GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    24839 vulnerabilities by Apple

    GCVE-1988-2026-0367

    Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 11:28
    VLAI
    Title
    APPLE-SA-05-13-2026-1 Safari 26.5
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-05-13-2026-1 Safari 26.5 Safari 26.5 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/127121. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced Description: A validation issue was addressed with improved logic. WebKit Bugzilla: 308906 CVE-2026-43660: Cantina WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced Description: The issue was addressed with improved input validation. WebKit Bugzilla: 308675 CVE-2026-28907: Cantina WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may disclose sensitive user information Description: This issue was addressed with improved access restrictions. WebKit Bugzilla: 309698 CVE-2026-28962: Luke Francis, Vaagn Vardanian, kwak kiyong / kakaogames, Vitaly Simonovich, Adel Bouachraoui, greenbynox WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 307669 CVE-2026-43658: Do Young Park WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 308545 CVE-2026-28905: Yuhao Hu, Yuanming Lai, Chenggang Wu, and Zhe Wang WebKit Bugzilla: 308707 CVE-2026-28847: DARKNAVY (@DarkNavyOrg), Anonymous working with TrendAI Zero Day Initiative, Daniel Rhea WebKit Bugzilla: 309601 CVE-2026-28904: Luka Rački WebKit Bugzilla: 310880 CVE-2026-28955: wac and Kookhwan Lee working with TrendAI Zero Day Initiative WebKit Bugzilla: 310303 CVE-2026-28903: Mateusz Krzywicki (iVerify.io) WebKit Bugzilla: 309628 CVE-2026-28953: Maher Azzouzi WebKit Bugzilla: 309861 CVE-2026-28902: Tristan Madani (@TristanInSec) from Talence Security, Nathaniel Oh (@calysteon) WebKit Bugzilla: 310207 CVE-2026-28901: Aisle offensive security research team (Joshua Rogers, Luigino Camastra, Igor Morgenstern, and Guido Vranken), Maher Azzouzi, Ngan Nguyen of Calif.io WebKit Bugzilla: 311631 CVE-2026-28913: an anonymous researcher WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 313939 CVE-2026-28883: kwak kiyong / kakaogames WebKit Available for: macOS Sonoma and macOS Sequoia Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved data protection. WebKit Bugzilla: 311228 CVE-2026-28958: Cantina WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: The issue was addressed with improved input validation. WebKit Bugzilla: 310527 CVE-2026-28917: Vitaly Simonovich WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 310234 CVE-2026-28947: dr3dd WebKit Bugzilla: 310544 CVE-2026-28946: Gia Bui (@yabeow) from Calif.io, dr3dd, w0wbox WebKit Bugzilla: 312180 CVE-2026-28942: Milad Nasr and Nicholas Carlini with Claude, Anthropic WebKit Available for: macOS Sonoma and macOS Sequoia Impact: A malicious iframe may use another website’s download settings Description: The issue was addressed with improved UI handling. CVE-2026-28971: Khiem Tran WebKit Bugzilla: 311288 WebRTC Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 311131 CVE-2026-28944: Kenneth Hsu of Palo Alto Networks, Jérôme DJOUDER, dr3dd Additional recognition Safari We would like to acknowledge sean mutuku for their assistance. Safari Push Notifications We would like to acknowledge Robert Mindo for their assistance. WebKit We would like to acknowledge Muhammad Zaid Ghifari (Mr.ZheeV), Kalimantan Utara, Qadhafy Muhammad Tera, Vitaly Simonovich for their assistance. WebRTC We would like to acknowledge Hyeonji Son (@jir4vv1t) of Demon Team for their assistance. Safari 26.5 may be obtained from the Mac App Store. All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmoE52oACgkQ4Ifiq8DH 7PV9tw/8C759AP/3NbUY9aGa7CjwMsAcI+/Y3Gt1NpNpOiTqBO9fVzFR5rzkPELk TGhNZ8fbGOMZji8i7tizeEbHzdZXaaVAvmBdFlhx8mmBtOMi1f8vFUQh+FeWiMDn 1BhlLMF2VigV8FcoyFiYIkcfaNYFnd3/QpDzQ4M0W7Wb/+xztzvqkgcTxQrhsNkN WfxUkSzsZlcv6XOb/P9KqAr66Y1NRhVNeYFuEd3rcJYnL6nap4p0HlwgGmyU1Grs PW0hOBmWo2HSFWOxOQ2akMtkOqpCiSjcI3FPwlMAagyhjieaZXT5/HrfCs0SelI2 kJVGpDiySNYxtKPbHYvDwjhVBRv2NaX6LFaNqVm20CaaFQGdF5sRGgTBJC7LtfCs 1PKnLcv2ov+isEYPEUsWjIWemFEi8nO+p9NkpqY6rMoOWbGKsi2IELbC5QNjgKVA 8/LEsQXW2Qf0RKQqlWk35Zv7ZWD2+ezjP/jNHYHvZJAN0IHR7HZOqfCm+V8uGndx 8iQDQ3R38mcsIUOYIMjuVP1PfVnMqyFSAVFkE/qtyTUk5TqsO4vdsQ/MKoxNXoW+ lHZT2q7ijQBGSteuax6XhH2r7hGxAXMols59EaJM3LZecDiqvOUloPC40hCItxEL 0VO4Cjuoz0UR2n4oafNs+AldAyuNnhlWEpYhgKbzkuySObOQ6TE= =5v8r -----END PGP SIGNATURE----- _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Apple Safari Affected: unknown
    		Create a notification for this product.
    Credits
    Apple Product Security via Fulldisclosure
    Relationships
    reference GCVE-1988-2026-0367 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-05-13-2026-1 Safari 26.5\n\nSafari 26.5 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/127121.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may prevent Content\nSecurity Policy from being enforced\nDescription: A validation issue was addressed with improved logic.\nWebKit Bugzilla: 308906\nCVE-2026-43660: Cantina\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may prevent Content\nSecurity Policy from being enforced\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 308675\nCVE-2026-28907: Cantina\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may disclose\nsensitive user information\nDescription: This issue was addressed with improved access restrictions.\nWebKit Bugzilla: 309698\nCVE-2026-28962: Luke Francis, Vaagn Vardanian, kwak kiyong / kakaogames,\nVitaly Simonovich, Adel Bouachraoui, greenbynox\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 307669\nCVE-2026-43658: Do Young Park\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 308545\nCVE-2026-28905: Yuhao Hu, Yuanming Lai, Chenggang Wu, and Zhe Wang\nWebKit Bugzilla: 308707\nCVE-2026-28847: DARKNAVY (@DarkNavyOrg), Anonymous working with TrendAI\nZero Day Initiative, Daniel Rhea\nWebKit Bugzilla: 309601\nCVE-2026-28904: Luka Ra\u010dki\nWebKit Bugzilla: 310880\nCVE-2026-28955: wac and Kookhwan Lee working with TrendAI Zero Day\nInitiative\nWebKit Bugzilla: 310303\nCVE-2026-28903: Mateusz Krzywicki (iVerify.io)\nWebKit Bugzilla: 309628\nCVE-2026-28953: Maher Azzouzi\nWebKit Bugzilla: 309861\nCVE-2026-28902: Tristan Madani (@TristanInSec) from Talence Security,\nNathaniel Oh (@calysteon)\nWebKit Bugzilla: 310207\nCVE-2026-28901: Aisle offensive security research team (Joshua Rogers,\nLuigino Camastra, Igor Morgenstern, and Guido Vranken), Maher Azzouzi,\nNgan Nguyen of Calif.io\nWebKit Bugzilla: 311631\nCVE-2026-28913: an anonymous researcher\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313939\nCVE-2026-28883: kwak kiyong / kakaogames\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nWebKit Bugzilla: 311228\nCVE-2026-28958: Cantina\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 310527\nCVE-2026-28917: Vitaly Simonovich\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 310234\nCVE-2026-28947: dr3dd\nWebKit Bugzilla: 310544\nCVE-2026-28946: Gia Bui (@yabeow) from Calif.io, dr3dd, w0wbox\nWebKit Bugzilla: 312180\nCVE-2026-28942: Milad Nasr and Nicholas Carlini with Claude, Anthropic\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: A malicious iframe may use another website\u2019s download settings\nDescription: The issue was addressed with improved UI handling.\nCVE-2026-28971: Khiem Tran\nWebKit Bugzilla: 311288\n\nWebRTC\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 311131\nCVE-2026-28944: Kenneth Hsu of Palo Alto Networks, J\u00e9r\u00f4me DJOUDER, dr3dd\n\nAdditional recognition\n\nSafari\nWe would like to acknowledge sean mutuku for their assistance.\n\nSafari Push Notifications\nWe would like to acknowledge Robert Mindo for their assistance.\n\nWebKit\nWe would like to acknowledge Muhammad Zaid Ghifari (Mr.ZheeV),\nKalimantan Utara, Qadhafy Muhammad Tera, Vitaly Simonovich for their\nassistance.\n\nWebRTC\nWe would like to acknowledge Hyeonji Son (@jir4vv1t) of Demon Team for\ntheir assistance.\n\nSafari 26.5 may be obtained from the Mac App Store.\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmoE52oACgkQ4Ifiq8DH\n7PV9tw/8C759AP/3NbUY9aGa7CjwMsAcI+/Y3Gt1NpNpOiTqBO9fVzFR5rzkPELk\nTGhNZ8fbGOMZji8i7tizeEbHzdZXaaVAvmBdFlhx8mmBtOMi1f8vFUQh+FeWiMDn\n1BhlLMF2VigV8FcoyFiYIkcfaNYFnd3/QpDzQ4M0W7Wb/+xztzvqkgcTxQrhsNkN\nWfxUkSzsZlcv6XOb/P9KqAr66Y1NRhVNeYFuEd3rcJYnL6nap4p0HlwgGmyU1Grs\nPW0hOBmWo2HSFWOxOQ2akMtkOqpCiSjcI3FPwlMAagyhjieaZXT5/HrfCs0SelI2\nkJVGpDiySNYxtKPbHYvDwjhVBRv2NaX6LFaNqVm20CaaFQGdF5sRGgTBJC7LtfCs\n1PKnLcv2ov+isEYPEUsWjIWemFEi8nO+p9NkpqY6rMoOWbGKsi2IELbC5QNjgKVA\n8/LEsQXW2Qf0RKQqlWk35Zv7ZWD2+ezjP/jNHYHvZJAN0IHR7HZOqfCm+V8uGndx\n8iQDQ3R38mcsIUOYIMjuVP1PfVnMqyFSAVFkE/qtyTUk5TqsO4vdsQ/MKoxNXoW+\nlHZT2q7ijQBGSteuax6XhH2r7hGxAXMols59EaJM3LZecDiqvOUloPC40hCItxEL\n0VO4Cjuoz0UR2n4oafNs+AldAyuNnhlWEpYhgKbzkuySObOQ6TE=\n=5v8r\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:28:33Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/16"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/16"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/en-us/127121"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/16"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-05-13-2026-1 Safari 26.5",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-28847",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28883",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28901",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28902",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28903",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28904",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28905",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28907",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28913",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28917",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28942",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28944",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28946",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28947",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28953",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28955",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28958",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28962",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28971",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43658",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43660",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0367",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/16",
