE-2026-43763: Pavan Nallamothu, Jared Reyes\n\nATS\nAvailable for: macOS Tahoe\nImpact: An app may be able to access user-sensitive data\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-84525: D4rthL\n\nATS\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: A permissions issue was addressed with improved validation.\nCVE-2026-65342: Mohamad Dawoud / Abodi Dawoud, Ahmed Alwardani\n\nAuthKit\nAvailable for: macOS Tahoe\nImpact: A local app may be able to read a persistent account identifier\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-84583: Zhongcheng Li from IES Red Team\n\nautofs\nAvailable for: macOS Tahoe\nImpact: An attacker with control of a network directory server may be\nable to execute arbitrary code with root privileges\nDescription: A path traversal issue was addressed with improved path\nvalidation.\nCVE-2026-84568: Mr.Gedik (@h4ck2s3c) of Turkish Technology\n\nautofs\nAvailable for: macOS Tahoe\nImpact: An app may be able to bypass Gatekeeper checks\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-84570: Mr.Gedik (@h4ck2s3c)\n\nAutomator\nAvailable for: macOS Tahoe\nImpact: An app may be able to break out of its sandbox\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-84535: Sindre Sorhus, Oren Yomtov, Morris Richman\n(@morrisinlife), Kun Peeks (@SwayZGl1tZyyy)\n\nAVEVideoEncoder\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: The issue was addressed with improved checks.\nCVE-2026-65410: Calif.io in collaboration with Claude and Anthropic\nResearch\n\nAVEVideoEncoder\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: A type confusion issue was addressed with improved memory\nhandling.\nCVE-2026-84616: Peter Malone\n\nAVEVideoEncoder\nAvailable for: macOS Tahoe\nImpact: A sandboxed app may be able to execute arbitrary code with\nkernel privileges\nDescription: A race condition was addressed with improved state\nmanagement.\nCVE-2026-84607: Ruslan Dautov\n\nBackgroundAssets\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: A logic issue was addressed with improved validation.\nCVE-2026-65406: Ye Zhang (@VAR10CK) of Baidu Security\n\nBluetooth\nAvailable for: macOS Tahoe\nImpact: A remote attacker may be able to cause unexpected app\ntermination or arbitrary code execution\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-65414\n\ncd9660\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-84567: Sanny Mitra, Sihyun Roh (Compsec, SNU), ngockhanh from\nCystack, \uc815\uc6b0 \ud558 (@0xfa11babe), Suresh Sundaram, Surej Sekhar, Kun Peeks\n(@SwayZGl1tZyyy), Hari Shanmugam (The Hxr1), Ataberk Yavuzer\n\ncopyfile\nAvailable for: macOS Tahoe\nImpact: An archive may be able to bypass Gatekeeper\nDescription: A file quarantine bypass was addressed with additional\nchecks.\nCVE-2026-65399: Rishabh Jain (rjcyber) of cyberplanet, Pasquale Scola,\nan anonymous researcher\n\nCore Bluetooth\nAvailable for: macOS Tahoe\nImpact: An app may be able to access Bluetooth device information\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-86891: Dawuge of Shuffle Team\n\nCoreDrag\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected process termination or\ndisclose process memory\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43683: Nathaniel Oh (@calysteon)\n\nCoreMedia\nAvailable for: macOS Tahoe\nImpact: An app may be able to access user-sensitive data\nDescription: An access issue was addressed with additional sandbox\nrestrictions.\nCVE-2026-43789: \uc774\uc7ac\uc601\n\nCoreMedia\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-65344: Siyeong kim\n\nCoreMedia\nAvailable for: macOS Tahoe\nImpact: A sandboxed process may be able to circumvent sandbox\nrestrictions\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-86876: Chris Bailey - Short Circuit\n\nCoreMedia Video Toolbox\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination or corrupt process memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43702: Nathaniel Oh (@calysteon)\n\nCoreML\nAvailable for: macOS Tahoe\nImpact: A sandboxed app may be able to access restricted files\nDescription: A permissions issue was addressed with improved path\nvalidation.\nCVE-2026-84624: AL Najafi, tamdao\n\nCoreMotion\nAvailable for: macOS Tahoe\nImpact: An app may be able to access motion data from headphones without\nuser consent\nDescription: An authorization issue was addressed with improved\nvalidation.\nCVE-2026-43737: Stuart Wallace\n\nCoreServices\nAvailable for: macOS Tahoe\nImpact: An app may be able to bypass Privacy preferences\nDescription: A permissions issue was addressed with improved state\nmanagement.\nCVE-2026-84574: Mickey Jin (@patch1t)\n\nCoreServices\nAvailable for: macOS Tahoe\nImpact: An app may bypass Gatekeeper checks\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-28899: Kraken Cryptocurrency Exchange, Andreas Jaegersberger \u0026\nRo Achterberg of Nosebeard Labs\n\nCoreServices\nAvailable for: macOS Tahoe\nImpact: A malicious application may be able to access restricted files\nDescription: A permissions issue was addressed with improved validation.\nCVE-2026-84559: Ryan Hughes\n\nCoreServices\nAvailable for: macOS Tahoe\nImpact: An app may be able to gain root privileges\nDescription: This issue was addressed with additional entitlement\nchecks.\nCVE-2026-43786: Kujtim Kryeziu (Sentry)\n\nCoreText\nAvailable for: macOS Tahoe\nImpact: Processing web content may lead to a denial-of-service\nDescription: A null pointer dereference was addressed with improved\ninput validation.\nCVE-2026-65412: Pavan Nallamothu\n\nCoreTypes\nAvailable for: macOS Tahoe\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A validation issue existed in the entitlement verification.\nThis issue was addressed with improved validation of the process\nentitlement.\nCVE-2026-65381: Mickey Jin (@patch1t)\n\nCoreUI\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84575: Mustafa Calap (@ordinal0, dbg.re)\n\nCoreUI\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted asset catalog may lead to\nunexpected process termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84511: stratan (@5tratan), Rahul Raj\n\nCUPS\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-84563: Yongyue WANG AKA Brian.W of OKX security, Omar Cerrito\n\nCUPS\nAvailable for: macOS Tahoe\nImpact: An app may be able to gain elevated privileges\nDescription: A path handling issue was addressed with improved\nvalidation.\nCVE-2026-64790: Aaron Grattafiori - NVIDIA AI Red Team\n\nCUPS\nAvailable for: macOS Tahoe\nImpact: A remote user may cause an unexpected app termination or\narbitrary code execution\nDescription: A validation issue was addressed with improved input\nsanitization.\nCVE-2026-43692: Aaron Grattafiori - NVIDIA AI Red Team\n\nCUPS\nAvailable for: macOS Tahoe\nImpact: An attacker in a privileged network position may be able to\ncause a denial-of-service\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-84554: Meshaal @ Darkcov, Joseph Shamoon\n\nCUPS\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-84540: Yongyue WANG AKA Brian.W of OKX security, \u7ae0\u9c7c\u54e5@aipy\n\uff08aipyaipy.com\uff09, instantraaamen (github.com/instantraaamen) Contact:\nmasa.shiramizu () gmail com\n\nCUPS\nAvailable for: macOS Tahoe\nImpact: An app may be able to gain root privileges\nDescription: A path handling issue was addressed with improved\nvalidation.\nCVE-2026-43691: And"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T04:57:29Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/56"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/56"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/149042"
},
{
"url": "https://support.apple.com/downloads/"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/56"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-09-14-2026-4 macOS Tahoe 26.7",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2022-3437",
"type": "related"
},
{
"destId": "CVE-2026-20683",
"type": "related"
},
{
"destId": "CVE-2026-28899",
"type": "related"
},
{
"destId": "CVE-2026-28934",
"type": "related"
},
{
"destId": "CVE-2026-28966",
"type": "related"
},
{
"destId": "CVE-2026-28968",
"type": "related"
},
{
"destId": "CVE-2026-28969",
"type": "related"
},
{
"destId": "CVE-2026-43664",
"type": "related"
},
{
"destId": "CVE-2026-43677",
"type": "related"
},
{
"destId": "CVE-2026-43683",
"type": "related"
},
{
"destId": "CVE-2026-43686",
"type": "related"
},
{
"destId": "CVE-2026-43687",
"type": "related"
},
{
"destId": "CVE-2026-43690",
"type": "related"
},
{
"destId": "CVE-2026-43691",
"type": "related"
},
{
"destId": "CVE-2026-43692",
"type": "related"
},
{
"destId": "CVE-2026-43695",
"type": "related"
},
{
"destId": "CVE-2026-43697",
"type": "related"
},
{
"destId": "CVE-2026-43698",
"type": "related"
},
{
"destId": "CVE-2026-43702",
"type": "related"
},
{
"destId": "CVE-2026-43719",
"type": "related"
},
{
"destId": "CVE-2026-43737",
"type": "related"
},
{
"destId": "CVE-2026-43741",
"type": "related"
},
{
"destId": "CVE-2026-43743",
"type": "related"
},
{
"destId": "CVE-2026-43760",
"type": "related"
},
{
"destId": "CVE-2026-43763",
"type": "related"
},
{
"destId": "CVE-2026-43785",
"type": "related"
},
{
"destId": "CVE-2026-43786",
"type": "related"
},
{
"destId": "CVE-2026-43787",
"type": "related"
},
{
"destId": "CVE-2026-43789",
"type": "related"
},
{
"destId": "CVE-2026-43790",
"type": "related"
},
{
"destId": "CVE-2026-43791",
"type": "related"
},
{
"destId": "CVE-2026-64712",
"type": "related"
},
{
"destId": "CVE-2026-64756",
"type": "related"
},
{
"destId": "CVE-2026-64790",
"type": "related"
},
{
"destId": "CVE-2026-65342",
"type": "related"
},
{
"destId": "CVE-2026-65344",
"type": "related"
},
{
"destId": "CVE-2026-65345",
"type": "related"
},
{
"destId": "CVE-2026-65348",
"type": "related"
},
{
"destId": "CVE-2026-65358",
"type": "related"
},
{
"destId": "CVE-2026-65359",
"type": "related"
},
{
"destId": "CVE-2026-65360",
"type": "related"
},
{
"destId": "CVE-2026-65361",
"type": "related"
},
{
"destId": "CVE-2026-65362",
"type": "related"
},
{
"destId": "CVE-2026-65364",
"type": "related"
},
{
"destId": "CVE-2026-65365",
"type": "related"
},
{
"destId": "CVE-2026-65369",
"type": "related"
},
{
"destId": "CVE-2026-65374",
"type": "related"
},
{
"destId": "CVE-2026-65376",
"type": "related"
},
{
"destId": "CVE-2026-65377",
"type": "related"
},
{
"destId": "CVE-2026-65378",
"type": "related"
},
{
"destId": "CVE-2026-65381",
"type": "related"
},
{
"destId": "CVE-2026-65382",
"type": "related"
},
{
"destId": "CVE-2026-65395",
"type": "related"
},
{
"destId": "CVE-2026-65399",
"type": "related"
},
{
"destId": "CVE-2026-65400",
"type": "related"
},
{
"destId": "CVE-2026-65401",
"type": "related"
},
{
"destId": "CVE-2026-65402",
"type": "related"
},
{
"destId": "CVE-2026-65403",
"type": "related"
},
{
"destId": "CVE-2026-65405",
"type": "related"
},
{
"destId": "CVE-2026-65406",
"type": "related"
},
{
"destId": "CVE-2026-65407",
"type": "related"
},
{
"destId": "CVE-2026-65408",
"type": "related"
},
{
"destId": "CVE-2026-65409",
"type": "related"
},
{
"destId": "CVE-2026-65410",
"type": "related"
},
{
"destId": "CVE-2026-65412",
"type": "related"
},
{
"destId": "CVE-2026-65413",
"type": "related"
},
{
"destId": "CVE-2026-65414",
"type": "related"
},
{
"destId": "CVE-2026-84487",
"type": "related"
},
{
"destId": "CVE-2026-84492",
"type": "related"
},
{
"destId": "CVE-2026-84497",
"type": "related"
},
{
"destId": "CVE-2026-84505",
"type": "related"
},
{
"destId": "CVE-2026-84506",
"type": "related"
},
{
"destId": "CVE-2026-84507",
"type": "related"
},
{
"destId": "CVE-2026-84509",
"type": "related"
},
{
"destId": "CVE-2026-84510",
"type": "related"
},
{
"destId": "CVE-2026-84511",
"type": "related"
},
{
"destId": "CVE-2026-84512",
"type": "related"
},
{
"destId": "CVE-2026-84513",
"type": "related"
},
{
"destId": "CVE-2026-84514",
"type": "related"
},
{
"destId": "CVE-2026-84515",
"type": "related"
},
{
"destId": "CVE-2026-84516",
"type": "related"
},
{
"destId": "CVE-2026-84517",
"type": "related"
},
{
"destId": "CVE-2026-84519",
"type": "related"
},
{
"destId": "CVE-2026-84521",
"type": "related"
},
{
"destId": "CVE-2026-84523",
"type": "related"
},
{
"destId": "CVE-2026-84524",
"type": "related"
},
{
"destId": "CVE-2026-84525",
"type": "related"
},
{
"destId": "CVE-2026-84526",
"type": "related"
},
{
"destId": "CVE-2026-84527",
"type": "related"
},
{
"destId": "CVE-2026-84530",
"type": "related"
},
{
"destId": "CVE-2026-84532",
"type": "related"
},
{
"destId": "CVE-2026-84534",
"type": "related"
},
{
"destId": "CVE-2026-84535",
"type": "related"
},
{
"destId": "CVE-2026-84536",
"type": "related"
},
{
"destId": "CVE-2026-84537",
"type": "related"
},
{
"destId": "CVE-2026-84538",
"type": "related"
},
{
"destId": "CVE-2026-84540",
"type": "related"
},
{
"destId": "CVE-2026-84541",
"type": "related"
},
{
"destId": "CVE-2026-84543",
"type": "related"
},
{
"destId": "CVE-2026-84544",
"type": "related"
},
{
"destId": "CVE-2026-84546",
"type": "related"
},
{
"destId": "CVE-2026-84548",
"type": "related"
},
{
"destId": "CVE-2026-84549",
"type": "related"
},
{
"destId": "CVE-2026-84550",
"type": "related"
},
{
"destId": "CVE-2026-84552",
"type": "related"
},
{
"destId": "CVE-2026-84553",
"type": "related"
},
{
"destId": "CVE-2026-84554",
"type": "related"
},
{
"destId": "CVE-2026-84556",
"type": "related"
},
{
"destId": "CVE-2026-84559",
"type": "related"
},
{
"destId": "CVE-2026-84561",
"type": "related"
},
{
"destId": "CVE-2026-84563",
"type": "related"
},
{
"destId": "CVE-2026-84564",
"type": "related"
},
{
"destId": "CVE-2026-84565",
"type": "related"
},
{
"destId": "CVE-2026-84566",
"type": "related"
},
{
"destId": "CVE-2026-84567",
"type": "related"
},
{
"destId": "CVE-2026-84568",
"type": "related"
},
{
"destId": "CVE-2026-84570",
"type": "related"
},
{
"destId": "CVE-2026-84572",
"type": "related"
},
{
"destId": "CVE-2026-84573",
"type": "related"
},
{
"destId": "CVE-2026-84574",
"type": "related"
},
{
"destId": "CVE-2026-84575",
"type": "related"
},
{
"destId": "CVE-2026-84576",
"type": "related"
},
{
"destId": "CVE-2026-84577",
"type": "related"
},
{
"destId": "CVE-2026-84578",
"type": "related"
},
{
"destId": "CVE-2026-84580",
"type": "related"
},
{
"destId": "CVE-2026-84581",
"type": "related"
},
{
"destId": "CVE-2026-84583",
"type": "related"
},
{
"destId": "CVE-2026-84587",
"type": "related"
},
{
"destId": "CVE-2026-84602",
"type": "related"
},
{
"destId": "CVE-2026-84607",
"type": "related"
},
{
"destId": "CVE-2026-84609",
"type": "related"
},
{
"destId": "CVE-2026-84611",
"type": "related"
},
{
"destId": "CVE-2026-84612",
"type": "related"
},
{
"destId": "CVE-2026-84616",
"type": "related"
},
{
"destId": "CVE-2026-84617",
"type": "related"
},
{
"destId": "CVE-2026-84618",
"type": "related"
},
{
"destId": "CVE-2026-84619",
"type": "related"
},
{
"destId": "CVE-2026-84620",
"type": "related"
},
{
"destId": "CVE-2026-84621",
"type": "related"
},
{
"destId": "CVE-2026-84622",
"type": "related"
},
{
"destId": "CVE-2026-84624",
"type": "related"
},
{
"destId": "CVE-2026-84626",
"type": "related"
},
{
"destId": "CVE-2026-84630",
"type": "related"
},
{
"destId": "CVE-2026-84632",
"type": "related"
},
{
"destId": "CVE-2026-86876",
"type": "related"
},
{
"destId": "CVE-2026-86881",
"type": "related"
},
{
"destId": "CVE-2026-86882",
"type": "related"
},
{
"destId": "CVE-2026-86888",
"type": "related"
},
{
"destId": "CVE-2026-86889",
"type": "related"
},
{
"destId": "CVE-2026-86891",
"type": "related"
},
{
"destId": "CVE-2026-86910",
"type": "related"
},
{
"destId": "CVE-2026-86917",
"type": "related"
},
{
"destId": "CVE-2026-86924",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0394",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/56",
"automated": true,
"contentSha256": "02499611bc7445ce78fb5ae0ae485c2bae3ac9b52aae0be1f9b2b1db1c450ccc",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/56",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-09-14T22:07:05Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0394"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-10-02T04:57:29Z",
"dateUpdated": "2026-10-02T04:57:29Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0394"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0395
Vulnerability from gna-1988 – Published: 2026-10-02 04:57 – Updated: 2026-10-02 04:57
VLAI
EPSS
VEX
Title
APPLE-SA-09-14-2026-5 macOS Sequoia 15.8
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-09-14-2026-5 macOS Sequoia 15.8
macOS Sequoia 15.8 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149043.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accelerate Framework
Available for: macOS Sequoia
Impact: Processing a maliciously crafted image may lead to unexpected
process termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-86882: Peter Malone
Accessibility
Available for: macOS Sequoia
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved data protection.