            "automated": true,
            "contentSha256": "284818841648cbd52b15b9b3cc23c072a07f159b9afa1bd6427c0b564951697f",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/16",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-13T21:39:47Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0367"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T11:28:33Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0367"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0346

    Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 11:35
    VLAI
    Title
    APPLE-SA-06-29-2026-2 macOS Tahoe 26.5.2
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-06-29-2026-2 macOS Tahoe 26.5.2 macOS Tahoe 26.5.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/127595. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. IOGPUFamily Available for: macOS Tahoe Impact: An app may be able to cause unexpected system termination Description: A race condition was addressed with improved state handling. CVE-2026-43743: Lyutoon, Dun Kernel Available for: macOS Tahoe Impact: An app may be able to cause unexpected system termination or write kernel memory Description: The issue was addressed with improved input sanitization. CVE-2026-43724: Hyunwoo Kim (@v4bel) Kernel Available for: macOS Tahoe Impact: An app may be able to leak sensitive kernel state Description: The issue was addressed with improved input sanitization. CVE-2026-43722: Feng Xue and XGPT of ThreatBook, Hyunwoo Kim (@v4bel) Kernel Available for: macOS Tahoe Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: This issue was addressed with improved input validation. CVE-2026-39868: Vladislav Shevchenko (Positive Technologies), Ye Zhang (@VAR10CK) of Baidu Security, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. libxslt Available for: macOS Tahoe Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: A double free issue was addressed with improved memory management. CVE-2026-43706: Tristan Madani (@TristanInSec) from Talence Security libxslt Available for: macOS Tahoe Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: The issue was addressed with improved memory handling. CVE-2026-43703: Tristan Madani (@TristanInSec) from Talence Security Web Extensions Available for: macOS Tahoe Impact: A malicious web extension may be able to cause an unexpected process crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 314642 CVE-2026-43704: dr3dd WebKit Available for: macOS Tahoe Impact: Processing maliciously crafted web content may disclose sensitive user information Description: A cross-origin issue was addressed with improved tracking of security origins. WebKit Bugzilla: 315368 CVE-2026-43700: Vitaly Simonovich, Christian Meurer Xavier WebKit Available for: macOS Tahoe Impact: A malicious website may exfiltrate data cross-origin Description: The issue was addressed with improved checks. WebKit Bugzilla: 313357 CVE-2026-43735: Merrick Hare, Drinor Selmanaj (Sentry), Khai Tran, John Lussier, Rhyru9, Kwak Kiyong, Song Nuri WebKit Available for: macOS Tahoe Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 313693 CVE-2026-43734: Jonathan Alush-Aben WebKit Bugzilla: 313857 CVE-2026-43726: Josef Korbel (Citadelo), Tristan Madani (@TristanInSec) from Talence Security, Gia Bui (@yabeow) from Calif.io, Narendra Singh (@_3P1C) WebKit Bugzilla: 314398 CVE-2026-43709 WebKit Bugzilla: 317227 CVE-2026-43699: Tommy DeVoss from Braze Security Team (@thedawgyg) WebKit Bugzilla: 315161 CVE-2026-43742: Юлия Мерцалова WebKit Available for: macOS Tahoe Impact: Processing maliciously crafted web content may disclose sensitive user information Description: A path handling issue was addressed with improved validation. WebKit Bugzilla: 313085 CVE-2026-43732: Nan Wang (@eternalsakura13) WebKit Available for: macOS Tahoe Impact: Processing maliciously crafted web content may lead to memory corruption Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 314115 CVE-2026-43731: dr3dd WebKit Bugzilla: 313577 CVE-2026-43715: Milad Nasr and Nicholas Carlini with Claude, Anthropic WebKit Available for: macOS Tahoe Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 313691 CVE-2026-43727: Tommy DeVoss from Braze Security Team (@thedawgyg), Gia Bui (@yabeow) from Calif.io, Gurpreet Shergill WebKit Available for: macOS Tahoe Impact: A malicious website may be able to process restricted web content outside the sandbox Description: The issue was addressed with improved input validation. WebKit Bugzilla: 312832 CVE-2026-43725: Luke Francis WebKit Available for: macOS Tahoe Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 312781 CVE-2026-43663: Soyeon Park, Amy Burnett, Khai Tran, sherkito, Kota Toda, HexRabbit (@h3xr4bb1t) and NiNi (@terrynini38514) of DEVCORE Research Team, Using GLM From Z.AI, Tristan Madani (@TristanInSec) from Talence Security, Brian Carpenter WebKit Bugzilla: 313528 CVE-2026-39872: Utkarsh Pal, Ignacio Sanmillan (@ulexec) WebKit Bugzilla: 314235 CVE-2026-43712: Kwak Kiyong, Song Nuri, Tristan Madani (@TristanInSec) from Talence Security WebKit Available for: macOS Tahoe Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 315047 CVE-2026-43716: Tuan and Duc from Calif.io, OpenAI Codex Security - Amy Burnett, Evan Lambert WebKit Available for: macOS Tahoe Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: An out-of-bounds access issue was addressed with improved bounds checking. WebKit Bugzilla: 317231 CVE-2026-43676: Mateusz Krzywicki (iVerify.io), dr3dd, Tommy DeVoss from Braze Security Team (@thedawgyg) WebKit Available for: macOS Tahoe Impact: Processing maliciously crafted web content may result in the disclosure of process memory Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 308046 CVE-2026-43740: Nathaniel Oh (@calysteon), Arni Hardarson WebKit Available for: macOS Tahoe Impact: Visiting a website may leak sensitive data Description: A permissions issue was addressed with additional restrictions. WebKit Bugzilla: 314806 CVE-2026-43713: Jody Ritonga WebKit Available for: macOS Tahoe Impact: A malicious website may exfiltrate data cross-origin Description: The issue was addressed with improved input validation. WebKit Bugzilla: 315306 CVE-2026-43708: Behzad Najjarpour Jabbari (@_G4ru_) WebKit Available for: macOS Tahoe Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: A memory corruption issue was addressed with improved memory handling. WebKit Bugzilla: 315951 CVE-2026-43707: OpenAI Codex Security - Amy Burnett WebKit Available for: macOS Tahoe Impact: Processing maliciously crafted web content may lead to memory corruption Description: A type confusion issue was addressed with improved checks. WebKit Bugzilla: 314528 CVE-2026-43705: dr3dd WebKit Available for: macOS Tahoe Impact: A malicious website may be able to process restricted web content outside the sandbox Description: The issue was addressed with improved checks. WebKit Bugzilla: 315004 CVE-2026-43701: Aaron Grattafiori - NVIDIA AI Red Team WebKit Available for: macOS Tahoe Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: An out-of-bounds write issue was addressed with improved input validation. WebKit Bugzilla: 315365 CVE-2026-43745: OpenAI Codex Security - Amy Burnett, Khai Tran WebKit Canvas Available for: macOS Tahoe Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 313175 CVE-2026-43720: Gia Bui (@yabeow) from Calif.io, Josef Korbel WebKit Storage Available for: macOS Tahoe Impact: A malicious website may be able to silently hijack clipboard data Description: This issue was addressed through improved state management. WebKit Bugzilla: 313478 CVE-2026-43721: Idan Masas WebRTC Available for: macOS Tahoe Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: An out-of-bounds access issue was addressed with improved bounds checking. WebKit Bugzilla: 317324 CVE-2026-28979 WebRTC Available for: macOS Tahoe Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A stack overflow was addressed with improved input validation. WebKit Bugzilla: 313350 CVE-2026-43718: Nan Wang (@eternalsakura13) WebRTC Available for: macOS Tahoe Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 313351 CVE-2026-43717: Nan Wang (@eternalsakura13) WebKit Bugzilla: 314090 CVE-2026-43746: dr3dd Additional recognition libxslt We would like to acknowledge Kubilay Berk Alkan for their assistance. WebKit We would like to acknowledge Henock Habte, Souta Sugiyama for their assistance. WebKit JavaScript Bindings We would like to acknowledge Karan Kurani for their assistance. macOS Tahoe 26.5.2 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmpCz3gACgkQ4Ifiq8DH 7PVguQ/+Oik8OkzSvGCd0i95T4XfWjMIegHQWkUyRY5f4SEcrXBDEX24hQ6vENUO Dw/oyPfHf/Io3Wj5a+/OcpPXMSTZRKc5DOjNso4gCmerw7//gF+0P+w08QhmLlmD FLSqIvuVBfpJQCh1wsDhKJJzx9g3Q8ae6SxhyY6uMVFNpo4GwUKUejiKiSU1ReIs xvTQN/MUb9cMUacJTjzuRazc7wgGJcjDjJ4yjIA1rVU4tezQmWxLvhMleCidyD1v VW1Jre4prqHtL3afK3OtEI/l3xuCSU/Tz+ZjTK/zU+JpFFP8umYlLKmw5S1M4sHy G+YAVu6PieLnjBBrs31OZ9ue/7/s4W0LFwEHvjRbq8NEi7IAAJxj6/cC6ym62Ujc 5Fv7n0405Xpwtw1/jonWPoNieOhFL2mvzaZDjx/DB6k5mUVZyycnJ4LPwLHkFH0m oQ3o0q9ECXv9PLVQf2398fZNNi5azSshX3jdE0X+rX058IjjZftfu/VDoaprP5is ztP6XnmmCXp/QW0/Q7wG34j05azwwQZ6FxU7ZP4DJ7RXQ5ugJU7KoD7tn7UYOZgA NbBXp//SX/OLyf/8pmUCSt5v84BE/Muhxfzy+mjiick6JPNoRMBnG5d7WYL212b4 zjPT4bZ4LwnYwocz3r1Ky0MU3Pt0Whrx4kSQbiVG3ULBNTjyspQ= =rkMC -----END PGP SIGNATURE----- _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Apple Macos Tahoe Affected: unknown
    		Create a notification for this product.
    Credits
    Apple Product Security via Fulldisclosure
    Relationships
    reference GCVE-1988-2026-0346 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Macos Tahoe",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-06-29-2026-2 macOS Tahoe 26.5.2\n\nmacOS Tahoe 26.5.2 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/127595.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nIOGPUFamily\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-43743: Lyutoon, Dun\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43724: Hyunwoo Kim (@v4bel)\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to leak sensitive kernel state\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43722: Feng Xue and XGPT of ThreatBook, Hyunwoo Kim (@v4bel)\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: This issue was addressed with improved input validation.\nCVE-2026-39868: Vladislav Shevchenko (Positive Technologies), Ye Zhang\n(@VAR10CK) of Baidu Security, Billy Jheng Bing Jhong and Pan Zhenpeng\n(@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nlibxslt\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A double free issue was addressed with improved memory\nmanagement.\nCVE-2026-43706: Tristan Madani (@TristanInSec) from Talence Security\n\nlibxslt\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43703: Tristan Madani (@TristanInSec) from Talence Security\n\nWeb Extensions\nAvailable for: macOS Tahoe\nImpact: A malicious web extension may be able to cause an unexpected\nprocess crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 314642\nCVE-2026-43704: dr3dd\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may disclose\nsensitive user information\nDescription: A cross-origin issue was addressed with improved tracking\nof security origins.\nWebKit Bugzilla: 315368\nCVE-2026-43700: Vitaly Simonovich, Christian Meurer Xavier\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: A malicious website may exfiltrate data cross-origin\nDescription: The issue was addressed with improved checks.\nWebKit Bugzilla: 313357\nCVE-2026-43735: Merrick Hare, Drinor Selmanaj (Sentry), Khai Tran, John\nLussier, Rhyru9, Kwak Kiyong, Song Nuri\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313693\nCVE-2026-43734: Jonathan Alush-Aben\nWebKit Bugzilla: 313857\nCVE-2026-43726: Josef Korbel (Citadelo), Tristan Madani (@TristanInSec)\nfrom Talence Security, Gia Bui (@yabeow) from Calif.io, Narendra Singh\n(@_3P1C)\nWebKit Bugzilla: 314398\nCVE-2026-43709\nWebKit Bugzilla: 317227\nCVE-2026-43699: Tommy DeVoss from Braze Security Team (@thedawgyg)\nWebKit Bugzilla: 315161\nCVE-2026-43742: \u042e\u043b\u0438\u044f \u041c\u0435\u0440\u0446\u0430\u043b\u043e\u0432\u0430\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may disclose\nsensitive user information\nDescription: A path handling issue was addressed with improved\nvalidation.\nWebKit Bugzilla: 313085\nCVE-2026-43732: Nan Wang (@eternalsakura13)\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 314115\nCVE-2026-43731: dr3dd\nWebKit Bugzilla: 313577\nCVE-2026-43715: Milad Nasr and Nicholas Carlini with Claude, Anthropic\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313691\nCVE-2026-43727: Tommy DeVoss from Braze Security Team (@thedawgyg), Gia\nBui (@yabeow) from Calif.io, Gurpreet Shergill\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: A malicious website may be able to process restricted web\ncontent outside the sandbox\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 312832\nCVE-2026-43725: Luke Francis\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 312781\nCVE-2026-43663: Soyeon Park, Amy Burnett, Khai Tran, sherkito, Kota\nToda, HexRabbit (@h3xr4bb1t) and NiNi (@terrynini38514) of DEVCORE\nResearch Team, Using GLM From Z.AI, Tristan Madani (@TristanInSec) from\nTalence Security, Brian Carpenter\nWebKit Bugzilla: 313528\nCVE-2026-39872: Utkarsh Pal, Ignacio Sanmillan (@ulexec)\nWebKit Bugzilla: 314235\nCVE-2026-43712: Kwak Kiyong, Song Nuri, Tristan Madani (@TristanInSec)\nfrom Talence Security\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 315047\nCVE-2026-43716: Tuan and Duc from Calif.io, OpenAI Codex Security - Amy\nBurnett, Evan Lambert\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nWebKit Bugzilla: 317231\nCVE-2026-43676: Mateusz Krzywicki (iVerify.io), dr3dd, Tommy DeVoss from\nBraze Security Team (@thedawgyg)\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may result in the\ndisclosure of process memory\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 308046\nCVE-2026-43740: Nathaniel Oh (@calysteon), Arni Hardarson\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Visiting a website may leak sensitive data\nDescription: A permissions issue was addressed with additional\nrestrictions.\nWebKit Bugzilla: 314806\nCVE-2026-43713: Jody Ritonga\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: A malicious website may exfiltrate data cross-origin\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 315306\nCVE-2026-43708: Behzad Najjarpour Jabbari (@_G4ru_)\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nWebKit Bugzilla: 315951\nCVE-2026-43707: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: A type confusion issue was addressed with improved checks.\nWebKit Bugzilla: 314528\nCVE-2026-43705: dr3dd\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: A malicious website may be able to process restricted web\ncontent outside the sandbox\nDescription: The issue was addressed with improved checks.\nWebKit Bugzilla: 315004\nCVE-2026-43701: Aaron Grattafiori - NVIDIA AI Red Team\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: An out-of-bounds write issue was addressed with improved\ninput validation.\nWebKit Bugzilla: 315365\nCVE-2026-43745: OpenAI Codex Security - Amy Burnett, Khai Tran\n\nWebKit Canvas\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313175\nCVE-2026-43720: Gia Bui (@yabeow) from Calif.io, Josef Korbel\n\nWebKit Storage\nAvailable for: macOS Tahoe\nImpact: A malicious website may be able to silently hijack clipboard\ndata\nDescription: This issue was addressed through improved state management.\nWebKit Bugzilla: 313478\nCVE-2026-43721: Idan Masas\n\nWebRTC\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nWebKit Bugzilla: 317324\nCVE-2026-28979\n\nWebRTC\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A stack overflow was addressed with improved input\nvalidation.\nWebKit Bugzilla: 313350\nCVE-2026-43718: Nan Wang (@eternalsakura13)\n\nWebRTC\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313351\nCVE-2026-43717: Nan Wang (@eternalsakura13)\nWebKit Bugzilla: 314090\nCVE-2026-43746: dr3dd\n\nAdditional recognition\n\nlibxslt\nWe would like to acknowledge Kubilay Berk Alkan for their assistance.\n\nWebKit\nWe would like to acknowledge Henock Habte, Souta Sugiyama for their\nassistance.\n\nWebKit JavaScript Bindings\nWe would like to acknowledge Karan Kurani for their assistance.\n\nmacOS Tahoe 26.5.2 may be obtained from the Mac App Store or Apple\u0027s\nSoftware Downloads web site: https://support.apple.com/downloads/\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmpCz3gACgkQ4Ifiq8DH\n7PVguQ/+Oik8OkzSvGCd0i95T4XfWjMIegHQWkUyRY5f4SEcrXBDEX24hQ6vENUO\nDw/oyPfHf/Io3Wj5a+/OcpPXMSTZRKc5DOjNso4gCmerw7//gF+0P+w08QhmLlmD\nFLSqIvuVBfpJQCh1wsDhKJJzx9g3Q8ae6SxhyY6uMVFNpo4GwUKUejiKiSU1ReIs\nxvTQN/MUb9cMUacJTjzuRazc7wgGJcjDjJ4yjIA1rVU4tezQmWxLvhMleCidyD1v\nVW1Jre4prqHtL3afK3OtEI/l3xuCSU/Tz+ZjTK/zU+JpFFP8umYlLKmw5S1M4sHy\nG+YAVu6PieLnjBBrs31OZ9ue/7/s4W0LFwEHvjRbq8NEi7IAAJxj6/cC6ym62Ujc\n5Fv7n0405Xpwtw1/jonWPoNieOhFL2mvzaZDjx/DB6k5mUVZyycnJ4LPwLHkFH0m\noQ3o0q9ECXv9PLVQf2398fZNNi5azSshX3jdE0X+rX058IjjZftfu/VDoaprP5is\nztP6XnmmCXp/QW0/Q7wG34j05azwwQZ6FxU7ZP4DJ7RXQ5ugJU7KoD7tn7UYOZgA\nNbBXp//SX/OLyf/8pmUCSt5v84BE/Muhxfzy+mjiick6JPNoRMBnG5d7WYL212b4\nzjPT4bZ4LwnYwocz3r1Ky0MU3Pt0Whrx4kSQbiVG3ULBNTjyspQ=\n=rkMC\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:35:20Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/12"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jul/12"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/downloads/"
        },
        {
          "url": "https://support.apple.com/en-us/127595"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jul/12"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-06-29-2026-2 macOS Tahoe 26.5.2",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-28979",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39868",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39872",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43663",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43676",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43699",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43700",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43701",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43703",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43704",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43705",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43706",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43707",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43708",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43709",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43712",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43713",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43715",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43716",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43717",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43718",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43720",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43721",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43722",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43724",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43725",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43726",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43727",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43731",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43732",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43734",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43735",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43740",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43742",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43743",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43745",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43746",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0346",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/12",
            "automated": true,
            "contentSha256": "4ac8d066f8e0dbe9c4fb0ab34408636c19e3bbf4a09e24f31037fe0404d14ac6",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/12",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-29T20:28:00Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0346"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:57Z",
    "dateUpdated": "2026-09-11T11:35:20Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0346"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0347

    Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 11:35
    VLAI
    Title
    APPLE-SA-06-29-2026-3 Safari 26.5.2