CVE-2026-43664: Stuart Wallace, Rosyna Keller of Totally Not Malicious
Software, Jian Lee (@speedyfriend433), Ilya Andr (andrd3v), Gongyu Ma
(@Mezone0), David Strnadel, Daniel Febrero, CJ Vana, Asaf Cohen
APFS
Available for: macOS Sequoia
Impact: An application may be able to access restricted files
Description: A permissions issue was addressed with improved path
validation.
CVE-2026-86910: an anonymous researcher
APFS
Available for: macOS Sequoia
Impact: An app may be able to cause unexpected system termination or
write kernel memory
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84523: Cem Onat Karagun, an anonymous researcher
AppKit
Available for: macOS Sequoia
Impact: An app may be able to access protected user data
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-84587: an anonymous researcher
Apple Account
Available for: macOS Sequoia
Impact: An app may be able to use the Sign In With Apple authentication
flow to access the user's Apple Account
Description: An authentication issue was addressed with improved state
management.
CVE-2026-20683: Lehan Dilusha Jayasingha (Sri Lanka), Jasminder Pal
Singh, Dem0ns (@天府简易信工作室), Abdelhak Kherroubi
Apple Neural Engine
Available for: macOS Sequoia
Impact: An app may be able to cause unexpected system termination
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-65408: tamdao
AppleAVD
Available for: macOS Sequoia
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-65407: Franco Belman at Blackwing Intelligence
AppleDouble
Available for: macOS Sequoia
Impact: Mounting a disk image with maliciously crafted files may lead to
unexpected system termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84519: Richard Zana
AppleMobileFileIntegrity
Available for: macOS Sequoia
Impact: A malicious app may be able to break out of its sandbox
Description: A validation issue existed in the entitlement verification.
This issue was addressed with improved validation of the process
entitlement.
CVE-2026-65381: Mickey Jin (@patch1t)
ATS
Available for: macOS Sequoia
Impact: An app may be able to read files outside of its sandbox
Description: A permissions issue was addressed by removing the
vulnerable code.
CVE-2026-43763: Pavan Nallamothu, Jared Reyes
ATS
Available for: macOS Sequoia
Impact: An app may be able to access user-sensitive data
Description: A logging issue was addressed with improved data redaction.
CVE-2026-84525: D4rthL
ATS
Available for: macOS Sequoia
Impact: An app may be able to access sensitive user data
Description: A permissions issue was addressed with improved validation.
CVE-2026-65342: Mohamad Dawoud / Abodi Dawoud, Ahmed Alwardani
Audio
Available for: macOS Sequoia
Impact: An app may be able to leak sensitive user information
Description: A logic issue was addressed with improved checks.
CVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik
Tsytsarkin
AuthKit
Available for: macOS Sequoia
Impact: A local app may be able to read a persistent account identifier
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-84583: Zhongcheng Li from IES Red Team
autofs
Available for: macOS Sequoia
Impact: An attacker with control of a network directory server may be
able to execute arbitrary code with root privileges
Description: A path traversal issue was addressed with improved path
validation.
CVE-2026-84568: Mr.Gedik (@h4ck2s3c) of Turkish Technology
autofs
Available for: macOS Sequoia
Impact: An app may be able to bypass Gatekeeper checks
Description: A logic issue was addressed with improved checks.
CVE-2026-84570: Mr.Gedik (@h4ck2s3c)
Automator
Available for: macOS Sequoia
Impact: An app may be able to break out of its sandbox
Description: An authorization issue was addressed with improved state
management.
CVE-2026-84535: Sindre Sorhus, Oren Yomtov, Morris Richman
(@morrisinlife), Kun Peeks (@SwayZGl1tZyyy)
AVEVideoEncoder
Available for: macOS Sequoia
Impact: An app may be able to cause unexpected system termination
Description: A type confusion issue was addressed with improved memory
handling.
CVE-2026-84616: Peter Malone
AVEVideoEncoder
Available for: macOS Sequoia
Impact: A sandboxed app may be able to execute arbitrary code with
kernel privileges
Description: A race condition was addressed with improved state
management.
CVE-2026-84607: Ruslan Dautov
BackgroundAssets
Available for: macOS Sequoia
Impact: An app may be able to access sensitive user data
Description: A logic issue was addressed with improved validation.
CVE-2026-65406: Ye Zhang (@VAR10CK) of Baidu Security
Bluetooth
Available for: macOS Sequoia
Impact: A remote attacker may be able to cause unexpected app
termination or arbitrary code execution
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-65414
cd9660
Available for: macOS Sequoia
Impact: An app may be able to cause unexpected system termination
Description: The issue was addressed with improved memory handling.
CVE-2026-84567: Sanny Mitra, Sihyun Roh (Compsec, SNU), ngockhanh from
Cystack, 정우 하 (@0xfa11babe), Suresh Sundaram, Surej Sekhar, Kun Peeks
(@SwayZGl1tZyyy), Hari Shanmugam (The Hxr1), Ataberk Yavuzer
copyfile
Available for: macOS Sequoia
Impact: An archive may be able to bypass Gatekeeper
Description: A file quarantine bypass was addressed with additional
checks.
CVE-2026-65399: Rishabh Jain (rjcyber) of cyberplanet, Pasquale Scola,
an anonymous researcher
Core Bluetooth
Available for: macOS Sequoia
Impact: An app may be able to access Bluetooth device information
Description: An authorization issue was addressed with improved state
management.
CVE-2026-86891: Dawuge of Shuffle Team
CoreDrag
Available for: macOS Sequoia
Impact: An app may be able to cause unexpected process termination or
disclose process memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-43683: Nathaniel Oh (@calysteon)
CoreMedia
Available for: macOS Sequoia
Impact: An app may be able to access user-sensitive data
Description: An access issue was addressed with additional sandbox
restrictions.
CVE-2026-43789: 이재영
CoreMedia
Available for: macOS Sequoia
Impact: Processing a maliciously crafted video file may lead to
unexpected app termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-65344: Siyeong kim
CoreMedia
Available for: macOS Sequoia
Impact: A sandboxed process may be able to circumvent sandbox
restrictions
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-86876: Chris Bailey - Short Circuit
CoreMedia Video Toolbox
Available for: macOS Sequoia
Impact: Processing a maliciously crafted video file may lead to
unexpected app termination or corrupt process memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43702: Nathaniel Oh (@calysteon)
CoreML
Available for: macOS Sequoia
Impact: A sandboxed app may be able to access restricted files
Description: A permissions issue was addressed with improved path
validation.
CVE-2026-84624: AL Najafi, tamdao
CoreMotion
Available for: macOS Sequoia
Impact: An app may be able to access motion data from headphones without
user consent
Description: An authorization issue was addressed with improved
validation.
CVE-2026-43737: Stuart Wallace
CoreServices
Available for: macOS Sequoia
Impact: An app may be able to bypass Privacy preferences
Description: A permissions issue was addressed with improved state
management.
CVE-2026-84574: Mickey Jin (@patch1t)
CoreServices
Available for: macOS Sequoia
Impact: A malicious application may be able to access restricted files
Description: A permissions issue was addressed with improved validation.
CVE-2026-84559: Ryan Hughes
CoreServices
Available for: macOS Sequoia
Impact: An app may be able to gain root privileges
Description: This issue was addressed with additional entitlement
checks.
CVE-2026-43786: Kujtim Kryeziu (Sentry)
CoreText
Available for: macOS Sequoia
Impact: Processing web content may lead to a denial-of-service
Description: A null pointer dereference was addressed with improved
input validation.
CVE-2026-65412: Pavan Nallamothu
CoreTypes
Available for: macOS Sequoia
Impact: A malicious app may be able to break out of its sandbox
Description: A validation issue existed in the entitlement verification.
This issue was addressed with improved validation of the process
entitlement.
CVE-2026-65381: Mickey Jin (@patch1t)
CoreUI
Available for: macOS Sequoia
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84575: Mustafa Calap (@ordinal0, dbg.re)
CoreUI
Available for: macOS Sequoia
Impact: Processing a maliciously crafted asset catalog may lead to
unexpected process termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84511: stratan (@5tratan), Rahul Raj
CUPS
Available for: macOS Sequoia
Impact: An app may be able to cause unexpected system termination
Description: A logic issue was addressed with improved checks.
CVE-2026-84563: Yongyue WANG AKA Brian.W of OKX security, Omar Cerrito
CUPS
Available for: macOS Sequoia
Impact: An app may be able to access sensitive user data
Description: An authorization issue was addressed with improved state
management.
CVE-2026-84540: Yongyue WANG AKA Brian.W of OKX security, 章鱼哥@aipy
（aipyaipy.com）, instantraaamen (github.com/instantraaamen) Contact:
masa.shiramizu () gmail com
CUPS
Available for: macOS Sequoia
Impact: An attacker in a privileged network position may be able to
cause a denial-of-service
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-84554: Meshaal @ Darkcov, Joseph Shamoon
CUPS
Available for: macOS Sequoia
Impact: A remote user may cause an unexpected app termination or
arbitrary code execution
Description: A validation issue was addressed with improved input
sanitization.
CVE-2026-43692: Aaron Grattafiori - NVIDIA AI Red Team
CUPS
Available for: macOS Sequoia
Impact: An app may be able to gain elevated privileges
Description: A path handling issue was addressed with improved
validation.
CVE-2026-64790: Aaron Grattafiori - NVIDIA AI Red Team
CUPS
Available for: macOS Sequoia
Impact: An app may be able to gain root privileges
Description: A path handling issue was addressed with improved
validation.
CVE-2026-43691: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
CUPS
Available for: macOS Sequoia
Impact: Processing a maliciously crafted file may result in unexpected
app termination or disclosure of process memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-84516: 章鱼哥@aipy (aipyaipy.com）
CUPS
Available for: macOS Sequoia
Impact: An application
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apple | Macos Sequoia |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0395 (this record)
- related CVE-2022-3437
- related CVE-2026-20683
- related CVE-2026-28899
- related CVE-2026-28930
- related CVE-2026-28934
- related CVE-2026-28935
- related CVE-2026-28966
- related CVE-2026-28968
- related CVE-2026-28969
- related CVE-2026-43664
- related CVE-2026-43677
- related CVE-2026-43683
- related CVE-2026-43684
- related CVE-2026-43686
- related CVE-2026-43690
- related CVE-2026-43691
- related CVE-2026-43692
- related CVE-2026-43695
- related CVE-2026-43697
- related CVE-2026-43702
- related CVE-2026-43719
- related CVE-2026-43737
- related CVE-2026-43741
- related CVE-2026-43763
- related CVE-2026-43785
- related CVE-2026-43786
- related CVE-2026-43787
- related CVE-2026-43789
- related CVE-2026-43790
- related CVE-2026-43791
- related CVE-2026-64712
- related CVE-2026-64736
- related CVE-2026-64756
- related CVE-2026-64758
- related CVE-2026-64790
- related CVE-2026-65330
- related CVE-2026-65339
- related CVE-2026-65342
- related CVE-2026-65344
- related CVE-2026-65345
- related CVE-2026-65346
- related CVE-2026-65348
- related CVE-2026-65349
- related CVE-2026-65358
- related CVE-2026-65359
- related CVE-2026-65360
- related CVE-2026-65361
- related CVE-2026-65362
- related CVE-2026-65364
- related CVE-2026-65365
- related CVE-2026-65369
- related CVE-2026-65371
- related CVE-2026-65374
- related CVE-2026-65375
- related CVE-2026-65376
- related CVE-2026-65377
- related CVE-2026-65378
- related CVE-2026-65381
- related CVE-2026-65382
- related CVE-2026-65395
- related CVE-2026-65399
- related CVE-2026-65402
- related CVE-2026-65403
- related CVE-2026-65405
- related CVE-2026-65406
- related CVE-2026-65407
- related CVE-2026-65408
- related CVE-2026-65409
- related CVE-2026-65412
- related CVE-2026-65413
- related CVE-2026-65414
- related CVE-2026-84487
- related CVE-2026-84492
- related CVE-2026-84497
- related CVE-2026-84505
- related CVE-2026-84506
- related CVE-2026-84507
- related CVE-2026-84509
- related CVE-2026-84510
- related CVE-2026-84511
- related CVE-2026-84512
- related CVE-2026-84513
- related CVE-2026-84514
- related CVE-2026-84515
- related CVE-2026-84516
- related CVE-2026-84517
- related CVE-2026-84519
- related CVE-2026-84521
- related CVE-2026-84523
- related CVE-2026-84524
- related CVE-2026-84525
- related CVE-2026-84526
- related CVE-2026-84527
- related CVE-2026-84532
- related CVE-2026-84534
- related CVE-2026-84535
- related CVE-2026-84536
- related CVE-2026-84537
- related CVE-2026-84538
- related CVE-2026-84540
- related CVE-2026-84541
- related CVE-2026-84543
- related CVE-2026-84544
- related CVE-2026-84546
- related CVE-2026-84548
- related CVE-2026-84549
- related CVE-2026-84550
- related CVE-2026-84552
- related CVE-2026-84553
- related CVE-2026-84554
- related CVE-2026-84555
- related CVE-2026-84556
- related CVE-2026-84559
- related CVE-2026-84561
- related CVE-2026-84563
- related CVE-2026-84564
- related CVE-2026-84565
- related CVE-2026-84566
- related CVE-2026-84567
- related CVE-2026-84568
- related CVE-2026-84570
- related CVE-2026-84572
- related CVE-2026-84573
- related CVE-2026-84574
- related CVE-2026-84575
- related CVE-2026-84576
- related CVE-2026-84578
- related CVE-2026-84580
- related CVE-2026-84581
- related CVE-2026-84583
- related CVE-2026-84587
- related CVE-2026-84602
- related CVE-2026-84607
- related CVE-2026-84609
- related CVE-2026-84611
- related CVE-2026-84612
- related CVE-2026-84616
- related CVE-2026-84617
- related CVE-2026-84618
- related CVE-2026-84619
- related CVE-2026-84620
- related CVE-2026-84621
- related CVE-2026-84622
- related CVE-2026-84624
- related CVE-2026-84626
- related CVE-2026-84630
- related CVE-2026-84632
- related CVE-2026-86876
- related CVE-2026-86881
- related CVE-2026-86882
- related CVE-2026-86889
- related CVE-2026-86891
- related CVE-2026-86910
- related CVE-2026-86917
{
"containers": {
"cna": {
"affected": [
{
"product": "Macos Sequoia",
"vendor": "Apple",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-09-14-2026-5 macOS Sequoia 15.8\n\nmacOS Sequoia 15.8 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/149043.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccelerate Framework\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted image may lead to unexpected\nprocess termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-86882: Peter Malone\n\nAccessibility\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43664: Stuart Wallace, Rosyna Keller of Totally Not Malicious\nSoftware, Jian Lee (@speedyfriend433), Ilya Andr (andrd3v), Gongyu Ma\n(@Mezone0), David Strnadel, Daniel Febrero, CJ Vana, Asaf Cohen\n\nAPFS\nAvailable for: macOS Sequoia\nImpact: An application may be able to access restricted files\nDescription: A permissions issue was addressed with improved path\nvalidation.\nCVE-2026-86910: an anonymous researcher\n\nAPFS\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84523: Cem Onat Karagun, an anonymous researcher\n\nAppKit\nAvailable for: macOS Sequoia\nImpact: An app may be able to access protected user data\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-84587: an anonymous researcher\n\nApple Account\nAvailable for: macOS Sequoia\nImpact: An app may be able to use the Sign In With Apple authentication\nflow to access the user\u0027s Apple Account\nDescription: An authentication issue was addressed with improved state\nmanagement.\nCVE-2026-20683: Lehan Dilusha Jayasingha (Sri Lanka), Jasminder Pal\nSingh, Dem0ns (@\u5929\u5e9c\u7b80\u6613\u4fe1\u5de5\u4f5c\u5ba4), Abdelhak Kherroubi\n\nApple Neural Engine\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-65408: tamdao\n\nAppleAVD\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-65407: Franco Belman at Blackwing Intelligence\n\nAppleDouble\nAvailable for: macOS Sequoia\nImpact: Mounting a disk image with maliciously crafted files may lead to\nunexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84519: Richard Zana\n\nAppleMobileFileIntegrity\nAvailable for: macOS Sequoia\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A validation issue existed in the entitlement verification.\nThis issue was addressed with improved validation of the process\nentitlement.\nCVE-2026-65381: Mickey Jin (@patch1t)\n\nATS\nAvailable for: macOS Sequoia\nImpact: An app may be able to read files outside of its sandbox\nDescription: A permissions issue was addressed by removing the\nvulnerable code.