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-06-29-2026-3 Safari 26.5.2 Safari 26.5.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/127685. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Web Extensions Available for: macOS Sonoma and macOS Sequoia Impact: A malicious web extension may be able to cause an unexpected process crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 314642 CVE-2026-43704: dr3dd WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may disclose sensitive user information Description: A cross-origin issue was addressed with improved tracking of security origins. WebKit Bugzilla: 315368 CVE-2026-43700: Vitaly Simonovich, Christian Meurer Xavier WebKit Available for: macOS Sonoma and macOS Sequoia Impact: A malicious website may exfiltrate data cross-origin Description: The issue was addressed with improved checks. WebKit Bugzilla: 313357 CVE-2026-43735: Merrick Hare, Drinor Selmanaj (Sentry), Khai Tran, John Lussier, Rhyru9, Kwak Kiyong, Song Nuri WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 313693 CVE-2026-43734: Jonathan Alush-Aben WebKit Bugzilla: 313857 CVE-2026-43726: Josef Korbel (Citadelo), Tristan Madani (@TristanInSec) from Talence Security, Gia Bui (@yabeow) from Calif.io, Narendra Singh (@_3P1C) WebKit Bugzilla: 314398 CVE-2026-43709 WebKit Bugzilla: 317227 CVE-2026-43699: Tommy DeVoss from Braze Security Team (@thedawgyg) WebKit Bugzilla: 315161 CVE-2026-43742: Юлия Мерцалова WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may disclose sensitive user information Description: A path handling issue was addressed with improved validation. WebKit Bugzilla: 313085 CVE-2026-43732: Nan Wang (@eternalsakura13) WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to memory corruption Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 314115 CVE-2026-43731: dr3dd WebKit Bugzilla: 313577 CVE-2026-43715: Milad Nasr and Nicholas Carlini with Claude, Anthropic WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 313691 CVE-2026-43727: Tommy DeVoss from Braze Security Team (@thedawgyg), Gia Bui (@yabeow) from Calif.io, Gurpreet Shergill WebKit Available for: macOS Sonoma and macOS Sequoia Impact: A malicious website may be able to process restricted web content outside the sandbox Description: The issue was addressed with improved input validation. WebKit Bugzilla: 312832 CVE-2026-43725: Luke Francis WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 312781 CVE-2026-43663: Soyeon Park, Amy Burnett, Khai Tran, sherkito, Kota Toda, HexRabbit (@h3xr4bb1t) and NiNi (@terrynini38514) of DEVCORE Research Team, Using GLM From Z.AI, Tristan Madani (@TristanInSec) from Talence Security, Brian Carpenter WebKit Bugzilla: 313528 CVE-2026-39872: Utkarsh Pal, Ignacio Sanmillan (@ulexec) WebKit Bugzilla: 314235 CVE-2026-43712: Kwak Kiyong, Song Nuri, Tristan Madani (@TristanInSec) from Talence Security WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 313473 CVE-2026-43716: Tuan and Duc from Calif.io, OpenAI Codex Security - Amy Burnett, Evan Lambert WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: An out-of-bounds access issue was addressed with improved bounds checking. WebKit Bugzilla: 317231 CVE-2026-43676: Mateusz Krzywicki (iVerify.io), dr3dd, Tommy DeVoss from Braze Security Team (@thedawgyg) WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may result in the disclosure of process memory Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 308046 CVE-2026-43740: Nathaniel Oh (@calysteon), Arni Hardarson WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Visiting a website may leak sensitive data Description: A permissions issue was addressed with additional restrictions. WebKit Bugzilla: 314806 CVE-2026-43713: Jody Ritonga WebKit Available for: macOS Sonoma and macOS Sequoia Impact: A malicious website may exfiltrate data cross-origin Description: The issue was addressed with improved input validation. WebKit Bugzilla: 315306 CVE-2026-43708: Behzad Najjarpour Jabbari (@_G4ru_) WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: A memory corruption issue was addressed with improved memory handling. WebKit Bugzilla: 315951 CVE-2026-43707: OpenAI Codex Security - Amy Burnett WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to memory corruption Description: A type confusion issue was addressed with improved checks. WebKit Bugzilla: 314528 CVE-2026-43705: dr3dd WebKit Available for: macOS Sonoma and macOS Sequoia Impact: A malicious website may be able to process restricted web content outside the sandbox Description: The issue was addressed with improved checks. WebKit Bugzilla: 315004 CVE-2026-43701: Aaron Grattafiori - NVIDIA AI Red Team WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: An out-of-bounds write issue was addressed with improved input validation. WebKit Bugzilla: 315365 CVE-2026-43745: OpenAI Codex Security - Amy Burnett, Khai Tran WebKit Canvas Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 313175 CVE-2026-43720: Gia Bui (@yabeow) from Calif.io, Josef Korbel WebKit Storage Available for: macOS Sonoma and macOS Sequoia Impact: A malicious website may be able to silently hijack clipboard data Description: This issue was addressed through improved state management. WebKit Bugzilla: 313478 CVE-2026-43721: Idan Masas WebRTC Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: An out-of-bounds access issue was addressed with improved bounds checking. WebKit Bugzilla: 317324 CVE-2026-28979 WebRTC Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A stack overflow was addressed with improved input validation. WebKit Bugzilla: 313350 CVE-2026-43718: Nan Wang (@eternalsakura13) WebRTC Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 313351 CVE-2026-43717: Nan Wang (@eternalsakura13) WebKit Bugzilla: 314090 CVE-2026-43746: dr3dd Additional recognition WebKit We would like to acknowledge Henock Habte, Souta Sugiyama for their assistance. WebKit JavaScript Bindings We would like to acknowledge Karan Kurani for their assistance. Safari 26.5.2 may be obtained from the Mac App Store. All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmpCz6IACgkQ4Ifiq8DH 7PVuEBAAgcVWMM1MLaIJIdRkv+s4HphbLBQ6a0ajL8v4lIUFNsGMdReRdFtWhnp9 BkPUePTO9huD9JzOMVAzHqRE0BXMhpwverWJKqd3iMddo7iVxo3KxQy4IyN9pVuq 3h1TajRzGs9MLNcOXP9acK4Oj5yiJlqOaXrPOmw7jXNNqnAPVLMSQqX7tZG1ellh 4eeUJAOGHx8lTL1LKyy6W027LVzozBeGTe0b2m6wJyNrDd3JpiNotcNSOh75dWkC qGn5wmtC0OXiwQWAmoiZRbTtjaUGZ5VwU4L0BbvZCqVXmwauntAuu30hRsMvu+jM dnQWELA0KfMIdOpVcbijsA2hEUBuXwCu9o1sGBcMxYPXTgpJln7kOhZpMide90a/ 4qFHHfHUpJCA0CLtqdRI3yv+6gPbtYGnqytOLgqcU1hDn5nyRlsIr6sWYS7VCpOt pXVWrgkalZSKWnBKwONomcElX7FqUfbdT6+CrRrlH5aw0f9jzPpf3PRmlbjF9Wdu ooB7V4Xs2AxzmoWm+aRstQL5bJoTGut+jXDxKzYkXpdbnS0qAk/by5AYCPxo0e+z jywZtGaG5Z4bFtGvpU3zwAqajqv6gqDZiG0NfLQxurOjFCrdwl6mQ1VhVh7lyxF4 XGG0gFPjaH3S2EAMKQ8c7YkST1pEDVPNWfBz62Ywc9Fey+zr0Ow= =orbO -----END PGP SIGNATURE----- _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Apple Safari Affected: unknown
    		Create a notification for this product.
    Credits
    Apple Product Security via Fulldisclosure
    Relationships
    reference GCVE-1988-2026-0347 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-06-29-2026-3 Safari 26.5.2\n\nSafari 26.5.2 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/127685.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nWeb Extensions\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: A malicious web extension may be able to cause an unexpected\nprocess crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 314642\nCVE-2026-43704: dr3dd\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may disclose\nsensitive user information\nDescription: A cross-origin issue was addressed with improved tracking\nof security origins.\nWebKit Bugzilla: 315368\nCVE-2026-43700: Vitaly Simonovich, Christian Meurer Xavier\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: A malicious website may exfiltrate data cross-origin\nDescription: The issue was addressed with improved checks.\nWebKit Bugzilla: 313357\nCVE-2026-43735: Merrick Hare, Drinor Selmanaj (Sentry), Khai Tran, John\nLussier, Rhyru9, Kwak Kiyong, Song Nuri\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313693\nCVE-2026-43734: Jonathan Alush-Aben\nWebKit Bugzilla: 313857\nCVE-2026-43726: Josef Korbel (Citadelo), Tristan Madani (@TristanInSec)\nfrom Talence Security, Gia Bui (@yabeow) from Calif.io, Narendra Singh\n(@_3P1C)\nWebKit Bugzilla: 314398\nCVE-2026-43709\nWebKit Bugzilla: 317227\nCVE-2026-43699: Tommy DeVoss from Braze Security Team (@thedawgyg)\nWebKit Bugzilla: 315161\nCVE-2026-43742: \u042e\u043b\u0438\u044f \u041c\u0435\u0440\u0446\u0430\u043b\u043e\u0432\u0430\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may disclose\nsensitive user information\nDescription: A path handling issue was addressed with improved\nvalidation.\nWebKit Bugzilla: 313085\nCVE-2026-43732: Nan Wang (@eternalsakura13)\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 314115\nCVE-2026-43731: dr3dd\nWebKit Bugzilla: 313577\nCVE-2026-43715: Milad Nasr and Nicholas Carlini with Claude, Anthropic\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313691\nCVE-2026-43727: Tommy DeVoss from Braze Security Team (@thedawgyg), Gia\nBui (@yabeow) from Calif.io, Gurpreet Shergill\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: A malicious website may be able to process restricted web\ncontent outside the sandbox\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 312832\nCVE-2026-43725: Luke Francis\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 312781\nCVE-2026-43663: Soyeon Park, Amy Burnett, Khai Tran, sherkito, Kota\nToda, HexRabbit (@h3xr4bb1t) and NiNi (@terrynini38514) of DEVCORE\nResearch Team, Using GLM From Z.AI, Tristan Madani (@TristanInSec) from\nTalence Security, Brian Carpenter\nWebKit Bugzilla: 313528\nCVE-2026-39872: Utkarsh Pal, Ignacio Sanmillan (@ulexec)\nWebKit Bugzilla: 314235\nCVE-2026-43712: Kwak Kiyong, Song Nuri, Tristan Madani (@TristanInSec)\nfrom Talence Security\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 313473\nCVE-2026-43716: Tuan and Duc from Calif.io, OpenAI Codex Security - Amy\nBurnett, Evan Lambert\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nWebKit Bugzilla: 317231\nCVE-2026-43676: Mateusz Krzywicki (iVerify.io), dr3dd, Tommy DeVoss from\nBraze Security Team (@thedawgyg)\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may result in the\ndisclosure of process memory\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 308046\nCVE-2026-43740: Nathaniel Oh (@calysteon), Arni Hardarson\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Visiting a website may leak sensitive data\nDescription: A permissions issue was addressed with additional\nrestrictions.\nWebKit Bugzilla: 314806\nCVE-2026-43713: Jody Ritonga\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: A malicious website may exfiltrate data cross-origin\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 315306\nCVE-2026-43708: Behzad Najjarpour Jabbari (@_G4ru_)\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nWebKit Bugzilla: 315951\nCVE-2026-43707: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: A type confusion issue was addressed with improved checks.\nWebKit Bugzilla: 314528\nCVE-2026-43705: dr3dd\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: A malicious website may be able to process restricted web\ncontent outside the sandbox\nDescription: The issue was addressed with improved checks.\nWebKit Bugzilla: 315004\nCVE-2026-43701: Aaron Grattafiori - NVIDIA AI Red Team\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: An out-of-bounds write issue was addressed with improved\ninput validation.\nWebKit Bugzilla: 315365\nCVE-2026-43745: OpenAI Codex Security - Amy Burnett, Khai Tran\n\nWebKit Canvas\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313175\nCVE-2026-43720: Gia Bui (@yabeow) from Calif.io, Josef Korbel\n\nWebKit Storage\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: A malicious website may be able to silently hijack clipboard\ndata\nDescription: This issue was addressed through improved state management.\nWebKit Bugzilla: 313478\nCVE-2026-43721: Idan Masas\n\nWebRTC\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nWebKit Bugzilla: 317324\nCVE-2026-28979\n\nWebRTC\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A stack overflow was addressed with improved input\nvalidation.\nWebKit Bugzilla: 313350\nCVE-2026-43718: Nan Wang (@eternalsakura13)\n\nWebRTC\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313351\nCVE-2026-43717: Nan Wang (@eternalsakura13)\nWebKit Bugzilla: 314090\nCVE-2026-43746: dr3dd\n\nAdditional recognition\n\nWebKit\nWe would like to acknowledge Henock Habte, Souta Sugiyama for their\nassistance.\n\nWebKit JavaScript Bindings\nWe would like to acknowledge Karan Kurani for their assistance.\n\nSafari 26.5.2 may be obtained from the Mac App Store.\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmpCz6IACgkQ4Ifiq8DH\n7PVuEBAAgcVWMM1MLaIJIdRkv+s4HphbLBQ6a0ajL8v4lIUFNsGMdReRdFtWhnp9\nBkPUePTO9huD9JzOMVAzHqRE0BXMhpwverWJKqd3iMddo7iVxo3KxQy4IyN9pVuq\n3h1TajRzGs9MLNcOXP9acK4Oj5yiJlqOaXrPOmw7jXNNqnAPVLMSQqX7tZG1ellh\n4eeUJAOGHx8lTL1LKyy6W027LVzozBeGTe0b2m6wJyNrDd3JpiNotcNSOh75dWkC\nqGn5wmtC0OXiwQWAmoiZRbTtjaUGZ5VwU4L0BbvZCqVXmwauntAuu30hRsMvu+jM\ndnQWELA0KfMIdOpVcbijsA2hEUBuXwCu9o1sGBcMxYPXTgpJln7kOhZpMide90a/\n4qFHHfHUpJCA0CLtqdRI3yv+6gPbtYGnqytOLgqcU1hDn5nyRlsIr6sWYS7VCpOt\npXVWrgkalZSKWnBKwONomcElX7FqUfbdT6+CrRrlH5aw0f9jzPpf3PRmlbjF9Wdu\nooB7V4Xs2AxzmoWm+aRstQL5bJoTGut+jXDxKzYkXpdbnS0qAk/by5AYCPxo0e+z\njywZtGaG5Z4bFtGvpU3zwAqajqv6gqDZiG0NfLQxurOjFCrdwl6mQ1VhVh7lyxF4\nXGG0gFPjaH3S2EAMKQ8c7YkST1pEDVPNWfBz62Ywc9Fey+zr0Ow=\n=orbO\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:35:22Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/13"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jul/13"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/en-us/127685"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jul/13"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-06-29-2026-3 Safari 26.5.2",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-28979",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39872",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43663",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43676",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43699",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43700",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43701",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43704",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43705",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43707",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43708",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43709",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43712",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43713",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43715",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43716",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43717",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43718",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43720",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43721",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43725",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43726",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43727",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43731",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43732",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43734",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43735",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43740",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43742",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43745",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43746",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0347",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/13",