\nCVE-2026-43763: Pavan Nallamothu, Jared Reyes\n\nATS\nAvailable for: macOS Sequoia\nImpact: An app may be able to access user-sensitive data\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-84525: D4rthL\n\nATS\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: A permissions issue was addressed with improved validation.\nCVE-2026-65342: Mohamad Dawoud / Abodi Dawoud, Ahmed Alwardani\n\nAudio\nAvailable for: macOS Sequoia\nImpact: An app may be able to leak sensitive user information\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik\nTsytsarkin\n\nAuthKit\nAvailable for: macOS Sequoia\nImpact: A local app may be able to read a persistent account identifier\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-84583: Zhongcheng Li from IES Red Team\n\nautofs\nAvailable for: macOS Sequoia\nImpact: An attacker with control of a network directory server may be\nable to execute arbitrary code with root privileges\nDescription: A path traversal issue was addressed with improved path\nvalidation.\nCVE-2026-84568: Mr.Gedik (@h4ck2s3c) of Turkish Technology\n\nautofs\nAvailable for: macOS Sequoia\nImpact: An app may be able to bypass Gatekeeper checks\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-84570: Mr.Gedik (@h4ck2s3c)\n\nAutomator\nAvailable for: macOS Sequoia\nImpact: An app may be able to break out of its sandbox\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-84535: Sindre Sorhus, Oren Yomtov, Morris Richman\n(@morrisinlife), Kun Peeks (@SwayZGl1tZyyy)\n\nAVEVideoEncoder\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: A type confusion issue was addressed with improved memory\nhandling.\nCVE-2026-84616: Peter Malone\n\nAVEVideoEncoder\nAvailable for: macOS Sequoia\nImpact: A sandboxed app may be able to execute arbitrary code with\nkernel privileges\nDescription: A race condition was addressed with improved state\nmanagement.\nCVE-2026-84607: Ruslan Dautov\n\nBackgroundAssets\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: A logic issue was addressed with improved validation.\nCVE-2026-65406: Ye Zhang (@VAR10CK) of Baidu Security\n\nBluetooth\nAvailable for: macOS Sequoia\nImpact: A remote attacker may be able to cause unexpected app\ntermination or arbitrary code execution\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-65414\n\ncd9660\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-84567: Sanny Mitra, Sihyun Roh (Compsec, SNU), ngockhanh from\nCystack, \uc815\uc6b0 \ud558 (@0xfa11babe), Suresh Sundaram, Surej Sekhar, Kun Peeks\n(@SwayZGl1tZyyy), Hari Shanmugam (The Hxr1), Ataberk Yavuzer\n\ncopyfile\nAvailable for: macOS Sequoia\nImpact: An archive may be able to bypass Gatekeeper\nDescription: A file quarantine bypass was addressed with additional\nchecks.\nCVE-2026-65399: Rishabh Jain (rjcyber) of cyberplanet, Pasquale Scola,\nan anonymous researcher\n\nCore Bluetooth\nAvailable for: macOS Sequoia\nImpact: An app may be able to access Bluetooth device information\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-86891: Dawuge of Shuffle Team\n\nCoreDrag\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected process termination or\ndisclose process memory\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43683: Nathaniel Oh (@calysteon)\n\nCoreMedia\nAvailable for: macOS Sequoia\nImpact: An app may be able to access user-sensitive data\nDescription: An access issue was addressed with additional sandbox\nrestrictions.\nCVE-2026-43789: \uc774\uc7ac\uc601\n\nCoreMedia\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-65344: Siyeong kim\n\nCoreMedia\nAvailable for: macOS Sequoia\nImpact: A sandboxed process may be able to circumvent sandbox\nrestrictions\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-86876: Chris Bailey - Short Circuit\n\nCoreMedia Video Toolbox\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination or corrupt process memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43702: Nathaniel Oh (@calysteon)\n\nCoreML\nAvailable for: macOS Sequoia\nImpact: A sandboxed app may be able to access restricted files\nDescription: A permissions issue was addressed with improved path\nvalidation.\nCVE-2026-84624: AL Najafi, tamdao\n\nCoreMotion\nAvailable for: macOS Sequoia\nImpact: An app may be able to access motion data from headphones without\nuser consent\nDescription: An authorization issue was addressed with improved\nvalidation.\nCVE-2026-43737: Stuart Wallace\n\nCoreServices\nAvailable for: macOS Sequoia\nImpact: An app may be able to bypass Privacy preferences\nDescription: A permissions issue was addressed with improved state\nmanagement.\nCVE-2026-84574: Mickey Jin (@patch1t)\n\nCoreServices\nAvailable for: macOS Sequoia\nImpact: A malicious application may be able to access restricted files\nDescription: A permissions issue was addressed with improved validation.\nCVE-2026-84559: Ryan Hughes\n\nCoreServices\nAvailable for: macOS Sequoia\nImpact: An app may be able to gain root privileges\nDescription: This issue was addressed with additional entitlement\nchecks.\nCVE-2026-43786: Kujtim Kryeziu (Sentry)\n\nCoreText\nAvailable for: macOS Sequoia\nImpact: Processing web content may lead to a denial-of-service\nDescription: A null pointer dereference was addressed with improved\ninput validation.\nCVE-2026-65412: Pavan Nallamothu\n\nCoreTypes\nAvailable for: macOS Sequoia\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A validation issue existed in the entitlement verification.\nThis issue was addressed with improved validation of the process\nentitlement.\nCVE-2026-65381: Mickey Jin (@patch1t)\n\nCoreUI\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84575: Mustafa Calap (@ordinal0, dbg.re)\n\nCoreUI\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted asset catalog may lead to\nunexpected process termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84511: stratan (@5tratan), Rahul Raj\n\nCUPS\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-84563: Yongyue WANG AKA Brian.W of OKX security, Omar Cerrito\n\nCUPS\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-84540: Yongyue WANG AKA Brian.W of OKX security, \u7ae0\u9c7c\u54e5@aipy\n\uff08aipyaipy.com\uff09, instantraaamen (github.com/instantraaamen) Contact:\nmasa.shiramizu () gmail com\n\nCUPS\nAvailable for: macOS Sequoia\nImpact: An attacker in a privileged network position may be able to\ncause a denial-of-service\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-84554: Meshaal @ Darkcov, Joseph Shamoon\n\nCUPS\nAvailable for: macOS Sequoia\nImpact: A remote user may cause an unexpected app termination or\narbitrary code execution\nDescription: A validation issue was addressed with improved input\nsanitization.\nCVE-2026-43692: Aaron Grattafiori - NVIDIA AI Red Team\n\nCUPS\nAvailable for: macOS Sequoia\nImpact: An app may be able to gain elevated privileges\nDescription: A path handling issue was addressed with improved\nvalidation.\nCVE-2026-64790: Aaron Grattafiori - NVIDIA AI Red Team\n\nCUPS\nAvailable for: macOS Sequoia\nImpact: An app may be able to gain root privileges\nDescription: A path handling issue was addressed with improved\nvalidation.\nCVE-2026-43691: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nCUPS\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted file may result in unexpected\napp termination or disclosure of process memory\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-84516: \u7ae0\u9c7c\u54e5@aipy (aipyaipy.com\uff09\n\nCUPS\nAvailable for: macOS Sequoia\nImpact: An application "
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T04:57:30Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/57"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/57"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/149043"
},
{
"url": "https://support.apple.com/downloads/"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/57"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-09-14-2026-5 macOS Sequoia 15.8",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2022-3437",
"type": "related"
},
{
"destId": "CVE-2026-20683",
"type": "related"
},
{
"destId": "CVE-2026-28899",
"type": "related"
},
{
"destId": "CVE-2026-28930",
"type": "related"
},
{
"destId": "CVE-2026-28934",
"type": "related"
},
{
"destId": "CVE-2026-28935",
"type": "related"
},
{
"destId": "CVE-2026-28966",
"type": "related"
},
{
"destId": "CVE-2026-28968",
"type": "related"
},
{
"destId": "CVE-2026-28969",
"type": "related"
},
{
"destId": "CVE-2026-43664",
"type": "related"
},
{
"destId": "CVE-2026-43677",
"type": "related"
},
{
"destId": "CVE-2026-43683",
"type": "related"
},
{
"destId": "CVE-2026-43684",
"type": "related"
},
{
"destId": "CVE-2026-43686",
"type": "related"
},
{
"destId": "CVE-2026-43690",
"type": "related"
},
{
"destId": "CVE-2026-43691",
"type": "related"
},
{
"destId": "CVE-2026-43692",
"type": "related"
},
{
"destId": "CVE-2026-43695",
"type": "related"
},
{
"destId": "CVE-2026-43697",
"type": "related"
},
{
"destId": "CVE-2026-43702",
"type": "related"
},
{
"destId": "CVE-2026-43719",
"type": "related"
},
{
"destId": "CVE-2026-43737",
"type": "related"
},
{
"destId": "CVE-2026-43741",
"type": "related"
},
{
"destId": "CVE-2026-43763",
"type": "related"
},
{
"destId": "CVE-2026-43785",
"type": "related"
},
{
"destId": "CVE-2026-43786",
"type": "related"
},
{
"destId": "CVE-2026-43787",
"type": "related"
},
{
"destId": "CVE-2026-43789",
"type": "related"
},
{
"destId": "CVE-2026-43790",
"type": "related"
},
{
"destId": "CVE-2026-43791",
"type": "related"
},
{
"destId": "CVE-2026-64712",
"type": "related"
},
{
"destId": "CVE-2026-64736",
"type": "related"
},
{
"destId": "CVE-2026-64756",
"type": "related"
},
{
"destId": "CVE-2026-64758",
"type": "related"
},
{
"destId": "CVE-2026-64790",
"type": "related"
},
{
"destId": "CVE-2026-65330",
"type": "related"
},
{
"destId": "CVE-2026-65339",
"type": "related"
},
{
"destId": "CVE-2026-65342",
"type": "related"
},
{
"destId": "CVE-2026-65344",
"type": "related"
},
{
"destId": "CVE-2026-65345",
"type": "related"
},
{
"destId": "CVE-2026-65346",
"type": "related"
},
{
"destId": "CVE-2026-65348",
"type": "related"
},
{
"destId": "CVE-2026-65349",
"type": "related"
},
{
"destId": "CVE-2026-65358",
"type": "related"
},
{
"destId": "CVE-2026-65359",
"type": "related"
},
{
"destId": "CVE-2026-65360",
"type": "related"
},
{
"destId": "CVE-2026-65361",
"type": "related"
},
{
"destId": "CVE-2026-65362",
"type": "related"
},
{
"destId": "CVE-2026-65364",
"type": "related"
},
{
"destId": "CVE-2026-65365",
"type": "related"
},
{
"destId": "CVE-2026-65369",
"type": "related"
},
{
"destId": "CVE-2026-65371",
"type": "related"
},
{
"destId": "CVE-2026-65374",
"type": "related"
},
{
"destId": "CVE-2026-65375",
"type": "related"
},
{
"destId": "CVE-2026-65376",
"type": "related"
},
{
"destId": "CVE-2026-65377",
"type": "related"
},
{
"destId": "CVE-2026-65378",
"type": "related"
},
{
"destId": "CVE-2026-65381",
"type": "related"
},
{
"destId": "CVE-2026-65382",
"type": "related"
},
{
"destId": "CVE-2026-65395",
"type": "related"
},
{
"destId": "CVE-2026-65399",
"type": "related"
},
{
"destId": "CVE-2026-65402",
"type": "related"
},
{
"destId": "CVE-2026-65403",
"type": "related"
},
{
"destId": "CVE-2026-65405",
"type": "related"
},
{
"destId": "CVE-2026-65406",
"type": "related"
},
{
"destId": "CVE-2026-65407",
"type": "related"
},
{
"destId": "CVE-2026-65408",
"type": "related"
},
{
"destId": "CVE-2026-65409",
"type": "related"
},
{
"destId": "CVE-2026-65412",
"type": "related"
},
{
"destId": "CVE-2026-65413",
"type": "related"
},
{
"destId": "CVE-2026-65414",
"type": "related"
},
{
"destId": "CVE-2026-84487",
"type": "related"
},
{
"destId": "CVE-2026-84492",
"type": "related"
},
{
"destId": "CVE-2026-84497",
"type": "related"
},
{
"destId": "CVE-2026-84505",
"type": "related"
},
{
"destId": "CVE-2026-84506",
"type": "related"
},
{
"destId": "CVE-2026-84507",
"type": "related"
},
{
"destId": "CVE-2026-84509",
"type": "related"
},
{
"destId": "CVE-2026-84510",
"type": "related"
},
{
"destId": "CVE-2026-84511",
"type": "related"
},
{
"destId": "CVE-2026-84512",
"type": "related"
},
{
"destId": "CVE-2026-84513",
"type": "related"
},
{
"destId": "CVE-2026-84514",
"type": "related"
},
{
"destId": "CVE-2026-84515",
"type": "related"
},
{
"destId": "CVE-2026-84516",
"type": "related"
},
{
"destId": "CVE-2026-84517",
"type": "related"
},
{
"destId": "CVE-2026-84519",
"type": "related"
},
{
"destId": "CVE-2026-84521",
"type": "related"
},
{
"destId": "CVE-2026-84523",
"type": "related"
},
{
"destId": "CVE-2026-84524",
"type": "related"
},
{
"destId": "CVE-2026-84525",
"type": "related"
},
{
"destId": "CVE-2026-84526",
"type": "related"
},
{
"destId": "CVE-2026-84527",
"type": "related"
},
{
"destId": "CVE-2026-84532",
"type": "related"
},
{
"destId": "CVE-2026-84534",
"type": "related"
},
{
"destId": "CVE-2026-84535",
"type": "related"
},
{
"destId": "CVE-2026-84536",
"type": "related"
},
{
"destId": "CVE-2026-84537",
"type": "related"
},
{
"destId": "CVE-2026-84538",
"type": "related"
},
{
"destId": "CVE-2026-84540",
"type": "related"
},
{
"destId": "CVE-2026-84541",
"type": "related"
},
{
"destId": "CVE-2026-84543",
"type": "related"
},
{
"destId": "CVE-2026-84544",
"type": "related"
},
{
"destId": "CVE-2026-84546",
"type": "related"
},
{
"destId": "CVE-2026-84548",
"type": "related"
},
{
"destId": "CVE-2026-84549",
"type": "related"
},
{
"destId": "CVE-2026-84550",
"type": "related"
},
{
"destId": "CVE-2026-84552",
"type": "related"
},
{
"destId": "CVE-2026-84553",
"type": "related"
},
{
"destId": "CVE-2026-84554",
"type": "related"
},
{
"destId": "CVE-2026-84555",
"type": "related"
},
{
"destId": "CVE-2026-84556",
"type": "related"
},
{
"destId": "CVE-2026-84559",
"type": "related"
},
{
"destId": "CVE-2026-84561",
"type": "related"
},
{
"destId": "CVE-2026-84563",
"type": "related"
},
{
"destId": "CVE-2026-84564",
"type": "related"
},
{
"destId": "CVE-2026-84565",
"type": "related"
},
{
"destId": "CVE-2026-84566",
"type": "related"
},
{
"destId": "CVE-2026-84567",
"type": "related"
},
{
"destId": "CVE-2026-84568",
"type": "related"
},
{
"destId": "CVE-2026-84570",
"type": "related"
},
{
"destId": "CVE-2026-84572",
"type": "related"
},
{
"destId": "CVE-2026-84573",
"type": "related"
},
{
"destId": "CVE-2026-84574",
"type": "related"
},
{
"destId": "CVE-2026-84575",
"type": "related"
},
{
"destId": "CVE-2026-84576",
"type": "related"
},
{
"destId": "CVE-2026-84578",
"type": "related"
},
{
"destId": "CVE-2026-84580",
"type": "related"
},
{
"destId": "CVE-2026-84581",
"type": "related"
},
{
"destId": "CVE-2026-84583",
"type": "related"
},
{
"destId": "CVE-2026-84587",
"type": "related"
},
{
"destId": "CVE-2026-84602",
"type": "related"
},
{
"destId": "CVE-2026-84607",
"type": "related"
},
{
"destId": "CVE-2026-84609",
"type": "related"
},
{
"destId": "CVE-2026-84611",
"type": "related"
},
{
"destId": "CVE-2026-84612",
"type": "related"
},
{
"destId": "CVE-2026-84616",
"type": "related"
},
{
"destId": "CVE-2026-84617",
"type": "related"
},
{
"destId": "CVE-2026-84618",
"type": "related"
},
{
"destId": "CVE-2026-84619",
"type": "related"
},
{
"destId": "CVE-2026-84620",
"type": "related"
},
{
"destId": "CVE-2026-84621",
"type": "related"
},
{
"destId": "CVE-2026-84622",
"type": "related"
},
{
"destId": "CVE-2026-84624",
"type": "related"
},
{
"destId": "CVE-2026-84626",
"type": "related"
},
{
"destId": "CVE-2026-84630",
"type": "related"
},
{
"destId": "CVE-2026-84632",
"type": "related"
},
{
"destId": "CVE-2026-86876",
"type": "related"
},
{
"destId": "CVE-2026-86881",
"type": "related"
},
{
"destId": "CVE-2026-86882",
"type": "related"
},
{
"destId": "CVE-2026-86889",
"type": "related"
},
{
"destId": "CVE-2026-86891",
"type": "related"
},
{
"destId": "CVE-2026-86910",
"type": "related"
},
{
"destId": "CVE-2026-86917",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0395",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/57",
"automated": true,
"contentSha256": "2d2290df1e9a0630fae8e581880969ed2cbe2e8e9f7c0f528a773fe4af504171",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/57",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-09-14T22:07:43Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0395"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-10-02T04:57:30Z",
"dateUpdated": "2026-10-02T04:57:30Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0395"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0396
Vulnerability from gna-1988 – Published: 2026-10-02 04:57 – Updated: 2026-10-02 04:57
VLAI
EPSS
VEX
Title
APPLE-SA-09-14-2026-6 tvOS 27
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-09-14-2026-6 tvOS 27
tvOS 27 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149036.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accelerate Framework
Available for: Apple TV 4K 2nd generation and later
Impact: Processing a maliciously crafted image may lead to unexpected
process termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-86882: Peter Malone
Accessibility
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved data protection.