            "automated": true,
            "contentSha256": "977f1aec75c263dd4ee474ce28b07e455418964247b9a621320fbcea8bc871d3",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/13",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-29T20:28:28Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0347"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:57Z",
    "dateUpdated": "2026-09-11T11:35:22Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0347"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0334

    Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 11:28
    VLAI
    Title
    APPLE-SA-05-11-2026-7 macOS Sequoia 15.7.7
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-05-11-2026-7 macOS Sequoia 15.7.7 macOS Sequoia 15.7.7 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/127116. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. APFS Available for: macOS Sequoia Impact: An app may be able to cause unexpected system termination Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-28959: Dave G. AppleJPEG Available for: macOS Sequoia Impact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory Description: A memory corruption issue was addressed with improved input validation. CVE-2026-28956: impost0r (ret2plt) Audio Available for: macOS Sequoia Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: The issue was addressed with improved memory handling. CVE-2026-39869: David Ige of Beryllium Security CoreMedia Available for: macOS Sequoia Impact: An app may be able to access private information Description: This issue was addressed through improved state management. CVE-2026-28922: Arni Hardarson Crash Reporter Available for: macOS Sequoia Impact: An app may be able to enumerate a user's installed apps Description: A privacy issue was addressed by removing sensitive data. CVE-2026-28878: Zhongcheng Li from IES Red Team CUPS Available for: macOS Sequoia Impact: An app may be able to gain root privileges Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-28915: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs FileProvider Available for: macOS Sequoia Impact: An app may be able to access sensitive user data Description: A race condition was addressed with additional validation. CVE-2026-43659: Alex Radocea GPU Drivers Available for: macOS Sequoia Impact: A malicious app may be able to break out of its sandbox Description: A logging issue was addressed with improved data redaction. CVE-2026-28923: Kun Peeks (@SwayZGl1tZyyy) HFS Available for: macOS Sequoia Impact: An app may be able to cause unexpected system termination or write kernel memory Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-28925: Dave G., Aswin Kumar Gokula Kannan Icons Available for: macOS Sequoia Impact: An app may be able to break out of its sandbox Description: An access issue was addressed with additional sandbox restrictions. CVE-2025-43524: Csaba Fitzl (@theevilbit) of Iru ImageIO Available for: macOS Sequoia Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: The issue was addressed with improved bounds checks. CVE-2026-28977: Suresh Sundaram ImageIO Available for: macOS Sequoia Impact: Processing a maliciously crafted image may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-28990: Jiri Ha, Arni Hardarson Installer Available for: macOS Sequoia Impact: A malicious app may be able to break out of its sandbox Description: A permissions issue was addressed with additional restrictions. CVE-2026-28978: wdszzml and Atuin Automated Vulnerability Discovery Engine IOHIDFamily Available for: macOS Sequoia Impact: An attacker may be able to cause unexpected app termination Description: A memory corruption vulnerability was addressed with improved locking. CVE-2026-28992: Johnny Franks (@zeroxjf) IOHIDFamily Available for: macOS Sequoia Impact: An app may be able to determine kernel memory layout Description: A logging issue was addressed with improved data redaction. CVE-2026-28943: Google Threat Analysis Group IOKit Available for: macOS Sequoia Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-28969: Mihalis Haatainen, Ari Hawking, Ashish Kunwar Kernel Available for: macOS Sequoia Impact: An app may be able to disclose kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-43654: Vaagn Vardanian, Nathaniel Oh (@calysteon) Kernel Available for: macOS Sequoia Impact: A maliciously crafted disk image may bypass Gatekeeper checks Description: A file quarantine bypass was addressed with additional checks. CVE-2026-28954: Yiğit Can YILMAZ (@yilmazcanyigit) Kernel Available for: macOS Sequoia Impact: A local user may be able to cause unexpected system termination or read kernel memory Description: A buffer overflow was addressed with improved input validation. CVE-2026-28897: Robert Tran, popku1337, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Aswin kumar Gokulakannan Kernel Available for: macOS Sequoia Impact: An app may be able to cause unexpected system termination Description: An integer overflow was addressed with improved input validation. CVE-2026-28952: Calif.io in collaboration with Claude and Anthropic Research Kernel Available for: macOS Sequoia Impact: An app may be able to modify protected parts of the file system Description: A denial of service issue was addressed by removing the vulnerable code. CVE-2026-28908: beist Kernel Available for: macOS Sequoia Impact: An app may be able to gain root privileges Description: An authorization issue was addressed with improved state management. CVE-2026-28951: Csaba Fitzl (@theevilbit) of Iru Kernel Available for: macOS Sequoia Impact: An app may be able to cause unexpected system termination or write kernel memory Description: An out-of-bounds write issue was addressed with improved input validation. CVE-2026-28972: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io) Kernel Available for: macOS Sequoia Impact: An app may be able to cause unexpected system termination Description: A race condition was addressed with additional validation. CVE-2026-28986: Tristan Madani (@TristanInSec) from Talence Security, Ryan Hileman via Xint Code (xint.io), Chris Betz Kernel Available for: macOS Sequoia Impact: An app may be able to leak sensitive kernel state Description: A logging issue was addressed with improved data redaction. CVE-2026-28987: Dhiyanesh Selvaraj (@redroot97) Mail Drafts Available for: macOS Sequoia Impact: Replying to an email could display remote images in Mail in Lockdown Mode Description: A logic issue was addressed with improved checks. CVE-2026-28929: Yiğit Can YILMAZ (@yilmazcanyigit) mDNSResponder Available for: macOS Sequoia Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2026-43668: Ricardo Prado, Anton Pakhunov mDNSResponder Available for: macOS Sequoia Impact: An attacker on the local network may be able to cause a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43666: Ian van der Wurff (ian.nl) Model I/O Available for: macOS Sequoia Impact: Processing a maliciously crafted image may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-28940: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative Model I/O Available for: macOS Sequoia Impact: Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents Description: The issue was addressed with improved checks. CVE-2026-28941: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative Networking Available for: macOS Sequoia Impact: An attacker may be able to track users through their IP address Description: This issue was addressed through improved state management. CVE-2026-28906: Ilya Sc. Jowell A. PackageKit Available for: macOS Sequoia Impact: An app may be able to gain root privileges Description: A permissions issue was addressed with additional restrictions. CVE-2026-28840: Morris Richman (@morrisinlife), Andrei Dodu Quick Look Available for: macOS Sequoia Impact: Parsing a maliciously crafted file may lead to an unexpected app termination Description: An out-of-bounds write issue was addressed with improved input validation. CVE-2026-43656: Peter Malone SceneKit Available for: macOS Sequoia Impact: Processing a maliciously crafted image may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-39870: Peter Malone SceneKit Available for: macOS Sequoia Impact: A remote attacker may be able to cause unexpected app termination Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-28846: Peter Malone Shortcuts Available for: macOS Sequoia Impact: An app may be able to access user-sensitive data Description: This issue was addressed by adding an additional prompt for user consent. CVE-2026-28993: Doron Assness SMB Available for: macOS Sequoia Impact: A remote attacker may be able to cause unexpected system termination Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-28848: Peter Malone, Dave G. and Alex Radocea of Supernetworks Spotlight Available for: macOS Sequoia Impact: An app may be able to cause a denial-of-service Description: This issue was addressed with improved checks to prevent unauthorized actions. CVE-2026-28974: Andy Koo (@andykoo) of Hexens Storage Available for: macOS Sequoia Impact: An app may be able to access sensitive user data Description: A race condition was addressed with additional validation. CVE-2026-28996: Alex Radocea StorageKit Available for: macOS Sequoia Impact: An app may be able to gain root privileges Description: A consistency issue was addressed with improved state handling. CVE-2026-28919: Amy (amys.website) Sync Services Available for: macOS Sequoia Impact: An app may be able to access Contacts without user consent Description: A race condition was addressed with improved handling of symbolic links. CVE-2026-28924: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs TV App Available for: macOS Sequoia Impact: An app may be able to observe unprotected user data Description: A path handling issue was addressed with improved logic. CVE-2026-39871: an anonymous researcher Wi-Fi Available for: macOS Sequoia Impact: An app may be able to execute arbitrary code with kernel privileges Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-28819: Wang Yu Wi-Fi Available for: macOS Sequoia Impact: An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets Description: A use after free issue was addressed with improved memory management. CVE-2026-28994: Alex Radocea zlib Available for: macOS Sequoia Impact: Visiting a maliciously crafted website may leak sensitive data Description: An information leakage was addressed with additional validation. CVE-2026-28920: Brendon Tiszka of Google Project Zero Additional recognition Kernel We would like to acknowledge Ryan Hileman via Xint Code (xint.io) for their assistance. Location We would like to acknowledge Kun Peeks (@SwayZGl1tZyyy) for their assistance. OpenSSH We would like to acknowledge Anand Patil for their assistance. macOS Sequoia 15.7.7 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNw
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Apple Macos Sequoia Affected: unknown
    		Create a notification for this product.