CVE-2026-43664: Stuart Wallace, Ilya Andr (andrd3v), Rosyna Keller of
Totally Not Malicious Software, CJ Vana, David Strnadel, Daniel Febrero,
Asaf Cohen, Gongyu Ma (@Mezone0), Jian Lee (@speedyfriend433)
APFS
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to cause unexpected system termination or
write kernel memory
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84523: Cem Onat Karagun, an anonymous researcher
App Store
Available for: Apple TV 4K 2nd generation and later
Impact: A local app may be able to read a persistent account identifier
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-86888: Zhongcheng Li (CK01)
AppleAVD
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-65407: Franco Belman at Blackwing Intelligence
Audio
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to leak sensitive user information
Description: A logic issue was addressed with improved checks.
CVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik
Tsytsarkin
AuthKit
Available for: Apple TV 4K 2nd generation and later
Impact: A local app may be able to read a persistent account identifier
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-84583: Zhongcheng Li from IES Red Team
AVEVideoEncoder
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to cause unexpected system termination
Description: The issue was addressed with improved checks.
CVE-2026-65410: Calif.io in collaboration with Claude and Anthropic
Research
AVEVideoEncoder
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to cause unexpected system termination
Description: A type confusion issue was addressed with improved memory
handling.
CVE-2026-84616: Peter Malone
AVEVideoEncoder
Available for: Apple TV 4K 2nd generation and later
Impact: A sandboxed app may be able to execute arbitrary code with
kernel privileges
Description: A race condition was addressed with improved state
management.
CVE-2026-84607: Ruslan Dautov
BackgroundAssets
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to access sensitive user data
Description: A logic issue was addressed with improved validation.
CVE-2026-65406: Ye Zhang (@VAR10CK) of Baidu Security
Bluetooth
Available for: Apple TV 4K 2nd generation and later
Impact: A remote attacker may be able to cause unexpected app
termination or arbitrary code execution
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-65414
Bluetooth
Available for: Apple TV 4K 2nd generation and later
Impact: An app may gain unauthorized access to Bluetooth
Description: An authorization issue was addressed with improved state
management.
CVE-2026-84560: an anonymous researcher
CloudKit
Available for: Apple TV 4K 2nd generation and later
Impact: A local app may be able to read a persistent account identifier
Description: An information disclosure issue was addressed with improved
state management.
CVE-2026-86895: Stanislav Jelezoglo
CloudKit
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to read device name
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-86893: Heiner Gerdes
CoreMedia
Available for: Apple TV 4K 2nd generation and later
Impact: Processing a maliciously crafted video file may lead to
unexpected app termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-65344: Siyeong kim
CoreMotion
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to access motion data from headphones without
user consent
Description: An authorization issue was addressed with improved
validation.
CVE-2026-43737: Stuart Wallace
CoreText
Available for: Apple TV 4K 2nd generation and later
Impact: Processing a maliciously crafted font may result in the
disclosure of process memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-84596: ret2happy, Meta Product Security
CoreUI
Available for: Apple TV 4K 2nd generation and later
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84575: Mustafa Calap (@ordinal0, dbg.re)
CoreUI
Available for: Apple TV 4K 2nd generation and later
Impact: Processing a maliciously crafted image may lead to unexpected
app termination
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-84571: stratan (@5tratan), Peter Malone
CoreUI
Available for: Apple TV 4K 2nd generation and later
Impact: Processing a maliciously crafted asset catalog may lead to
unexpected process termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84511: Rahul Raj, stratan (@5tratan)
DeviceCheck
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to read persistent device identifiers
Description: An authorization issue was addressed with improved access
control.
CVE-2026-84612: N.M.Praveen Nawarathne (@zblockrat), James Gill
(@jjtech@infosec.exchange)
File Bookmark
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to modify a file it only had permission to
read
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-43785: Junyeong Lee (jylab.github.io), Merrick Hare, Aditya
Kumar, John Nzyuko Uvyu, Narendra Singh (@_3P1C)
FontParser
Available for: Apple TV 4K 2nd generation and later
Impact: Processing a maliciously crafted font file may lead to
unexpected app termination
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-84524: an anonymous researcher
FontParser
Available for: Apple TV 4K 2nd generation and later
Impact: Processing a maliciously crafted font may result in the
disclosure of process memory
Description: An out-of-bounds read issue was addressed with improved
input validation.
CVE-2026-84597: Nik Tsytsarkin
Foundation
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to cause a denial of service
Description: A type confusion issue was addressed with improved memory
handling.
CVE-2026-65409: Bruce Dang of Calif.io in collaboration with Claude and
Anthropic Research
Graphics
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to cause unexpected system termination
Description: A race condition was addressed with improved state
handling.
CVE-2026-84492: Tommy DeVoss from Braze Security Team (@thedawgyg),
Jiyong Yang
Heimdal
Available for: Apple TV 4K 2nd generation and later
Impact: An attacker in a privileged network position may be able to
modify network traffic
Description: A cryptographic issue was addressed with improved integrity
checks.
CVE-2026-84533: Vishal Patidar, Roman Zabicki
ImageIO
Available for: Apple TV 4K 2nd generation and later
Impact: Processing a maliciously crafted image may result in disclosure
of process memory
Description: An uninitialized memory issue was addressed with improved
memory initialization.
CVE-2026-84564: Justin O'Leary
ImageIO
Available for: Apple TV 4K 2nd generation and later
Impact: Processing an image may lead to a denial-of-service
Description: The issue was addressed with improved checks.
CVE-2026-65347: Geonha Lee (@leegn4a)
ImageIO
Available for: Apple TV 4K 2nd generation and later
Impact: Processing an image may lead to arbitrary code execution
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-65346: Meta Red Team X - Nik Tsytsarkin
ImageIO
Available for: Apple TV 4K 2nd generation and later
Impact: Processing a maliciously crafted image may result in memory
corruption
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-65395: Mateusz Jurczyk of Google Project Zero, Varik Matevosyan
IOKit
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-28969: Mihalis Haatainen, Ashish Kunwar, Ari Hawking, 이재영
IOMobileFrameBuffer
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: An out-of-bounds access issue was addressed with improved
bounds checking.
CVE-2026-65398: Chris Bailey - Short Circuit, Mustafa Calap (@ordinal0,
dbg.re), David Strnadel, Meta Red Team X - Nik Tsytsarkin
CVE-2026-64736: Ruslan Dautov, hxr1
IOSurfaceAccelerator
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to leak sensitive kernel state
Description: An information leakage was addressed with additional
validation.
CVE-2026-64760: an anonymous researcher, Seiji Sakurai (@HeapSmasher),
Franco Belman at Blackwing Intelligence
Kernel
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-28968: genter0, Svetoslav Stolarov & Aisa Fox, Josh Maine of
Calif.io, Dun
Kernel
Available for: Apple TV 4K 2nd generation and later
Impact: A local user may be able to cause unexpected system termination
or read kernel memory
Description: A race condition was addressed with additional validation.
CVE-2026-65415: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)
of STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)
Kernel
Available for: Apple TV 4K 2nd generation and later
Impact: A remote attacker may be able to cause unexpected system
termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-65343: Drinor Selmanaj (Sentry), Surya Narayan Kushwaha
Kernel
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to cause unexpected system termination or
read kernel memory
Description: An out-of-bounds read was addressed with improved input
validation.
CVE-2026-65349: an anonymous researcher
Kernel
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: A double free issue was addressed with improved memory
management.
CVE-2026-84561: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)
of STAR Labs SG Pte. Ltd., Bhaswanth Chigurupati
Kernel
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to cause unexpected system termination
Description: A race condition was addressed with improved state
handling.
CVE-2026-84630: Tristan Madani (@TristanInSec) from Talence Security
CVE-2026-
Severity
No CVSS data available.
Assigner
References
7 references
Relationships
reference
GCVE-1988-2026-0396 (this record)
- related CVE-2026-28935
- related CVE-2026-28966
- related CVE-2026-28968
- related CVE-2026-28969
- related CVE-2026-43664
- related CVE-2026-43686
- related CVE-2026-43687
- related CVE-2026-43695
- related CVE-2026-43737
- related CVE-2026-43785
- related CVE-2026-43794
- related CVE-2026-64715
- related CVE-2026-64736
- related CVE-2026-64753
- related CVE-2026-64760
- related CVE-2026-64778
- related CVE-2026-64787
- related CVE-2026-65330
- related CVE-2026-65339
- related CVE-2026-65341
- related CVE-2026-65343
- related CVE-2026-65344
- related CVE-2026-65346
- related CVE-2026-65347
- related CVE-2026-65349
- related CVE-2026-65358
- related CVE-2026-65359
- related CVE-2026-65360
- related CVE-2026-65377
- related CVE-2026-65390
- related CVE-2026-65391
- related CVE-2026-65395
- related CVE-2026-65398
- related CVE-2026-65402
- related CVE-2026-65405
- related CVE-2026-65406
- related CVE-2026-65407
- related CVE-2026-65409
- related CVE-2026-65410
- related CVE-2026-65414
- related CVE-2026-65415
- related CVE-2026-84487
- related CVE-2026-84491
- related CVE-2026-84492
- related CVE-2026-84497
- related CVE-2026-84507
- related CVE-2026-84511
- related CVE-2026-84513
- related CVE-2026-84523
- related CVE-2026-84524
- related CVE-2026-84526
- related CVE-2026-84527
- related CVE-2026-84530
- related CVE-2026-84532
- related CVE-2026-84533
- related CVE-2026-84546
- related CVE-2026-84560
- related CVE-2026-84561
- related CVE-2026-84564
- related CVE-2026-84571
- related CVE-2026-84575
- related CVE-2026-84583
- related CVE-2026-84596
- related CVE-2026-84597
- related CVE-2026-84600
- related CVE-2026-84602
- related CVE-2026-84607
- related CVE-2026-84609
- related CVE-2026-84611
- related CVE-2026-84612
- related CVE-2026-84615
- related CVE-2026-84616
- related CVE-2026-84617
- related CVE-2026-84620
- related CVE-2026-84622
- related CVE-2026-84626
- related CVE-2026-84628
- related CVE-2026-84629
- related CVE-2026-84630
- related CVE-2026-84632
- related CVE-2026-84635
- related CVE-2026-84636
- related CVE-2026-86881
- related CVE-2026-86882
- related CVE-2026-86884
- related CVE-2026-86888
- related CVE-2026-86893
- related CVE-2026-86895
- related CVE-2026-86903
{
"containers": {
"cna": {
"affected": [
{
"product": "tvOS 27",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-09-14-2026-6 tvOS 27\n\ntvOS 27 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/149036.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccelerate Framework\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing a maliciously crafted image may lead to unexpected\nprocess termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-86882: Peter Malone\n\nAccessibility\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43664: Stuart Wallace, Ilya Andr (andrd3v), Rosyna Keller of\nTotally Not Malicious Software, CJ Vana, David Strnadel, Daniel Febrero,\nAsaf Cohen, Gongyu Ma (@Mezone0), Jian Lee (@speedyfriend433)\n\nAPFS\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84523: Cem Onat Karagun, an anonymous researcher\n\nApp Store\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: A local app may be able to read a persistent account identifier\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-86888: Zhongcheng Li (CK01)\n\nAppleAVD\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-65407: Franco Belman at Blackwing Intelligence\n\nAudio\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to leak sensitive user information\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik\nTsytsarkin\n\nAuthKit\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: A local app may be able to read a persistent account identifier\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-84583: Zhongcheng Li from IES Red Team\n\nAVEVideoEncoder\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause unexpected system termination\nDescription: The issue was addressed with improved checks.\nCVE-2026-65410: Calif.io in collaboration with Claude and Anthropic\nResearch\n\nAVEVideoEncoder\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A type confusion issue was addressed with improved memory\nhandling.\nCVE-2026-84616: Peter Malone\n\nAVEVideoEncoder\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: A sandboxed app may be able to execute arbitrary code with\nkernel privileges\nDescription: A race condition was addressed with improved state\nmanagement.\nCVE-2026-84607: Ruslan Dautov\n\nBackgroundAssets\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to access sensitive user data\nDescription: A logic issue was addressed with improved validation.\nCVE-2026-65406: Ye Zhang (@VAR10CK) of Baidu Security\n\nBluetooth\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: A remote attacker may be able to cause unexpected app\ntermination or arbitrary code execution\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-65414\n\nBluetooth\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may gain unauthorized access to Bluetooth\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-84560: an anonymous researcher\n\nCloudKit\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: A local app may be able to read a persistent account identifier\nDescription: An information disclosure issue was addressed with improved\nstate management.\nCVE-2026-86895: Stanislav Jelezoglo\n\nCloudKit\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to read device name\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-86893: Heiner Gerdes\n\nCoreMedia\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-65344: Siyeong kim\n\nCoreMotion\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to access motion data from headphones without\nuser consent\nDescription: An authorization issue was addressed with improved\nvalidation.\nCVE-2026-43737: Stuart Wallace\n\nCoreText\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing a maliciously crafted font may result in the\ndisclosure of process memory\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-84596: ret2happy, Meta Product Security\n\nCoreUI\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84575: Mustafa Calap (@ordinal0, dbg.re)\n\nCoreUI\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing a maliciously crafted image may lead to unexpected\napp termination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-84571: stratan (@5tratan), Peter Malone\n\nCoreUI\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing a maliciously crafted asset catalog may lead to\nunexpected process termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84511: Rahul Raj, stratan (@5tratan)\n\nDeviceCheck\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to read persistent device identifiers\nDescription: An authorization issue was addressed with improved access\ncontrol.\nCVE-2026-84612: N.M.Praveen Nawarathne (@zblockrat), James Gill\n(@jjtech@infosec.exchange)\n\nFile Bookmark\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to modify a file it only had permission to\nread\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-43785: Junyeong Lee (jylab.github.io), Merrick Hare, Aditya\nKumar, John Nzyuko Uvyu, Narendra Singh (@_3P1C)\n\nFontParser\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing a maliciously crafted font file may lead to\nunexpected app termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-84524: an anonymous researcher\n\nFontParser\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing a maliciously crafted font may result in the\ndisclosure of process memory\nDescription: An out-of-bounds read issue was addressed with improved\ninput validation.\nCVE-2026-84597: Nik Tsytsarkin\n\nFoundation\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause a denial of service\nDescription: A type confusion issue was addressed with improved memory\nhandling.\nCVE-2026-65409: Bruce Dang of Calif.io in collaboration with Claude and\nAnthropic Research\n\nGraphics\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-84492: Tommy DeVoss from Braze Security Team (@thedawgyg),\nJiyong Yang\n\nHeimdal\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An attacker in a privileged network position may be able to\nmodify network traffic\nDescription: A cryptographic issue was addressed with improved integrity\nchecks.\nCVE-2026-84533: Vishal Patidar, Roman Zabicki\n\nImageIO\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing a maliciously crafted image may result in disclosure\nof process memory\nDescription: An uninitialized memory issue was addressed with improved\nmemory initialization.\nCVE-2026-84564: Justin O\u0027Leary\n\nImageIO\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing an image may lead to a denial-of-service\nDescription: The issue was addressed with improved checks.\nCVE-2026-65347: Geonha Lee (@leegn4a)\n\nImageIO\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing an image may lead to arbitrary code execution\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-65346: Meta Red Team X - Nik Tsytsarkin\n\nImageIO\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing a maliciously crafted image may result in memory\ncorruption\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-65395: Mateusz Jurczyk of Google Project Zero, Varik Matevosyan\n\nIOKit\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28969: Mihalis Haatainen, Ashish Kunwar, Ari Hawking, \uc774\uc7ac\uc601\n\nIOMobileFrameBuffer\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-65398: Chris Bailey - Short Circuit, Mustafa Calap (@ordinal0,\ndbg.re), David Strnadel, Meta Red Team X - Nik Tsytsarkin\nCVE-2026-64736: Ruslan Dautov, hxr1\n\nIOSurfaceAccelerator\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to leak sensitive kernel state\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-64760: an anonymous researcher, Seiji Sakurai (@HeapSmasher),\nFranco Belman at Blackwing Intelligence\n\nKernel\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-28968: genter0, Svetoslav Stolarov \u0026 Aisa Fox, Josh Maine of\nCalif.io, Dun\n\nKernel\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: A local user may be able to cause unexpected system termination\nor read kernel memory\nDescription: A race condition was addressed with additional validation.\nCVE-2026-65415: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-65343: Drinor Selmanaj (Sentry), Surya Narayan Kushwaha\n\nKernel\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause unexpected system termination or\nread kernel memory\nDescription: An out-of-bounds read was addressed with improved input\nvalidation.\nCVE-2026-65349: an anonymous researcher\n\nKernel\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: A double free issue was addressed with improved memory\nmanagement.\nCVE-2026-84561: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd., Bhaswanth Chigurupati\n\nKernel\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-84630: Tristan Madani (@TristanInSec) from Talence Security\nCVE-2026-"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T04:57:30Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/58"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/58"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/149036"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/58"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-09-14-2026-6 tvOS 27",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-28935",
"type": "related"
},
{
"destId": "CVE-2026-28966",
"type": "related"
},
{
"destId": "CVE-2026-28968",
"type": "related"
},
{
"destId": "CVE-2026-28969",
"type": "related"
},
{
"destId": "CVE-2026-43664",
"type": "related"
},
{
"destId": "CVE-2026-43686",
"type": "related"
},
{
"destId": "CVE-2026-43687",
"type": "related"
},
{
"destId": "CVE-2026-43695",
"type": "related"
},
{
"destId": "CVE-2026-43737",
"type": "related"
},
{
"destId": "CVE-2026-43785",
"type": "related"
},
{
"destId": "CVE-2026-43794",
"type": "related"
},
{
"destId": "CVE-2026-64715",
"type": "related"
},
{
"destId": "CVE-2026-64736",
"type": "related"
},
{
"destId": "CVE-2026-64753",
"type": "related"
},
{
"destId": "CVE-2026-64760",
"type": "related"
},
{
"destId": "CVE-2026-64778",
"type": "related"
},
{
"destId": "CVE-2026-64787",
"type": "related"
},
{
"destId": "CVE-2026-65330",
"type": "related"
},
{
"destId": "CVE-2026-65339",
"type": "related"
},
{
"destId": "CVE-2026-65341",
"type": "related"
},
{
"destId": "CVE-2026-65343",
"type": "related"
},
{
"destId": "CVE-2026-65344",
"type": "related"
},
{
"destId": "CVE-2026-65346",
"type": "related"
},
{
"destId": "CVE-2026-65347",
"type": "related"
},
{
"destId": "CVE-2026-65349",
"type": "related"
},
{
"destId": "CVE-2026-65358",
"type": "related"
},
{
"destId": "CVE-2026-65359",
"type": "related"
},
{
"destId": "CVE-2026-65360",
"type": "related"
},
{
"destId": "CVE-2026-65377",
"type": "related"
},
{
"destId": "CVE-2026-65390",
"type": "related"
},
{
"destId": "CVE-2026-65391",
"type": "related"
},
{
"destId": "CVE-2026-65395",
"type": "related"
},
{
"destId": "CVE-2026-65398",
"type": "related"
},
{
"destId": "CVE-2026-65402",
"type": "related"
},
{
"destId": "CVE-2026-65405",
"type": "related"
},
{
"destId": "CVE-2026-65406",
"type": "related"
},
{
"destId": "CVE-2026-65407",
"type": "related"
},
{
"destId": "CVE-2026-65409",
"type": "related"
},
{
"destId": "CVE-2026-65410",
"type": "related"
},
{
"destId": "CVE-2026-65414",
"type": "related"
},
{
"destId": "CVE-2026-65415",
"type": "related"
},
{
"destId": "CVE-2026-84487",
"type": "related"
},
{
"destId": "CVE-2026-84491",
"type": "related"
},
{
"destId": "CVE-2026-84492",
"type": "related"
},
{
"destId": "CVE-2026-84497",
"type": "related"
},
{
"destId": "CVE-2026-84507",
"type": "related"
},
{
"destId": "CVE-2026-84511",
"type": "related"
},
{
"destId": "CVE-2026-84513",
"type": "related"
},
{
"destId": "CVE-2026-84523",
"type": "related"
},
{
"destId": "CVE-2026-84524",
"type": "related"
},
{
"destId": "CVE-2026-84526",
"type": "related"
},
{
"destId": "CVE-2026-84527",
"type": "related"
},
{
"destId": "CVE-2026-84530",
"type": "related"
},
{
"destId": "CVE-2026-84532",
"type": "related"
},
{
"destId": "CVE-2026-84533",
"type": "related"
},
{
"destId": "CVE-2026-84546",
"type": "related"
},
{
"destId": "CVE-2026-84560",
"type": "related"
},
{
"destId": "CVE-2026-84561",
"type": "related"
},
{
"destId": "CVE-2026-84564",
"type": "related"
},
{
"destId": "CVE-2026-84571",
"type": "related"
},
{
"destId": "CVE-2026-84575",
"type": "related"
},
{
"destId": "CVE-2026-84583",
"type": "related"
},
{
"destId": "CVE-2026-84596",
"type": "related"
},
{
"destId": "CVE-2026-84597",
"type": "related"
},
{
"destId": "CVE-2026-84600",
"type": "related"
},
{
"destId": "CVE-2026-84602",
"type": "related"
},
{
"destId": "CVE-2026-84607",
"type": "related"
},
{
"destId": "CVE-2026-84609",
"type": "related"
},
{
"destId": "CVE-2026-84611",
"type": "related"
},
{
"destId": "CVE-2026-84612",
"type": "related"
},
{
"destId": "CVE-2026-84615",
"type": "related"
},
{
"destId": "CVE-2026-84616",
"type": "related"
},
{
"destId": "CVE-2026-84617",
"type": "related"
},
{
"destId": "CVE-2026-84620",
"type": "related"
},
{
"destId": "CVE-2026-84622",
"type": "related"
},
{
"destId": "CVE-2026-84626",
"type": "related"
},
{
"destId": "CVE-2026-84628",
"type": "related"
},
{
"destId": "CVE-2026-84629",
"type": "related"
},
{
"destId": "CVE-2026-84630",
"type": "related"
},
{
"destId": "CVE-2026-84632",
"type": "related"
},
{
"destId": "CVE-2026-84635",
"type": "related"
},
{
"destId": "CVE-2026-84636",
"type": "related"
},
{
"destId": "CVE-2026-86881",
"type": "related"
},
{
"destId": "CVE-2026-86882",
"type": "related"
},
{
"destId": "CVE-2026-86884",
"type": "related"
},
{
"destId": "CVE-2026-86888",
"type": "related"
},
{
"destId": "CVE-2026-86893",
"type": "related"
},
{
"destId": "CVE-2026-86895",
"type": "related"
},
{
"destId": "CVE-2026-86903",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0396",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/58",
"automated": true,
"contentSha256": "17dd0ec9f57afe1ffc10461f3711f60920deb25f184989429dfef2ad399bdd83",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/58",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-09-14T22:08:11Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0396"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-10-02T04:57:30Z",
"dateUpdated": "2026-10-02T04:57:30Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0396"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0397
Vulnerability from gna-1988 – Published: 2026-10-02 04:57 – Updated: 2026-10-02 04:57
VLAI
EPSS
VEX
Title
APPLE-SA-09-14-2026-7 watchOS 27
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-09-14-2026-7 watchOS 27
watchOS 27 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149037.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accelerate Framework
Available for: Apple Watch Series 9 and later
Impact: Processing a maliciously crafted image may lead to unexpected
process termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-86882: Peter Malone
Accessibility
Available for: Apple Watch Series 9 and later
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved data protection.
CVE-2026-43664: Stuart Wallace, Ilya Andr (andrd3v), Rosyna Keller of
Totally Not Malicious Software, CJ Vana, David Strnadel, Daniel Febrero,
Asaf Cohen, Gongyu Ma (@Mezone0), Jian Lee (@speedyfriend433)
APFS
Available for: Apple Watch Series 9 and later
Impact: An app may be able to cause unexpected system termination or
write kernel memory
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84523: Cem Onat Karagun, an anonymous researcher
App Store
Available for: Apple Watch Series 9 and later
Impact: A local app may be able to read a persistent account identifier
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-86888: Zhongcheng Li (CK01)
Apple Account
Available for: Apple Watch Series 9 and later
Impact: A malicious application may be able to leak sensitive user
information
Description: An information disclosure issue was addressed with improved
state management.
CVE-2026-84586: Prashan Samarathunge, Zhongcheng Li (CK01)
AppleAVD
Available for: Apple Watch Series 9 and later
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-65407: Franco Belman at Blackwing Intelligence
Audio
Available for: Apple Watch Series 9 and later
Impact: An app may be able to leak sensitive user information
Description: A logic issue was addressed with improved checks.
CVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik
Tsytsarkin
AuthKit
Available for: Apple Watch Series 9 and later
Impact: A local app may be able to read a persistent account identifier
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-84583: Zhongcheng Li from IES Red Team
AVEVideoEncoder
Available for: Apple Watch Series 9 and later
Impact: An app may be able to cause unexpected system termination
Description: The issue was addressed with improved checks.
CVE-2026-65410: Calif.io in collaboration with Claude and Anthropic
Research
AVEVideoEncoder
Available for: Apple Watch Series 9 and later
Impact: An app may be able to cause unexpected system termination
Description: A type confusion issue was addressed with improved memory
handling.
CVE-2026-84616: Peter Malone
AVEVideoEncoder
Available for: Apple Watch Series 9 and later
Impact: A sandboxed app may be able to execute arbitrary code with
kernel privileges
Description: A race condition was addressed with improved state
management.
CVE-2026-84607: Ruslan Dautov
Bluetooth
Available for: Apple Watch Series 9 and later
Impact: A remote attacker may be able to cause unexpected app
termination or arbitrary code execution
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-65414
Bluetooth
Available for: Apple Watch Series 9 and later
Impact: An app may gain unauthorized access to Bluetooth
Description: An authorization issue was addressed with improved state
management.
CVE-2026-84560: an anonymous researcher
CloudKit
Available for: Apple Watch Series 9 and later
Impact: A local app may be able to read a persistent account identifier
Description: An information disclosure issue was addressed with improved
state management.
CVE-2026-86895: Stanislav Jelezoglo
CloudKit
Available for: Apple Watch Series 9 and later
Impact: An app may be able to read device name
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-86893: Heiner Gerdes
copyfile
Available for: Apple Watch Series 9 and later
Impact: An archive may be able to bypass Gatekeeper
Description: A file quarantine bypass was addressed with additional
checks.
CVE-2026-65399: Rishabh Jain (rjcyber) of cyberplanet, Pasquale Scola,
an anonymous researcher
Core Bluetooth
Available for: Apple Watch Series 9 and later
Impact: An app may be able to access Bluetooth device information
Description: An authorization issue was addressed with improved state
management.
CVE-2026-86891: Dawuge of Shuffle Team
CoreMedia
Available for: Apple Watch Series 9 and later
Impact: A sandboxed process may be able to circumvent sandbox
restrictions
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-86876: Chris Bailey - Short Circuit
CoreMotion
Available for: Apple Watch Series 9 and later
Impact: An app may be able to access motion data from headphones without
user consent
Description: An authorization issue was addressed with improved
validation.
CVE-2026-43737: Stuart Wallace
CoreText
Available for: Apple Watch Series 9 and later
Impact: Processing web content may lead to a denial-of-service
Description: A null pointer dereference was addressed with improved
input validation.
CVE-2026-65412: Pavan Nallamothu
CoreText
Available for: Apple Watch Series 9 and later
Impact: Processing a maliciously crafted font may result in the
disclosure of process memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-84596: ret2happy, Meta Product Security
CoreUI
Available for: Apple Watch Series 9 and later
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84575: Mustafa Calap (@ordinal0, dbg.re)
CoreUI
Available for: Apple Watch Series 9 and later
Impact: Processing a maliciously crafted image may lead to unexpected
app termination
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-84571: stratan (@5tratan), Peter Malone
CoreUI
Available for: Apple Watch Series 9 and later
Impact: Processing a maliciously crafted asset catalog may lead to
unexpected process termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84511: Rahul Raj, stratan (@5tratan)
DeviceCheck
Available for: Apple Watch Series 9 and later
Impact: An app may be able to read persistent device identifiers
Description: An authorization issue was addressed with improved access
control.
CVE-2026-84612: N.M.Praveen Nawarathne (@zblockrat), James Gill
(@jjtech@infosec.exchange)
FontParser
Available for: Apple Watch Series 9 and later
Impact: Processing a maliciously crafted font file may lead to
unexpected app termination
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-84524: an anonymous researcher
FontParser
Available for: Apple Watch Series 9 and later
Impact: Processing a maliciously crafted font may result in the
disclosure of process memory
Description: An out-of-bounds read issue was addressed with improved
input validation.
CVE-2026-84597: Nik Tsytsarkin
Foundation
Available for: Apple Watch Series 9 and later
Impact: An app may be able to cause a denial of service
Description: A type confusion issue was addressed with improved memory
handling.
CVE-2026-65409: Bruce Dang of Calif.io in collaboration with Claude and
Anthropic Research
Graphics
Available for: Apple Watch Series 9 and later
Impact: An app may be able to cause unexpected system termination
Description: A race condition was addressed with improved state
handling.
CVE-2026-84492: Tommy DeVoss from Braze Security Team (@thedawgyg),
Jiyong Yang
Heimdal
Available for: Apple Watch Series 9 and later
Impact: An attacker in a privileged network position may be able to
modify network traffic
Description: A cryptographic issue was addressed with improved integrity
checks.
CVE-2026-84533: Vishal Patidar, Roman Zabicki
ImageIO
Available for: Apple Watch Series 9 and later
Impact: Processing a maliciously crafted image may result in disclosure
of process memory
Description: An uninitialized memory issue was addressed with improved
memory initialization.