    Credits
    Apple Product Security via Fulldisclosure
    Relationships
    reference GCVE-1988-2026-0334 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Macos Sequoia",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-05-11-2026-7 macOS Sequoia 15.7.7\n\nmacOS Sequoia 15.7.7 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/127116.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAPFS\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28959: Dave G.\n\nAppleJPEG\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted media file may lead to\nunexpected app termination or corrupt process memory\nDescription: A memory corruption issue was addressed with improved input\nvalidation.\nCVE-2026-28956: impost0r (ret2plt)\n\nAudio\nAvailable for: macOS Sequoia\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-39869: David Ige of Beryllium Security\n\nCoreMedia\nAvailable for: macOS Sequoia\nImpact: An app may be able to access private information\nDescription: This issue was addressed through improved state management.\nCVE-2026-28922: Arni Hardarson\n\nCrash Reporter\nAvailable for: macOS Sequoia\nImpact: An app may be able to enumerate a user\u0027s installed apps\nDescription: A privacy issue was addressed by removing sensitive data.\nCVE-2026-28878: Zhongcheng Li from IES Red Team\n\nCUPS\nAvailable for: macOS Sequoia\nImpact: An app may be able to gain root privileges\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-28915: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nFileProvider\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with additional validation.\nCVE-2026-43659: Alex Radocea\n\nGPU Drivers\nAvailable for: macOS Sequoia\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28923: Kun Peeks (@SwayZGl1tZyyy)\n\nHFS\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28925: Dave G., Aswin Kumar Gokula Kannan\n\nIcons\nAvailable for: macOS Sequoia\nImpact: An app may be able to break out of its sandbox\nDescription: An access issue was addressed with additional sandbox\nrestrictions.\nCVE-2025-43524: Csaba Fitzl (@theevilbit) of Iru\n\nImageIO\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-28977: Suresh Sundaram\n\nImageIO\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-28990: Jiri Ha, Arni Hardarson\n\nInstaller\nAvailable for: macOS Sequoia\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28978: wdszzml and Atuin Automated Vulnerability Discovery\nEngine\n\nIOHIDFamily\nAvailable for: macOS Sequoia\nImpact: An attacker may be able to cause unexpected app termination\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nCVE-2026-28992: Johnny Franks (@zeroxjf)\n\nIOHIDFamily\nAvailable for: macOS Sequoia\nImpact: An app may be able to determine kernel memory layout\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28943: Google Threat Analysis Group\n\nIOKit\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28969: Mihalis Haatainen, Ari Hawking, Ashish Kunwar\n\nKernel\nAvailable for: macOS Sequoia\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43654: Vaagn Vardanian, Nathaniel Oh (@calysteon)\n\nKernel\nAvailable for: macOS Sequoia\nImpact: A maliciously crafted disk image may bypass Gatekeeper checks\nDescription: A file quarantine bypass was addressed with additional\nchecks.\nCVE-2026-28954: Yi\u011fit Can YILMAZ (@yilmazcanyigit)\n\nKernel\nAvailable for: macOS Sequoia\nImpact: A local user may be able to cause unexpected system termination\nor read kernel memory\nDescription: A buffer overflow was addressed with improved input\nvalidation.\nCVE-2026-28897: Robert Tran, popku1337, Billy Jheng Bing Jhong and Pan\nZhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Aswin kumar\nGokulakannan\n\nKernel\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-28952: Calif.io in collaboration with Claude and Anthropic\nResearch\n\nKernel\nAvailable for: macOS Sequoia\nImpact: An app may be able to modify protected parts of the file system\nDescription: A denial of service issue was addressed by removing the\nvulnerable code.\nCVE-2026-28908: beist\n\nKernel\nAvailable for: macOS Sequoia\nImpact: An app may be able to gain root privileges\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-28951: Csaba Fitzl (@theevilbit) of Iru\n\nKernel\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\ninput validation.\nCVE-2026-28972: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with additional validation.\nCVE-2026-28986: Tristan Madani (@TristanInSec) from Talence Security,\nRyan Hileman via Xint Code (xint.io), Chris Betz\n\nKernel\nAvailable for: macOS Sequoia\nImpact: An app may be able to leak sensitive kernel state\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28987: Dhiyanesh Selvaraj (@redroot97)\n\nMail Drafts\nAvailable for: macOS Sequoia\nImpact: Replying to an email could display remote images in Mail in\nLockdown Mode\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-28929: Yi\u011fit Can YILMAZ (@yilmazcanyigit)\n\nmDNSResponder\nAvailable for: macOS Sequoia\nImpact: A remote attacker may be able to cause unexpected system\ntermination or corrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43668: Ricardo Prado, Anton Pakhunov\n\nmDNSResponder\nAvailable for: macOS Sequoia\nImpact: An attacker on the local network may be able to cause a\ndenial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43666: Ian van der Wurff (ian.nl)\n\nModel I/O\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-28940: Michael DePlante (@izobashi) of TrendAI Zero Day\nInitiative\n\nModel I/O\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted file may lead to a\ndenial-of-service or potentially disclose memory contents\nDescription: The issue was addressed with improved checks.\nCVE-2026-28941: Michael DePlante (@izobashi) of TrendAI Zero Day\nInitiative\n\nNetworking\nAvailable for: macOS Sequoia\nImpact: An attacker may be able to track users through their IP address\nDescription: This issue was addressed through improved state management.\nCVE-2026-28906: Ilya Sc. Jowell A.\n\nPackageKit\nAvailable for: macOS Sequoia\nImpact: An app may be able to gain root privileges\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28840: Morris Richman (@morrisinlife), Andrei Dodu\n\nQuick Look\nAvailable for: macOS Sequoia\nImpact: Parsing a maliciously crafted file may lead to an unexpected app\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\ninput validation.\nCVE-2026-43656: Peter Malone\n\nSceneKit\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-39870: Peter Malone\n\nSceneKit\nAvailable for: macOS Sequoia\nImpact: A remote attacker may be able to cause unexpected app\ntermination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28846: Peter Malone\n\nShortcuts\nAvailable for: macOS Sequoia\nImpact: An app may be able to access user-sensitive data\nDescription: This issue was addressed by adding an additional prompt for\nuser consent.\nCVE-2026-28993: Doron Assness\n\nSMB\nAvailable for: macOS Sequoia\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28848: Peter Malone, Dave G. and Alex Radocea of Supernetworks\n\nSpotlight\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause a denial-of-service\nDescription: This issue was addressed with improved checks to prevent\nunauthorized actions.\nCVE-2026-28974: Andy Koo (@andykoo) of Hexens\n\nStorage\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with additional validation.\nCVE-2026-28996: Alex Radocea\n\nStorageKit\nAvailable for: macOS Sequoia\nImpact: An app may be able to gain root privileges\nDescription: A consistency issue was addressed with improved state\nhandling.\nCVE-2026-28919: Amy (amys.website)\n\nSync Services\nAvailable for: macOS Sequoia\nImpact: An app may be able to access Contacts without user consent\nDescription: A race condition was addressed with improved handling of\nsymbolic links.\nCVE-2026-28924: YingQi Shi (@Mas0nShi) of DBAppSecurity\u0027s WeBin lab,\nAndreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nTV App\nAvailable for: macOS Sequoia\nImpact: An app may be able to observe unprotected user data\nDescription: A path handling issue was addressed with improved logic.\nCVE-2026-39871: an anonymous researcher\n\nWi-Fi\nAvailable for: macOS Sequoia\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-28819: Wang Yu\n\nWi-Fi\nAvailable for: macOS Sequoia\nImpact: An attacker in a privileged network position may be able to\nperform denial-of-service attack using crafted Wi-Fi packets\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28994: Alex Radocea\n\nzlib\nAvailable for: macOS Sequoia\nImpact: Visiting a maliciously crafted website may leak sensitive data\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-28920: Brendon Tiszka of Google Project Zero\n\nAdditional recognition\n\nKernel\nWe would like to acknowledge Ryan Hileman via Xint Code (xint.io) for\ntheir assistance.\n\nLocation\nWe would like to acknowledge Kun Peeks (@SwayZGl1tZyyy) for their\nassistance.\n\nOpenSSH\nWe would like to acknowledge Anand Patil for their assistance.\n\nmacOS Sequoia 15.7.7 may be obtained from the Mac App Store or Apple\u0027s\nSoftware Downloads web site: https://support.apple.com/downloads/\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNw"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:28:25Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/12"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/12"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/downloads/"
        },
        {
          "url": "https://support.apple.com/en-us/127116"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/12"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-05-11-2026-7 macOS Sequoia 15.7.7",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-43524",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28819",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28840",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28846",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28848",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28878",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28897",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28906",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28908",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28915",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28919",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28920",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28922",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28923",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28924",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28925",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28929",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28940",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28941",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28943",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28951",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28952",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28954",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28956",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28959",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28969",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28972",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28974",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28977",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28978",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28986",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28987",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28990",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28992",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28993",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28994",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28996",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39869",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39870",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39871",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43654",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43656",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43659",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43666",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43668",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0334",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/12",
            "automated": true,
            "contentSha256": "8afb0d0534235069df9276cbbd4a90e94f80c6d1a3ed2096a6f25f0738e7a3fb",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/12",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-11T22:33:20Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0334"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:56Z",
    "dateUpdated": "2026-09-11T11:28:25Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0334"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0336

    Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 11:28
    VLAI
    Title
    APPLE-SA-05-11-2026-9 tvOS 26.5
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-05-11-2026-9 tvOS 26.5 tvOS 26.5 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/127118. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accelerate Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-28991: Seiji Sakurai (@HeapSmasher) APFS Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to cause unexpected system termination Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-28959: Dave G. App Intents Available for: Apple TV HD and Apple TV 4K (all models) Impact: A malicious app may be able to break out of its sandbox Description: A logic issue was addressed with improved restrictions. CVE-2026-28995: Vamshi Paili, Tony Gorez (@tonygo_) for Reverse Society AppleJPEG Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing a maliciously crafted image may lead to a denial-of-service Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2026-1837 AppleJPEG Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory Description: A memory corruption issue was addressed with improved input validation. CVE-2026-28956: impost0r (ret2plt) Audio Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: The issue was addressed with improved memory handling. CVE-2026-39869: David Ige of Beryllium Security CoreSymbolication Available for: Apple TV HD and Apple TV 4K (all models) Impact: Parsing a maliciously crafted file may lead to an unexpected app termination Description: An out-of-bounds access issue was addressed with improved bounds checking. CVE-2026-28918: Niels Hofmans, Anonymous working with TrendAI Zero Day Initiative ImageIO Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing a maliciously crafted image may corrupt process memory Description: A buffer overflow issue was addressed with improved memory handling. CVE-2026-43661: an anonymous researcher ImageIO Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: The issue was addressed with improved bounds checks. CVE-2026-28977: Suresh Sundaram ImageIO Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing a maliciously crafted image may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-28990: Jiri Ha, Arni Hardarson IOHIDFamily Available for: Apple TV HD and Apple TV 4K (all models) Impact: An attacker may be able to cause unexpected app termination Description: A memory corruption vulnerability was addressed with improved locking. CVE-2026-28992: Johnny Franks (@zeroxjf) IOHIDFamily Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to determine kernel memory layout Description: A logging issue was addressed with improved data redaction. CVE-2026-28943: Google Threat Analysis Group IOKit Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-28969: Mihalis Haatainen, Ari Hawking, Ashish Kunwar IOSurfaceAccelerator Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-43655: Somair Ansar and an anonymous researcher Kernel Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to disclose kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-43654: Vaagn Vardanian, Nathaniel Oh (@calysteon) Kernel Available for: Apple TV HD and Apple TV 4K (all models) Impact: A local user may be able to cause unexpected system termination or read kernel memory Description: A buffer overflow was addressed with improved input validation. CVE-2026-28897: popku1337, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Robert Tran, Aswin kumar Gokulakannan Kernel Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to cause unexpected system termination or write kernel memory Description: An out-of-bounds write issue was addressed with improved input validation. CVE-2026-28972: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io) Kernel Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to cause unexpected system termination Description: A race condition was addressed with additional validation. CVE-2026-28986: Chris Betz, Tristan Madani (@TristanInSec) from Talence Security, Ryan Hileman via Xint Code (xint.io) Kernel Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to leak sensitive kernel state Description: A logging issue was addressed with improved data redaction. CVE-2026-28987: Dhiyanesh Selvaraj (@redroot97) LaunchServices Available for: Apple TV HD and Apple TV 4K (all models) Impact: A remote attacker may be able to cause a denial of service Description: A type confusion issue was addressed with improved checks. CVE-2026-28983: Ruslan Dautov mDNSResponder Available for: Apple TV HD and Apple TV 4K (all models) Impact: An attacker on the local network may be able to cause a denial-of-service Description: The issue was addressed with improved memory handling. CVE-2026-43653: Atul R V mDNSResponder Available for: Apple TV HD and Apple TV 4K (all models) Impact: An attacker on the local network may be able to cause a denial-of-service Description: A null pointer dereference was addressed with improved input validation. CVE-2026-28985: Omar Cerrito mDNSResponder Available for: Apple TV HD and Apple TV 4K (all models) Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2026-43668: Anton Pakhunov, Ricardo Prado mDNSResponder Available for: Apple TV HD and Apple TV 4K (all models) Impact: An attacker on the local network may be able to cause a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43666: Ian van der Wurff (ian.nl) Model I/O Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing a maliciously crafted image may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-28940: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative SceneKit Available for: Apple TV HD and Apple TV 4K (all models) Impact: A remote attacker may be able to cause unexpected app termination Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-28846: Peter Malone Spotlight Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to cause a denial-of-service Description: This issue was addressed with improved checks to prevent unauthorized actions. CVE-2026-28974: Andy Koo (@andykoo) of Hexens Storage Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to access sensitive user data Description: A race condition was addressed with additional validation. CVE-2026-28996: Alex Radocea WebKit Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced Description: A validation issue was addressed with improved logic. WebKit Bugzilla: 308906 CVE-2026-43660: Cantina WebKit Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced Description: The issue was addressed with improved input validation. WebKit Bugzilla: 308675 CVE-2026-28907: Cantina WebKit Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 307669 CVE-2026-43658: Do Young Park WebKit Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 308545 CVE-2026-28905: Yuhao Hu, Yuanming Lai, Chenggang Wu, and Zhe Wang WebKit Bugzilla: 308707 CVE-2026-28847: DARKNAVY (@DarkNavyOrg), Anonymous working with TrendAI Zero Day Initiative, Daniel Rhea WebKit Bugzilla: 309601 CVE-2026-28904: Luka Rački WebKit Bugzilla: 310880 CVE-2026-28955: wac and Kookhwan Lee working with TrendAI Zero Day Initiative WebKit Bugzilla: 310303 CVE-2026-28903: Mateusz Krzywicki (iVerify.io) WebKit Bugzilla: 309628 CVE-2026-28953: Maher Azzouzi WebKit Bugzilla: 309861 CVE-2026-28902: Tristan Madani (@TristanInSec) from Talence Security, Nathaniel Oh (@calysteon) WebKit Bugzilla: 310207 CVE-2026-28901: Aisle offensive security research team (Joshua Rogers, Luigino Camastra, Igor Morgenstern, and Guido Vranken), Maher Azzouzi, Ngan Nguyen of Calif.io WebKit Bugzilla: 311631 CVE-2026-28913: an anonymous researcher WebKit Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 313939 CVE-2026-28883: kwak kiyong / kakaogames WebKit Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: The issue was addressed with improved input validation. WebKit Bugzilla: 310527 CVE-2026-28917: Vitaly Simonovich WebKit Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 310234 CVE-2026-28947: dr3dd WebKit Bugzilla: 312180 CVE-2026-28942: Milad Nasr and Nicholas Carlini with Claude, Anthropic Wi-Fi Available for: Apple TV HD and Apple TV 4K (all models) Impact: An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets Description: A use after free issue was addressed with improved memory management. CVE-2026-28994: Alex Radocea zlib Available for: Apple TV HD and Apple TV 4K (all models) Impact: Visiting a maliciously crafted website may leak sensitive data Description: An information leakage was addressed with additional validation. CVE-2026-28920: Brendon Tiszka of Google Project Zero Additional recognition App Intents We would like to acknowledge Mikael Kinnman for their assistance. Apple Account We would like to acknowledge Iván Savransky, YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab for their assistance. AuthKit We would like to acknowledge Gongyu Ma (@Mezone0) for their assistance. CoreUI We would like to acknowledge Mustafa Calap ​ fo
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Apple Tvos Affected: unknown
    		Create a notification for this product.