CVE-2026-84564: Justin O'Leary
ImageIO
Available for: Apple Watch Series 9 and later
Impact: Processing an image may lead to a denial-of-service
Description: The issue was addressed with improved checks.
CVE-2026-65347: Geonha Lee (@leegn4a)
ImageIO
Available for: Apple Watch Series 9 and later
Impact: Processing an image may lead to arbitrary code execution
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-65346: Meta Red Team X - Nik Tsytsarkin
IOGPUFamily
Available for: Apple Watch Series 9 and later
Impact: Processing maliciously crafted web content may lead to memory
corruption
Description: The issue was addressed with improved memory handling.
CVE-2026-64788: an anonymous researcher, f00l (@PPPF00L) and
3ndy1(@_3ndy1) and Minghao Lin@Y1nkoc and 云散花折, Arjanit Isufi
IOKit
Available for: Apple Watch Series 9 and later
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-28969: Mihalis Haatainen, Ashish Kunwar, Ari Hawking, 이재영
IOMobileFrameBuffer
Available for: Apple Watch Series 9 and later
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: An out-of-bounds access issue was addressed with improved
bounds checking.
CVE-2026-65398: Chris Bailey - Short Circuit, Mustafa Calap (@ordinal0,
dbg.re), David Strnadel, Meta Red Team X - Nik Tsytsarkin
CVE-2026-64736: Ruslan Dautov, hxr1
IOSurfaceAccelerator
Available for: Apple Watch Series 9 and later
Impact: An app may be able to leak sensitive kernel state
Description: An information leakage was addressed with additional
validation.
CVE-2026-64760: an anonymous researcher, Seiji Sakurai (@HeapSmasher),
Franco Belman at Blackwing Intelligence
Kernel
Available for: Apple Watch Series 9 and later
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-28968: genter0, Svetoslav Stolarov & Aisa Fox, Josh Maine of
Calif.io, Dun
Kernel
Available for: Apple Watch Series 9 and later
Impact: A local user may be able to cause unexpected system termination
or read kernel memory
Description: A race condition was addressed with additional validation.
CVE-2026-65415: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)
of STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)
Kernel
Available for: Apple Watch Series 9 and later
Impact: A remote attacker may be able to cause unexpected system
termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-65343: Drinor Selmanaj (Sentry), Surya Narayan Kushwaha
Kernel
Available for: Apple Watch Series 9 and later
Impact: An app may be able to cause unexpected system termination or
read kernel memory
Description: An out-of-bounds read was addressed with improved input
validation.
CVE-2026-65349: an anonymous researcher
Kernel
Available for: Apple Watch Series 9 and later
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: A double free issue was addressed with improved memory
management.
CVE-2026-84561: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)
of STAR Labs SG Pte. Ltd., Bhaswanth Chi
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| unknown | watchOS 27 |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0397 (this record)
- related CVE-2026-28935
- related CVE-2026-28968
- related CVE-2026-28969
- related CVE-2026-43664
- related CVE-2026-43686
- related CVE-2026-43687
- related CVE-2026-43695
- related CVE-2026-43737
- related CVE-2026-43794
- related CVE-2026-64715
- related CVE-2026-64736
- related CVE-2026-64753
- related CVE-2026-64760
- related CVE-2026-64778
- related CVE-2026-64787
- related CVE-2026-64788
- related CVE-2026-65330
- related CVE-2026-65339
- related CVE-2026-65341
- related CVE-2026-65343
- related CVE-2026-65346
- related CVE-2026-65347
- related CVE-2026-65349
- related CVE-2026-65358
- related CVE-2026-65359
- related CVE-2026-65360
- related CVE-2026-65377
- related CVE-2026-65390
- related CVE-2026-65391
- related CVE-2026-65398
- related CVE-2026-65399
- related CVE-2026-65402
- related CVE-2026-65403
- related CVE-2026-65405
- related CVE-2026-65407
- related CVE-2026-65409
- related CVE-2026-65410
- related CVE-2026-65412
- related CVE-2026-65414
- related CVE-2026-65415
- related CVE-2026-84487
- related CVE-2026-84491
- related CVE-2026-84492
- related CVE-2026-84507
- related CVE-2026-84511
- related CVE-2026-84513
- related CVE-2026-84523
- related CVE-2026-84524
- related CVE-2026-84526
- related CVE-2026-84527
- related CVE-2026-84530
- related CVE-2026-84533
- related CVE-2026-84546
- related CVE-2026-84551
- related CVE-2026-84560
- related CVE-2026-84561
- related CVE-2026-84564
- related CVE-2026-84571
- related CVE-2026-84575
- related CVE-2026-84583
- related CVE-2026-84586
- related CVE-2026-84596
- related CVE-2026-84597
- related CVE-2026-84600
- related CVE-2026-84602
- related CVE-2026-84603
- related CVE-2026-84607
- related CVE-2026-84609
- related CVE-2026-84611
- related CVE-2026-84612
- related CVE-2026-84616
- related CVE-2026-84620
- related CVE-2026-84622
- related CVE-2026-84625
- related CVE-2026-84626
- related CVE-2026-84628
- related CVE-2026-84629
- related CVE-2026-84630
- related CVE-2026-84632
- related CVE-2026-84635
- related CVE-2026-84636
- related CVE-2026-86870
- related CVE-2026-86876
- related CVE-2026-86881
- related CVE-2026-86882
- related CVE-2026-86884
- related CVE-2026-86886
- related CVE-2026-86888
- related CVE-2026-86891
- related CVE-2026-86893
- related CVE-2026-86895
- related CVE-2026-86903
- related CVE-2026-86904
{
"containers": {
"cna": {
"affected": [
{
"product": "watchOS 27",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-09-14-2026-7 watchOS 27\n\nwatchOS 27 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/149037.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccelerate Framework\nAvailable for: Apple Watch Series 9 and later\nImpact: Processing a maliciously crafted image may lead to unexpected\nprocess termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-86882: Peter Malone\n\nAccessibility\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43664: Stuart Wallace, Ilya Andr (andrd3v), Rosyna Keller of\nTotally Not Malicious Software, CJ Vana, David Strnadel, Daniel Febrero,\nAsaf Cohen, Gongyu Ma (@Mezone0), Jian Lee (@speedyfriend433)\n\nAPFS\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84523: Cem Onat Karagun, an anonymous researcher\n\nApp Store\nAvailable for: Apple Watch Series 9 and later\nImpact: A local app may be able to read a persistent account identifier\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-86888: Zhongcheng Li (CK01)\n\nApple Account\nAvailable for: Apple Watch Series 9 and later\nImpact: A malicious application may be able to leak sensitive user\ninformation\nDescription: An information disclosure issue was addressed with improved\nstate management.\nCVE-2026-84586: Prashan Samarathunge, Zhongcheng Li (CK01)\n\nAppleAVD\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-65407: Franco Belman at Blackwing Intelligence\n\nAudio\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to leak sensitive user information\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik\nTsytsarkin\n\nAuthKit\nAvailable for: Apple Watch Series 9 and later\nImpact: A local app may be able to read a persistent account identifier\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-84583: Zhongcheng Li from IES Red Team\n\nAVEVideoEncoder\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: The issue was addressed with improved checks.\nCVE-2026-65410: Calif.io in collaboration with Claude and Anthropic\nResearch\n\nAVEVideoEncoder\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A type confusion issue was addressed with improved memory\nhandling.\nCVE-2026-84616: Peter Malone\n\nAVEVideoEncoder\nAvailable for: Apple Watch Series 9 and later\nImpact: A sandboxed app may be able to execute arbitrary code with\nkernel privileges\nDescription: A race condition was addressed with improved state\nmanagement.\nCVE-2026-84607: Ruslan Dautov\n\nBluetooth\nAvailable for: Apple Watch Series 9 and later\nImpact: A remote attacker may be able to cause unexpected app\ntermination or arbitrary code execution\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-65414\n\nBluetooth\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may gain unauthorized access to Bluetooth\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-84560: an anonymous researcher\n\nCloudKit\nAvailable for: Apple Watch Series 9 and later\nImpact: A local app may be able to read a persistent account identifier\nDescription: An information disclosure issue was addressed with improved\nstate management.\nCVE-2026-86895: Stanislav Jelezoglo\n\nCloudKit\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to read device name\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-86893: Heiner Gerdes\n\ncopyfile\nAvailable for: Apple Watch Series 9 and later\nImpact: An archive may be able to bypass Gatekeeper\nDescription: A file quarantine bypass was addressed with additional\nchecks.\nCVE-2026-65399: Rishabh Jain (rjcyber) of cyberplanet, Pasquale Scola,\nan anonymous researcher\n\nCore Bluetooth\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to access Bluetooth device information\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-86891: Dawuge of Shuffle Team\n\nCoreMedia\nAvailable for: Apple Watch Series 9 and later\nImpact: A sandboxed process may be able to circumvent sandbox\nrestrictions\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-86876: Chris Bailey - Short Circuit\n\nCoreMotion\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to access motion data from headphones without\nuser consent\nDescription: An authorization issue was addressed with improved\nvalidation.\nCVE-2026-43737: Stuart Wallace\n\nCoreText\nAvailable for: Apple Watch Series 9 and later\nImpact: Processing web content may lead to a denial-of-service\nDescription: A null pointer dereference was addressed with improved\ninput validation.\nCVE-2026-65412: Pavan Nallamothu\n\nCoreText\nAvailable for: Apple Watch Series 9 and later\nImpact: Processing a maliciously crafted font may result in the\ndisclosure of process memory\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-84596: ret2happy, Meta Product Security\n\nCoreUI\nAvailable for: Apple Watch Series 9 and later\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84575: Mustafa Calap (@ordinal0, dbg.re)\n\nCoreUI\nAvailable for: Apple Watch Series 9 and later\nImpact: Processing a maliciously crafted image may lead to unexpected\napp termination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-84571: stratan (@5tratan), Peter Malone\n\nCoreUI\nAvailable for: Apple Watch Series 9 and later\nImpact: Processing a maliciously crafted asset catalog may lead to\nunexpected process termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84511: Rahul Raj, stratan (@5tratan)\n\nDeviceCheck\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to read persistent device identifiers\nDescription: An authorization issue was addressed with improved access\ncontrol.\nCVE-2026-84612: N.M.Praveen Nawarathne (@zblockrat), James Gill\n(@jjtech@infosec.exchange)\n\nFontParser\nAvailable for: Apple Watch Series 9 and later\nImpact: Processing a maliciously crafted font file may lead to\nunexpected app termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-84524: an anonymous researcher\n\nFontParser\nAvailable for: Apple Watch Series 9 and later\nImpact: Processing a maliciously crafted font may result in the\ndisclosure of process memory\nDescription: An out-of-bounds read issue was addressed with improved\ninput validation.\nCVE-2026-84597: Nik Tsytsarkin\n\nFoundation\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to cause a denial of service\nDescription: A type confusion issue was addressed with improved memory\nhandling.\nCVE-2026-65409: Bruce Dang of Calif.io in collaboration with Claude and\nAnthropic Research\n\nGraphics\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-84492: Tommy DeVoss from Braze Security Team (@thedawgyg),\nJiyong Yang\n\nHeimdal\nAvailable for: Apple Watch Series 9 and later\nImpact: An attacker in a privileged network position may be able to\nmodify network traffic\nDescription: A cryptographic issue was addressed with improved integrity\nchecks.\nCVE-2026-84533: Vishal Patidar, Roman Zabicki\n\nImageIO\nAvailable for: Apple Watch Series 9 and later\nImpact: Processing a maliciously crafted image may result in disclosure\nof process memory\nDescription: An uninitialized memory issue was addressed with improved\nmemory initialization.\nCVE-2026-84564: Justin O\u0027Leary\n\nImageIO\nAvailable for: Apple Watch Series 9 and later\nImpact: Processing an image may lead to a denial-of-service\nDescription: The issue was addressed with improved checks.\nCVE-2026-65347: Geonha Lee (@leegn4a)\n\nImageIO\nAvailable for: Apple Watch Series 9 and later\nImpact: Processing an image may lead to arbitrary code execution\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-65346: Meta Red Team X - Nik Tsytsarkin\n\nIOGPUFamily\nAvailable for: Apple Watch Series 9 and later\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64788: an anonymous researcher, f00l (@PPPF00L) and\n3ndy1(@_3ndy1) and Minghao Lin@Y1nkoc and \u4e91\u6563\u82b1\u6298, Arjanit Isufi\n\nIOKit\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28969: Mihalis Haatainen, Ashish Kunwar, Ari Hawking, \uc774\uc7ac\uc601\n\nIOMobileFrameBuffer\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-65398: Chris Bailey - Short Circuit, Mustafa Calap (@ordinal0,\ndbg.re), David Strnadel, Meta Red Team X - Nik Tsytsarkin\nCVE-2026-64736: Ruslan Dautov, hxr1\n\nIOSurfaceAccelerator\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to leak sensitive kernel state\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-64760: an anonymous researcher, Seiji Sakurai (@HeapSmasher),\nFranco Belman at Blackwing Intelligence\n\nKernel\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-28968: genter0, Svetoslav Stolarov \u0026 Aisa Fox, Josh Maine of\nCalif.io, Dun\n\nKernel\nAvailable for: Apple Watch Series 9 and later\nImpact: A local user may be able to cause unexpected system termination\nor read kernel memory\nDescription: A race condition was addressed with additional validation.\nCVE-2026-65415: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: Apple Watch Series 9 and later\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-65343: Drinor Selmanaj (Sentry), Surya Narayan Kushwaha\n\nKernel\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to cause unexpected system termination or\nread kernel memory\nDescription: An out-of-bounds read was addressed with improved input\nvalidation.\nCVE-2026-65349: an anonymous researcher\n\nKernel\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: A double free issue was addressed with improved memory\nmanagement.\nCVE-2026-84561: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd., Bhaswanth Chi"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T04:57:31Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/59"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/59"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/149037"
},
{
"url": "https://support.apple.com/kb/HT204641"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/59"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-09-14-2026-7 watchOS 27",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-28935",
"type": "related"
},
{
"destId": "CVE-2026-28968",
"type": "related"
},
{
"destId": "CVE-2026-28969",
"type": "related"
},
{
"destId": "CVE-2026-43664",
"type": "related"
},
{
"destId": "CVE-2026-43686",
"type": "related"
},
{
"destId": "CVE-2026-43687",
"type": "related"
},
{
"destId": "CVE-2026-43695",
"type": "related"
},
{
"destId": "CVE-2026-43737",
"type": "related"
},
{
"destId": "CVE-2026-43794",
"type": "related"
},
{
"destId": "CVE-2026-64715",
"type": "related"
},
{
"destId": "CVE-2026-64736",
"type": "related"
},
{
"destId": "CVE-2026-64753",
"type": "related"
},
{
"destId": "CVE-2026-64760",
"type": "related"
},
{
"destId": "CVE-2026-64778",
"type": "related"
},
{
"destId": "CVE-2026-64787",
"type": "related"
},
{
"destId": "CVE-2026-64788",
"type": "related"
},
{
"destId": "CVE-2026-65330",
"type": "related"
},
{
"destId": "CVE-2026-65339",
"type": "related"
},
{
"destId": "CVE-2026-65341",
"type": "related"
},
{
"destId": "CVE-2026-65343",
"type": "related"
},
{
"destId": "CVE-2026-65346",
"type": "related"
},
{
"destId": "CVE-2026-65347",
"type": "related"
},
{
"destId": "CVE-2026-65349",
"type": "related"
},
{
"destId": "CVE-2026-65358",
"type": "related"
},
{
"destId": "CVE-2026-65359",
"type": "related"
},
{
"destId": "CVE-2026-65360",
"type": "related"
},
{
"destId": "CVE-2026-65377",
"type": "related"
},
{
"destId": "CVE-2026-65390",
"type": "related"
},
{
"destId": "CVE-2026-65391",
"type": "related"
},
{
"destId": "CVE-2026-65398",
"type": "related"
},
{
"destId": "CVE-2026-65399",
"type": "related"
},
{
"destId": "CVE-2026-65402",
"type": "related"
},
{
"destId": "CVE-2026-65403",
"type": "related"
},
{
"destId": "CVE-2026-65405",
"type": "related"
},
{
"destId": "CVE-2026-65407",
"type": "related"
},
{
"destId": "CVE-2026-65409",
"type": "related"
},
{
"destId": "CVE-2026-65410",
"type": "related"
},
{
"destId": "CVE-2026-65412",
"type": "related"
},
{
"destId": "CVE-2026-65414",
"type": "related"
},
{
"destId": "CVE-2026-65415",
"type": "related"
},
{
"destId": "CVE-2026-84487",
"type": "related"
},
{
"destId": "CVE-2026-84491",
"type": "related"
},
{
"destId": "CVE-2026-84492",
"type": "related"
},
{
"destId": "CVE-2026-84507",
"type": "related"
},
{
"destId": "CVE-2026-84511",
"type": "related"
},
{
"destId": "CVE-2026-84513",
"type": "related"
},
{
"destId": "CVE-2026-84523",
"type": "related"
},
{
"destId": "CVE-2026-84524",
"type": "related"
},
{
"destId": "CVE-2026-84526",
"type": "related"
},
{
"destId": "CVE-2026-84527",
"type": "related"
},
{
"destId": "CVE-2026-84530",
"type": "related"
},
{
"destId": "CVE-2026-84533",
"type": "related"
},
{
"destId": "CVE-2026-84546",
"type": "related"
},
{
"destId": "CVE-2026-84551",
"type": "related"
},
{
"destId": "CVE-2026-84560",
"type": "related"
},
{
"destId": "CVE-2026-84561",
"type": "related"
},
{
"destId": "CVE-2026-84564",
"type": "related"
},
{
"destId": "CVE-2026-84571",
"type": "related"
},
{
"destId": "CVE-2026-84575",
"type": "related"
},
{
"destId": "CVE-2026-84583",
"type": "related"
},
{
"destId": "CVE-2026-84586",
"type": "related"
},
{
"destId": "CVE-2026-84596",
"type": "related"
},
{
"destId": "CVE-2026-84597",
"type": "related"
},
{
"destId": "CVE-2026-84600",
"type": "related"
},
{
"destId": "CVE-2026-84602",
"type": "related"
},
{
"destId": "CVE-2026-84603",
"type": "related"
},
{
"destId": "CVE-2026-84607",
"type": "related"
},
{
"destId": "CVE-2026-84609",
"type": "related"
},
{
"destId": "CVE-2026-84611",
"type": "related"
},
{
"destId": "CVE-2026-84612",
"type": "related"
},
{
"destId": "CVE-2026-84616",
"type": "related"
},
{
"destId": "CVE-2026-84620",
"type": "related"
},
{
"destId": "CVE-2026-84622",
"type": "related"
},
{
"destId": "CVE-2026-84625",
"type": "related"
},
{
"destId": "CVE-2026-84626",
"type": "related"
},
{
"destId": "CVE-2026-84628",
"type": "related"
},
{
"destId": "CVE-2026-84629",
"type": "related"
},
{
"destId": "CVE-2026-84630",
"type": "related"
},
{
"destId": "CVE-2026-84632",
"type": "related"
},
{
"destId": "CVE-2026-84635",
"type": "related"
},
{
"destId": "CVE-2026-84636",
"type": "related"
},
{
"destId": "CVE-2026-86870",
"type": "related"
},
{
"destId": "CVE-2026-86876",
"type": "related"
},
{
"destId": "CVE-2026-86881",
"type": "related"
},
{
"destId": "CVE-2026-86882",
"type": "related"
},
{
"destId": "CVE-2026-86884",
"type": "related"
},
{
"destId": "CVE-2026-86886",
"type": "related"
},
{
"destId": "CVE-2026-86888",
"type": "related"
},
{
"destId": "CVE-2026-86891",
"type": "related"
},
{
"destId": "CVE-2026-86893",
"type": "related"
},
{
"destId": "CVE-2026-86895",
"type": "related"
},
{
"destId": "CVE-2026-86903",
"type": "related"
},
{
"destId": "CVE-2026-86904",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0397",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/59",
"automated": true,
"contentSha256": "f0f79b792a59ca091ec420d4f64d4e732790c665263927591be75cdc976fe162",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/59",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-09-14T22:09:02Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0397"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-10-02T04:57:31Z",
"dateUpdated": "2026-10-02T04:57:31Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0397"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0398
Vulnerability from gna-1988 – Published: 2026-10-02 04:57 – Updated: 2026-10-02 04:57
VLAI
EPSS
VEX
Title
APPLE-SA-09-14-2026-8 visionOS 27
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-09-14-2026-8 visionOS 27
visionOS 27 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149038.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accelerate Framework
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted image may lead to unexpected
process termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-86882: Peter Malone
APFS
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause unexpected system termination or
write kernel memory
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84523: Cem Onat Karagun, an anonymous researcher
App Store
Available for: Apple Vision Pro (all models)
Impact: A local app may be able to read a persistent account identifier
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-86888: Zhongcheng Li (CK01)
Apple Account
Available for: Apple Vision Pro (all models)
Impact: An app may be able to use the Sign In With Apple authentication
flow to access the user's Apple Account
Description: An authentication issue was addressed with improved state
management.
CVE-2026-20683: Dem0ns (@天府简易信工作室), Abdelhak Kherroubi, Jasminder Pal
Singh, Lehan Dilusha Jayasingha (Sri Lanka)
AppleAVD
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-65407: Franco Belman at Blackwing Intelligence
Audio
Available for: Apple Vision Pro (all models)
Impact: An app may be able to leak sensitive user information
Description: A logic issue was addressed with improved checks.
CVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik
Tsytsarkin
Authentication Services
Available for: Apple Vision Pro (all models)
Impact: An app may be able to delete credentials stored in Keychain
Description: This issue was addressed by removing the vulnerable code.
CVE-2026-86905: Ilya Andr (andrd3v)
AuthKit
Available for: Apple Vision Pro (all models)
Impact: A local app may be able to read a persistent account identifier
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-84583: Zhongcheng Li from IES Red Team
AVEVideoEncoder
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause unexpected system termination
Description: The issue was addressed with improved checks.
CVE-2026-65410: Calif.io in collaboration with Claude and Anthropic
Research
AVEVideoEncoder
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause unexpected system termination
Description: A type confusion issue was addressed with improved memory
handling.
CVE-2026-84616: Peter Malone
AVEVideoEncoder
Available for: Apple Vision Pro (all models)
Impact: A sandboxed app may be able to execute arbitrary code with
kernel privileges
Description: A race condition was addressed with improved state
management.
CVE-2026-84607: Ruslan Dautov
BackgroundAssets
Available for: Apple Vision Pro (all models)
Impact: An app may be able to access sensitive user data
Description: A logic issue was addressed with improved validation.
CVE-2026-65406: Ye Zhang (@VAR10CK) of Baidu Security
Bluetooth
Available for: Apple Vision Pro (all models)
Impact: A remote attacker may be able to cause unexpected app
termination or arbitrary code execution
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-65414
Bluetooth
Available for: Apple Vision Pro (all models)
Impact: An app may gain unauthorized access to Bluetooth
Description: An authorization issue was addressed with improved state
management.
CVE-2026-84560: an anonymous researcher
CloudKit
Available for: Apple Vision Pro (all models)
Impact: A local app may be able to read a persistent account identifier
Description: An information disclosure issue was addressed with improved
state management.
CVE-2026-86895: Stanislav Jelezoglo
CloudKit
Available for: Apple Vision Pro (all models)
Impact: An app may be able to read device name
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-86893: Heiner Gerdes
copyfile
Available for: Apple Vision Pro (all models)
Impact: An archive may be able to bypass Gatekeeper
Description: A file quarantine bypass was addressed with additional
checks.
CVE-2026-65399: Rishabh Jain (rjcyber) of cyberplanet, Pasquale Scola,
an anonymous researcher
CoreMedia
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted image may lead to arbitrary
code execution
Description: A memory corruption issue was addressed by removing the
vulnerable code.
CVE-2026-64752: Nik Tsytsarkin
CoreMedia
Available for: Apple Vision Pro (all models)
Impact: A sandboxed process may be able to circumvent sandbox
restrictions
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-86876: Chris Bailey - Short Circuit
CoreMedia
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted video file may lead to
unexpected app termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-65344: Siyeong kim
CoreML
Available for: Apple Vision Pro (all models)
Impact: A sandboxed app may be able to access restricted files
Description: A permissions issue was addressed with improved path
validation.
CVE-2026-84624: AL Najafi, tamdao
CoreText
Available for: Apple Vision Pro (all models)
Impact: Processing web content may lead to a denial-of-service
Description: A null pointer dereference was addressed with improved
input validation.
CVE-2026-65412: Pavan Nallamothu
CoreText
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted font may result in the
disclosure of process memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-84596: ret2happy, Meta Product Security
CoreUI
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84575: Mustafa Calap (@ordinal0, dbg.re)
CoreUI
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted image may lead to unexpected
app termination
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-84571: stratan (@5tratan), Peter Malone
CoreUI
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted asset catalog may lead to
unexpected process termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84511: Rahul Raj, stratan (@5tratan)
DeviceCheck
Available for: Apple Vision Pro (all models)
Impact: An app may be able to read persistent device identifiers
Description: An authorization issue was addressed with improved access
control.
CVE-2026-84612: N.M.Praveen Nawarathne (@zblockrat), James Gill
(@jjtech@infosec.exchange)
File Bookmark
Available for: Apple Vision Pro (all models)
Impact: An app may be able to modify a file it only had permission to
read
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-43785: Junyeong Lee (jylab.github.io), Merrick Hare, Aditya
Kumar, John Nzyuko Uvyu, Narendra Singh (@_3P1C)
file_cmds
Available for: Apple Vision Pro (all models)
Impact: Extracting a maliciously crafted archive may allow an attacker
to write arbitrary files
Description: A path handling issue was addressed with improved
validation.
CVE-2026-84534: Geoffrey Lovelace
FontParser
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted font file may lead to
unexpected app termination
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-84524: an anonymous researcher
FontParser
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted font may result in the
disclosure of process memory
Description: An out-of-bounds read issue was addressed with improved
input validation.
CVE-2026-84597: Nik Tsytsarkin
Foundation
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause a denial of service
Description: A type confusion issue was addressed with improved memory
handling.
CVE-2026-65409: Bruce Dang of Calif.io in collaboration with Claude and
Anthropic Research
Graphics
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause unexpected system termination
Description: A race condition was addressed with improved state
handling.
CVE-2026-84492: Tommy DeVoss from Braze Security Team (@thedawgyg),
Jiyong Yang
iCloud
Available for: Apple Vision Pro (all models)
Impact: An app may be able to identify a user across reinstalls
Description: A privacy issue was addressed with improved handling of
identifiers.
CVE-2026-84606: Ilya Andr (andrd3v)
ImageIO
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted image may result in disclosure
of process memory
Description: An uninitialized memory issue was addressed with improved
memory initialization.
CVE-2026-84564: Justin O'Leary
ImageIO
Available for: Apple Vision Pro (all models)
Impact: Processing an image may lead to a denial-of-service
Description: The issue was addressed with improved checks.
CVE-2026-65347: Geonha Lee (@leegn4a)
ImageIO
Available for: Apple Vision Pro (all models)
Impact: Processing an image may lead to arbitrary code execution
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-65346: Meta Red Team X - Nik Tsytsarkin
ImageIO
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted image may result in memory
corruption
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-65395: Mateusz Jurczyk of Google Project Zero, Varik Matevosyan
IOGPUFamily
Available for: Apple Vision Pro (all models)
Impact: Processing maliciously crafted web content may lead to memory
corruption
Description: The issue was addressed with improved memory handling.
CVE-2026-64788: an anonymous researcher, f00l (@PPPF00L) and
3ndy1(@_3ndy1) and Minghao Lin@Y1nkoc and 云散花折, Arjanit Isufi
IOKit
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-28969: Mihalis Haatainen, Ashish Kunwar, Ari Hawking, 이재영
IOMobileFrameBuffer
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: An out-of-bounds access issue was addressed with improved
bounds checking.
CVE-2026-65398: Chris Bailey - Short Circuit, Mustafa Calap (@ordinal0,
dbg.re), David Strnadel, Meta Red Team X - Nik Tsytsarkin
CVE-2026-64736: Ruslan Dautov, hxr1
IOSurfaceAccelerator
Available for: Apple Vision Pro (all models)
Impact: An app may be able to leak sensitive kernel state
Description: An information leakage was addressed with additional
validation.
CVE-2026-64760: an anonymous researcher, Seiji Sakurai (@HeapSmasher),
Franco Belman at Blackwing Intelligence
Kernel
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-28968: genter0, Svetoslav Stolarov & Aisa Fox, Josh Maine of
Calif.io, Dun
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| unknown | visionOS 27 |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0398 (this record)
- related CVE-2026-20683
- related CVE-2026-28935
- related CVE-2026-28966
- related CVE-2026-28968
- related CVE-2026-28969
- related CVE-2026-43686
- related CVE-2026-43687
- related CVE-2026-43689
- related CVE-2026-43695
- related CVE-2026-43785
- related CVE-2026-43794
- related CVE-2026-43795
- related CVE-2026-64715
- related CVE-2026-64718
- related CVE-2026-64736
- related CVE-2026-64752
- related CVE-2026-64753
- related CVE-2026-64760
- related CVE-2026-64778
- related CVE-2026-64779
- related CVE-2026-64780
- related CVE-2026-64781
- related CVE-2026-64782
- related CVE-2026-64784
- related CVE-2026-64787
- related CVE-2026-64788
- related CVE-2026-65330
- related CVE-2026-65331
- related CVE-2026-65332
- related CVE-2026-65333
- related CVE-2026-65334
- related CVE-2026-65335
- related CVE-2026-65336
- related CVE-2026-65337
- related CVE-2026-65338
- related CVE-2026-65339
- related CVE-2026-65340
- related CVE-2026-65341
- related CVE-2026-65343
- related CVE-2026-65344
- related CVE-2026-65346
- related CVE-2026-65347
- related CVE-2026-65349
- related CVE-2026-65351
- related CVE-2026-65358
- related CVE-2026-65359
- related CVE-2026-65360
- related CVE-2026-65377
- related CVE-2026-65390
- related CVE-2026-65391
- related CVE-2026-65395
- related CVE-2026-65398
- related CVE-2026-65399
- related CVE-2026-65402
- related CVE-2026-65403
- related CVE-2026-65405
- related CVE-2026-65406
- related CVE-2026-65407
- related CVE-2026-65409
- related CVE-2026-65410
- related CVE-2026-65411
- related CVE-2026-65412
- related CVE-2026-65414
- related CVE-2026-65415
- related CVE-2026-84487
- related CVE-2026-84491
- related CVE-2026-84492
- related CVE-2026-84497
- related CVE-2026-84507
- related CVE-2026-84511
- related CVE-2026-84513
- related CVE-2026-84521
- related CVE-2026-84523
- related CVE-2026-84524
- related CVE-2026-84526
- related CVE-2026-84527
- related CVE-2026-84530
- related CVE-2026-84532
- related CVE-2026-84534
- related CVE-2026-84546
- related CVE-2026-84551
- related CVE-2026-84560
- related CVE-2026-84561
- related CVE-2026-84564
- related CVE-2026-84571
- related CVE-2026-84575
- related CVE-2026-84583
- related CVE-2026-84596
- related CVE-2026-84597
- related CVE-2026-84600
- related CVE-2026-84602
- related CVE-2026-84603
- related CVE-2026-84606
- related CVE-2026-84607
- related CVE-2026-84609
- related CVE-2026-84611
- related CVE-2026-84612
- related CVE-2026-84615
- related CVE-2026-84616
- related CVE-2026-84620
- related CVE-2026-84622
- related CVE-2026-84624
- related CVE-2026-84625
- related CVE-2026-84626
- related CVE-2026-84628
- related CVE-2026-84629
- related CVE-2026-84630
- related CVE-2026-84632
- related CVE-2026-84635
- related CVE-2026-84636
- related CVE-2026-86870
- related CVE-2026-86876
- related CVE-2026-86881
- related CVE-2026-86882
- related CVE-2026-86883
- related CVE-2026-86887
- related CVE-2026-86888
- related CVE-2026-86892
- related CVE-2026-86893
- related CVE-2026-86895
- related CVE-2026-86897
- related CVE-2026-86898
- related CVE-2026-86903
- related CVE-2026-86905
{
"containers": {
"cna": {
"affected": [
{
"product": "visionOS 27",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-09-14-2026-8 visionOS 27\n\nvisionOS 27 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/149038.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccelerate Framework\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may lead to unexpected\nprocess termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-86882: Peter Malone\n\nAPFS\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84523: Cem Onat Karagun, an anonymous researcher\n\nApp Store\nAvailable for: Apple Vision Pro (all models)\nImpact: A local app may be able to read a persistent account identifier\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-86888: Zhongcheng Li (CK01)\n\nApple Account\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to use the Sign In With Apple authentication\nflow to access the user\u0027s Apple Account\nDescription: An authentication issue was addressed with improved state\nmanagement.\nCVE-2026-20683: Dem0ns (@\u5929\u5e9c\u7b80\u6613\u4fe1\u5de5\u4f5c\u5ba4), Abdelhak Kherroubi, Jasminder Pal\nSingh, Lehan Dilusha Jayasingha (Sri Lanka)\n\nAppleAVD\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-65407: Franco Belman at Blackwing Intelligence\n\nAudio\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to leak sensitive user information\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik\nTsytsarkin\n\nAuthentication Services\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to delete credentials stored in Keychain\nDescription: This issue was addressed by removing the vulnerable code.\nCVE-2026-86905: Ilya Andr (andrd3v)\n\nAuthKit\nAvailable for: Apple Vision Pro (all models)\nImpact: A local app may be able to read a persistent account identifier\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-84583: Zhongcheng Li from IES Red Team\n\nAVEVideoEncoder\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: The issue was addressed with improved checks.\nCVE-2026-65410: Calif.io in collaboration with Claude and Anthropic\nResearch\n\nAVEVideoEncoder\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A type confusion issue was addressed with improved memory\nhandling.\nCVE-2026-84616: Peter Malone\n\nAVEVideoEncoder\nAvailable for: Apple Vision Pro (all models)\nImpact: A sandboxed app may be able to execute arbitrary code with\nkernel privileges\nDescription: A race condition was addressed with improved state\nmanagement.\nCVE-2026-84607: Ruslan Dautov\n\nBackgroundAssets\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: A logic issue was addressed with improved validation.\nCVE-2026-65406: Ye Zhang (@VAR10CK) of Baidu Security\n\nBluetooth\nAvailable for: Apple Vision Pro (all models)\nImpact: A remote attacker may be able to cause unexpected app\ntermination or arbitrary code execution\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-65414\n\nBluetooth\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may gain unauthorized access to Bluetooth\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-84560: an anonymous researcher\n\nCloudKit\nAvailable for: Apple Vision Pro (all models)\nImpact: A local app may be able to read a persistent account identifier\nDescription: An information disclosure issue was addressed with improved\nstate management.\nCVE-2026-86895: Stanislav Jelezoglo\n\nCloudKit\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to read device name\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-86893: Heiner Gerdes\n\ncopyfile\nAvailable for: Apple Vision Pro (all models)\nImpact: An archive may be able to bypass Gatekeeper\nDescription: A file quarantine bypass was addressed with additional\nchecks.\nCVE-2026-65399: Rishabh Jain (rjcyber) of cyberplanet, Pasquale Scola,\nan anonymous researcher\n\nCoreMedia\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may lead to arbitrary\ncode execution\nDescription: A memory corruption issue was addressed by removing the\nvulnerable code.\nCVE-2026-64752: Nik Tsytsarkin\n\nCoreMedia\nAvailable for: Apple Vision Pro (all models)\nImpact: A sandboxed process may be able to circumvent sandbox\nrestrictions\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-86876: Chris Bailey - Short Circuit\n\nCoreMedia\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-65344: Siyeong kim\n\nCoreML\nAvailable for: Apple Vision Pro (all models)\nImpact: A sandboxed app may be able to access restricted files\nDescription: A permissions issue was addressed with improved path\nvalidation.\nCVE-2026-84624: AL Najafi, tamdao\n\nCoreText\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing web content may lead to a denial-of-service\nDescription: A null pointer dereference was addressed with improved\ninput validation.\nCVE-2026-65412: Pavan Nallamothu\n\nCoreText\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted font may result in the\ndisclosure of process memory\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-84596: ret2happy, Meta Product Security\n\nCoreUI\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84575: Mustafa Calap (@ordinal0, dbg.re)\n\nCoreUI\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may lead to unexpected\napp termination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-84571: stratan (@5tratan), Peter Malone\n\nCoreUI\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted asset catalog may lead to\nunexpected process termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84511: Rahul Raj, stratan (@5tratan)\n\nDeviceCheck\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to read persistent device identifiers\nDescription: An authorization issue was addressed with improved access\ncontrol.\nCVE-2026-84612: N.M.Praveen Nawarathne (@zblockrat), James Gill\n(@jjtech@infosec.exchange)\n\nFile Bookmark\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to modify a file it only had permission to\nread\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-43785: Junyeong Lee (jylab.github.io), Merrick Hare, Aditya\nKumar, John Nzyuko Uvyu, Narendra Singh (@_3P1C)\n\nfile_cmds\nAvailable for: Apple Vision Pro (all models)\nImpact: Extracting a maliciously crafted archive may allow an attacker\nto write arbitrary files\nDescription: A path handling issue was addressed with improved\nvalidation.\nCVE-2026-84534: Geoffrey Lovelace\n\nFontParser\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted font file may lead to\nunexpected app termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-84524: an anonymous researcher\n\nFontParser\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted font may result in the\ndisclosure of process memory\nDescription: An out-of-bounds read issue was addressed with improved\ninput validation.\nCVE-2026-84597: Nik Tsytsarkin\n\nFoundation\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause a denial of service\nDescription: A type confusion issue was addressed with improved memory\nhandling.\nCVE-2026-65409: Bruce Dang of Calif.io in collaboration with Claude and\nAnthropic Research\n\nGraphics\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-84492: Tommy DeVoss from Braze Security Team (@thedawgyg),\nJiyong Yang\n\niCloud\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to identify a user across reinstalls\nDescription: A privacy issue was addressed with improved handling of\nidentifiers.\nCVE-2026-84606: Ilya Andr (andrd3v)\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may result in disclosure\nof process memory\nDescription: An uninitialized memory issue was addressed with improved\nmemory initialization.\nCVE-2026-84564: Justin O\u0027Leary\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing an image may lead to a denial-of-service\nDescription: The issue was addressed with improved checks.\nCVE-2026-65347: Geonha Lee (@leegn4a)\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing an image may lead to arbitrary code execution\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-65346: Meta Red Team X - Nik Tsytsarkin\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may result in memory\ncorruption\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-65395: Mateusz Jurczyk of Google Project Zero, Varik Matevosyan\n\nIOGPUFamily\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64788: an anonymous researcher, f00l (@PPPF00L) and\n3ndy1(@_3ndy1) and Minghao Lin@Y1nkoc and \u4e91\u6563\u82b1\u6298, Arjanit Isufi\n\nIOKit\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28969: Mihalis Haatainen, Ashish Kunwar, Ari Hawking, \uc774\uc7ac\uc601\n\nIOMobileFrameBuffer\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-65398: Chris Bailey - Short Circuit, Mustafa Calap (@ordinal0,\ndbg.re), David Strnadel, Meta Red Team X - Nik Tsytsarkin\nCVE-2026-64736: Ruslan Dautov, hxr1\n\nIOSurfaceAccelerator\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to leak sensitive kernel state\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-64760: an anonymous researcher, Seiji Sakurai (@HeapSmasher),\nFranco Belman at Blackwing Intelligence\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-28968: genter0, Svetoslav Stolarov \u0026 Aisa Fox, Josh Maine of\nCalif.io, Dun\n"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T04:57:32Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/60"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/60"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/149038"
},
{
"url": "https://support.apple.com/kb/HT214009"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/60"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-09-14-2026-8 visionOS 27",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-20683",
"type": "related"
},
{
"destId": "CVE-2026-28935",
"type": "related"
},
{
"destId": "CVE-2026-28966",
"type": "related"
},
{
"destId": "CVE-2026-28968",
"type": "related"
},
{
"destId": "CVE-2026-28969",
"type": "related"
},
{
"destId": "CVE-2026-43686",
"type": "related"
},
{
"destId": "CVE-2026-43687",
"type": "related"
},
{
"destId": "CVE-2026-43689",
"type": "related"
},
{
"destId": "CVE-2026-43695",
"type": "related"
},
{
"destId": "CVE-2026-43785",
"type": "related"
},
{
"destId": "CVE-2026-43794",
"type": "related"
},
{
"destId": "CVE-2026-43795",
"type": "related"
},
{
"destId": "CVE-2026-64715",
"type": "related"
},
{
"destId": "CVE-2026-64718",
"type": "related"
},
{
"destId": "CVE-2026-64736",
"type": "related"
},
{
"destId": "CVE-2026-64752",
"type": "related"
},
{
"destId": "CVE-2026-64753",
"type": "related"
},
{
"destId": "CVE-2026-64760",
"type": "related"
},
{
"destId": "CVE-2026-64778",
"type": "related"
},
{
"destId": "CVE-2026-64779",
"type": "related"
},
{
"destId": "CVE-2026-64780",
"type": "related"
},
{
"destId": "CVE-2026-64781",
"type": "related"
},
{
"destId": "CVE-2026-64782",
"type": "related"
},
{
"destId": "CVE-2026-64784",
"type": "related"
},
{
"destId": "CVE-2026-64787",
"type": "related"
},
{
"destId": "CVE-2026-64788",
"type": "related"
},
{
"destId": "CVE-2026-65330",
"type": "related"
},
{
"destId": "CVE-2026-65331",
"type": "related"
},
{
"destId": "CVE-2026-65332",
"type": "related"
},
{
"destId": "CVE-2026-65333",
"type": "related"
},
{
"destId": "CVE-2026-65334",
"type": "related"
},
{
"destId": "CVE-2026-65335",
"type": "related"
},
{
"destId": "CVE-2026-65336",
"type": "related"
},
{
"destId": "CVE-2026-65337",
"type": "related"
},
{
"destId": "CVE-2026-65338",
"type": "related"
},
{
"destId": "CVE-2026-65339",
"type": "related"
},
{
"destId": "CVE-2026-65340",
"type": "related"
},
{
"destId": "CVE-2026-65341",
"type": "related"
},
{
"destId": "CVE-2026-65343",
"type": "related"
},
{
"destId": "CVE-2026-65344",
"type": "related"
},
{
"destId": "CVE-2026-65346",
"type": "related"
},
{
"destId": "CVE-2026-65347",
"type": "related"
},
{
"destId": "CVE-2026-65349",
"type": "related"
},
{
"destId": "CVE-2026-65351",
"type": "related"
},
{
"destId": "CVE-2026-65358",
"type": "related"
},
{
"destId": "CVE-2026-65359",
"type": "related"
},
{
"destId": "CVE-2026-65360",
"type": "related"
},
{
"destId": "CVE-2026-65377",
"type": "related"
},
{
"destId": "CVE-2026-65390",
"type": "related"
},
{
"destId": "CVE-2026-65391",
"type": "related"
},
{
"destId": "CVE-2026-65395",
"type": "related"
},
{
"destId": "CVE-2026-65398",
"type": "related"
},
{
"destId": "CVE-2026-65399",
"type": "related"
},
{
"destId": "CVE-2026-65402",
"type": "related"
},
{
"destId": "CVE-2026-65403",
"type": "related"
},
{
"destId": "CVE-2026-65405",
"type": "related"
},
{
"destId": "CVE-2026-65406",
"type": "related"
},
{
"destId": "CVE-2026-65407",
"type": "related"
},
{
"destId": "CVE-2026-65409",
"type": "related"
},
{
"destId": "CVE-2026-65410",
"type": "related"
},
{
"destId": "CVE-2026-65411",
"type": "related"
},
{
"destId": "CVE-2026-65412",
"type": "related"
},
{
"destId": "CVE-2026-65414",
"type": "related"
},
{
"destId": "CVE-2026-65415",
"type": "related"
},
{
"destId": "CVE-2026-84487",
"type": "related"
},
{
"destId": "CVE-2026-84491",
"type": "related"
},
{
"destId": "CVE-2026-84492",
"type": "related"
},
{
"destId": "CVE-2026-84497",
"type": "related"
},
{
"destId": "CVE-2026-84507",
"type": "related"
},
{
"destId": "CVE-2026-84511",
"type": "related"
},
{
"destId": "CVE-2026-84513",
"type": "related"
},
{
"destId": "CVE-2026-84521",
"type": "related"
},
{
"destId": "CVE-2026-84523",
"type": "related"
},
{
"destId": "CVE-2026-84524",
"type": "related"
},
{
"destId": "CVE-2026-84526",
"type": "related"
},
{
"destId": "CVE-2026-84527",
"type": "related"
},
{
"destId": "CVE-2026-84530",
"type": "related"
},
{
"destId": "CVE-2026-84532",
"type": "related"
},
{
"destId": "CVE-2026-84534",
"type": "related"
},
{
"destId": "CVE-2026-84546",
"type": "related"
},
{
"destId": "CVE-2026-84551",
"type": "related"
},
{
"destId": "CVE-2026-84560",
"type": "related"
},
{
"destId": "CVE-2026-84561",
"type": "related"
},
{
"destId": "CVE-2026-84564",
"type": "related"
},
{
"destId": "CVE-2026-84571",
"type": "related"
},
{
"destId": "CVE-2026-84575",
"type": "related"
},
{
"destId": "CVE-2026-84583",
"type": "related"
},
{
"destId": "CVE-2026-84596",
"type": "related"
},
{
"destId": "CVE-2026-84597",
"type": "related"
},
{
"destId": "CVE-2026-84600",
"type": "related"
},
{
"destId": "CVE-2026-84602",
"type": "related"
},
{
"destId": "CVE-2026-84603",
"type": "related"
},
{
"destId": "CVE-2026-84606",
"type": "related"
},
{
"destId": "CVE-2026-84607",
"type": "related"
},
{
"destId": "CVE-2026-84609",
"type": "related"
},
{
"destId": "CVE-2026-84611",
"type": "related"
},
{
"destId": "CVE-2026-84612",
"type": "related"
},
{
"destId": "CVE-2026-84615",
"type": "related"
},
{
"destId": "CVE-2026-84616",
"type": "related"
},
{
"destId": "CVE-2026-84620",
"type": "related"
},
{
"destId": "CVE-2026-84622",
"type": "related"
},
{
"destId": "CVE-2026-84624",
"type": "related"
},
{
"destId": "CVE-2026-84625",
"type": "related"
},
{
"destId": "CVE-2026-84626",
"type": "related"
},
{
"destId": "CVE-2026-84628",
"type": "related"
},
{
"destId": "CVE-2026-84629",
"type": "related"
},
{
"destId": "CVE-2026-84630",
"type": "related"
},
{
"destId": "CVE-2026-84632",
"type": "related"
},
{
"destId": "CVE-2026-84635",
"type": "related"
},
{
"destId": "CVE-2026-84636",
"type": "related"
},
{
"destId": "CVE-2026-86870",
"type": "related"
},
{
"destId": "CVE-2026-86876",
"type": "related"
},
{
"destId": "CVE-2026-86881",
"type": "related"
},
{
"destId": "CVE-2026-86882",
"type": "related"
},
{
"destId": "CVE-2026-86883",
"type": "related"
},
{
"destId": "CVE-2026-86887",
"type": "related"
},
{
"destId": "CVE-2026-86888",
"type": "related"
},
{
"destId": "CVE-2026-86892",
"type": "related"
},
{
"destId": "CVE-2026-86893",
"type": "related"
},
{
"destId": "CVE-2026-86895",
"type": "related"
},
{
"destId": "CVE-2026-86897",
"type": "related"
},
{
"destId": "CVE-2026-86898",
"type": "related"
},
{
"destId": "CVE-2026-86903",
"type": "related"
},
{
"destId": "CVE-2026-86905",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0398",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/60",
"automated": true,
"contentSha256": "d1a72a0a042e783ac09829d6e2610d4e6db9aa438ec5ede9027011353dc55579",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/60",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-09-14T22:09:24Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0398"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-10-02T04:57:32Z",
"dateUpdated": "2026-10-02T04:57:32Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0398"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GHSA-5VRC-4FJ4-9CMH
Vulnerability from github – Published: 2026-05-11 21:31 – Updated: 2026-09-14 21:31
VLAI
Details
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2026-28969"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-11T21:18:57Z",
"severity": "HIGH"
},
"details": "A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination.",
"id": "GHSA-5vrc-4fj4-9cmh",
"modified": "2026-09-14T21:31:15Z",
"published": "2026-05-11T21:31:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28969"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/127110"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/127111"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/127115"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/127116"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/127117"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/127118"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/127119"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/127120"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/149034"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/149035"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/149036"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/149037"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/149038"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/149042"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/149043"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
NCSC-2026-0138
Vulnerability from csaf_ncscnl - Published: 2026-05-12 12:18 - Updated: 2026-05-12 12:18Summary
Kwetsbaarheden verholpen in Apple iOS en iPadOS
Scope
73 vulnerabilities in this advisory, including CVE-2026-28969.
CVE-2026-28969
A use after free vulnerability was fixed through improved memory management in multiple Apple operating systems, including iOS 18.7.9 and macOS Sequoia 15.7.7, preventing unexpected system termination caused by apps.
Known affected: 2 products
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…
Loading…