    Credits
    Apple Product Security via Fulldisclosure
    Relationships
    reference GCVE-1988-2026-0336 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Tvos",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-05-11-2026-9 tvOS 26.5\n\ntvOS 26.5 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/127118.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccelerate\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-28991: Seiji Sakurai (@HeapSmasher)\n\nAPFS\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28959: Dave G.\n\nApp Intents\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A logic issue was addressed with improved restrictions.\nCVE-2026-28995: Vamshi Paili, Tony Gorez (@tonygo_) for Reverse Society\n\nAppleJPEG\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted image may lead to a\ndenial-of-service\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-1837\n\nAppleJPEG\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted media file may lead to\nunexpected app termination or corrupt process memory\nDescription: A memory corruption issue was addressed with improved input\nvalidation.\nCVE-2026-28956: impost0r (ret2plt)\n\nAudio\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-39869: David Ige of Beryllium Security\n\nCoreSymbolication\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Parsing a maliciously crafted file may lead to an unexpected app\ntermination\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-28918: Niels Hofmans, Anonymous working with TrendAI Zero Day\nInitiative\n\nImageIO\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: A buffer overflow issue was addressed with improved memory\nhandling.\nCVE-2026-43661: an anonymous researcher\n\nImageIO\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-28977: Suresh Sundaram\n\nImageIO\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-28990: Jiri Ha, Arni Hardarson\n\nIOHIDFamily\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An attacker may be able to cause unexpected app termination\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nCVE-2026-28992: Johnny Franks (@zeroxjf)\n\nIOHIDFamily\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to determine kernel memory layout\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28943: Google Threat Analysis Group\n\nIOKit\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28969: Mihalis Haatainen, Ari Hawking, Ashish Kunwar\n\nIOSurfaceAccelerator\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination or\nread kernel memory\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43655: Somair Ansar and an anonymous researcher\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43654: Vaagn Vardanian, Nathaniel Oh (@calysteon)\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: A local user may be able to cause unexpected system termination\nor read kernel memory\nDescription: A buffer overflow was addressed with improved input\nvalidation.\nCVE-2026-28897: popku1337, Billy Jheng Bing Jhong and Pan Zhenpeng\n(@Peterpan0927) of STAR Labs SG Pte. Ltd., Robert Tran, Aswin kumar\nGokulakannan\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\ninput validation.\nCVE-2026-28972: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with additional validation.\nCVE-2026-28986: Chris Betz, Tristan Madani (@TristanInSec) from Talence\nSecurity, Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to leak sensitive kernel state\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28987: Dhiyanesh Selvaraj (@redroot97)\n\nLaunchServices\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: A remote attacker may be able to cause a denial of service\nDescription: A type confusion issue was addressed with improved checks.\nCVE-2026-28983: Ruslan Dautov\n\nmDNSResponder\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An attacker on the local network may be able to cause a\ndenial-of-service\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43653: Atul R V\n\nmDNSResponder\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An attacker on the local network may be able to cause a\ndenial-of-service\nDescription: A null pointer dereference was addressed with improved\ninput validation.\nCVE-2026-28985: Omar Cerrito\n\nmDNSResponder\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: A remote attacker may be able to cause unexpected system\ntermination or corrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43668: Anton Pakhunov, Ricardo Prado\n\nmDNSResponder\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An attacker on the local network may be able to cause a\ndenial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43666: Ian van der Wurff (ian.nl)\n\nModel I/O\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-28940: Michael DePlante (@izobashi) of TrendAI Zero Day\nInitiative\n\nSceneKit\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: A remote attacker may be able to cause unexpected app\ntermination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28846: Peter Malone\n\nSpotlight\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause a denial-of-service\nDescription: This issue was addressed with improved checks to prevent\nunauthorized actions.\nCVE-2026-28974: Andy Koo (@andykoo) of Hexens\n\nStorage\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with additional validation.\nCVE-2026-28996: Alex Radocea\n\nWebKit\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing maliciously crafted web content may prevent Content\nSecurity Policy from being enforced\nDescription: A validation issue was addressed with improved logic.\nWebKit Bugzilla: 308906\nCVE-2026-43660: Cantina\n\nWebKit\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing maliciously crafted web content may prevent Content\nSecurity Policy from being enforced\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 308675\nCVE-2026-28907: Cantina\n\nWebKit\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 307669\nCVE-2026-43658: Do Young Park\n\nWebKit\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 308545\nCVE-2026-28905: Yuhao Hu, Yuanming Lai, Chenggang Wu, and Zhe Wang\nWebKit Bugzilla: 308707\nCVE-2026-28847: DARKNAVY (@DarkNavyOrg), Anonymous working with TrendAI\nZero Day Initiative, Daniel Rhea\nWebKit Bugzilla: 309601\nCVE-2026-28904: Luka Ra\u010dki\nWebKit Bugzilla: 310880\nCVE-2026-28955: wac and Kookhwan Lee working with TrendAI Zero Day\nInitiative\nWebKit Bugzilla: 310303\nCVE-2026-28903: Mateusz Krzywicki (iVerify.io)\nWebKit Bugzilla: 309628\nCVE-2026-28953: Maher Azzouzi\nWebKit Bugzilla: 309861\nCVE-2026-28902: Tristan Madani (@TristanInSec) from Talence Security,\nNathaniel Oh (@calysteon)\nWebKit Bugzilla: 310207\nCVE-2026-28901: Aisle offensive security research team (Joshua Rogers,\nLuigino Camastra, Igor Morgenstern, and Guido Vranken), Maher Azzouzi,\nNgan Nguyen of Calif.io\nWebKit Bugzilla: 311631\nCVE-2026-28913: an anonymous researcher\n\nWebKit\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313939\nCVE-2026-28883: kwak kiyong / kakaogames\n\nWebKit\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 310527\nCVE-2026-28917: Vitaly Simonovich\n\nWebKit\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 310234\nCVE-2026-28947: dr3dd\nWebKit Bugzilla: 312180\nCVE-2026-28942: Milad Nasr and Nicholas Carlini with Claude, Anthropic\n\nWi-Fi\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An attacker in a privileged network position may be able to\nperform denial-of-service attack using crafted Wi-Fi packets\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28994: Alex Radocea\n\nzlib\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Visiting a maliciously crafted website may leak sensitive data\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-28920: Brendon Tiszka of Google Project Zero\n\nAdditional recognition\n\nApp Intents\nWe would like to acknowledge Mikael Kinnman for their assistance.\n\nApple Account\nWe would like to acknowledge Iv\u00e1n Savransky, YingQi Shi (@Mas0nShi) of\nDBAppSecurity\u0027s WeBin lab for their assistance.\n\nAuthKit\nWe would like to acknowledge Gongyu Ma (@Mezone0) for their assistance.\n\nCoreUI\nWe would like to acknowledge Mustafa Calap \u200b fo"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:28:28Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/13"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/13"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/en-us/127118"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/13"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-05-11-2026-9 tvOS 26.5",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-1837",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28846",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28847",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28883",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28897",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28901",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28902",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28903",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28904",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28905",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28907",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28913",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28917",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28918",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28920",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28940",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28942",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28943",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28947",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28953",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28955",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28956",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28959",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28969",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28972",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28974",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28977",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28983",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28985",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28986",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28987",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28990",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28991",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28992",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28994",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28995",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28996",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39869",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43653",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43654",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43655",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43658",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43660",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43661",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43666",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43668",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0336",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/13",
            "automated": true,
            "contentSha256": "d2601279c96ad136c02829f670d7529562d8d9e35fc443c95372b638a08471bb",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/13",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-11T22:34:23Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0336"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:56Z",
    "dateUpdated": "2026-09-11T11:28:28Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0336"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0335

    Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 11:28
    VLAI
    Title
    APPLE-SA-05-11-2026-8 macOS Sonoma 14.8.7
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-05-11-2026-8 macOS Sonoma 14.8.7 macOS Sonoma 14.8.7 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/127117. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. APFS Available for: macOS Sonoma Impact: An app may be able to cause unexpected system termination Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-28959: Dave G. AppleJPEG Available for: macOS Sonoma Impact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory Description: A memory corruption issue was addressed with improved input validation. CVE-2026-28956: impost0r (ret2plt) Audio Available for: macOS Sonoma Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: The issue was addressed with improved memory handling. CVE-2026-39869: David Ige of Beryllium Security CoreMedia Available for: macOS Sonoma Impact: An app may be able to access private information Description: This issue was addressed through improved state management. CVE-2026-28922: Arni Hardarson CoreServices Available for: macOS Sonoma Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: The issue was addressed with improved checks. CVE-2026-28936: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs CUPS Available for: macOS Sonoma Impact: An app may be able to gain root privileges Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-28915: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs FileProvider Available for: macOS Sonoma Impact: An app may be able to access sensitive user data Description: A race condition was addressed with additional validation. CVE-2026-43659: Alex Radocea GPU Drivers Available for: macOS Sonoma Impact: A malicious app may be able to break out of its sandbox Description: A logging issue was addressed with improved data redaction. CVE-2026-28923: Kun Peeks (@SwayZGl1tZyyy) HFS Available for: macOS Sonoma Impact: An app may be able to cause unexpected system termination or write kernel memory Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-28925: Dave G., Aswin Kumar Gokula Kannan Icons Available for: macOS Sonoma Impact: An app may be able to break out of its sandbox Description: An access issue was addressed with additional sandbox restrictions. CVE-2025-43524: Csaba Fitzl (@theevilbit) of Iru ImageIO Available for: macOS Sonoma Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: The issue was addressed with improved bounds checks. CVE-2026-28977: Suresh Sundaram ImageIO Available for: macOS Sonoma Impact: Processing a maliciously crafted image may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-28990: Jiri Ha, Arni Hardarson Installer Available for: macOS Sonoma Impact: A malicious app may be able to break out of its sandbox Description: A permissions issue was addressed with additional restrictions. CVE-2026-28978: wdszzml and Atuin Automated Vulnerability Discovery Engine IOHIDFamily Available for: macOS Sonoma Impact: An attacker may be able to cause unexpected app termination Description: A memory corruption vulnerability was addressed with improved locking. CVE-2026-28992: Johnny Franks (@zeroxjf) IOHIDFamily Available for: macOS Sonoma Impact: An app may be able to determine kernel memory layout Description: A logging issue was addressed with improved data redaction. CVE-2026-28943: Google Threat Analysis Group IOKit Available for: macOS Sonoma Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-28969: Mihalis Haatainen, Ari Hawking, Ashish Kunwar Kernel Available for: macOS Sonoma Impact: An app may be able to disclose kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-43654: Vaagn Vardanian, Nathaniel Oh (@calysteon) Kernel Available for: macOS Sonoma Impact: A maliciously crafted disk image may bypass Gatekeeper checks Description: A file quarantine bypass was addressed with additional checks. CVE-2026-28954: Yiğit Can YILMAZ (@yilmazcanyigit) Kernel Available for: macOS Sonoma Impact: A local user may be able to cause unexpected system termination or read kernel memory Description: A buffer overflow was addressed with improved input validation. CVE-2026-28897: Robert Tran, popku1337, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Aswin kumar Gokulakannan Kernel Available for: macOS Sonoma Impact: An app may be able to cause unexpected system termination Description: An integer overflow was addressed with improved input validation. CVE-2026-28952: Calif.io in collaboration with Claude and Anthropic Research Kernel Available for: macOS Sonoma Impact: An app may be able to modify protected parts of the file system Description: A denial of service issue was addressed by removing the vulnerable code. CVE-2026-28908: beist Kernel Available for: macOS Sonoma Impact: An app may be able to gain root privileges Description: An authorization issue was addressed with improved state management. CVE-2026-28951: Csaba Fitzl (@theevilbit) of Iru Kernel Available for: macOS Sonoma Impact: An app may be able to cause unexpected system termination or write kernel memory Description: An out-of-bounds write issue was addressed with improved input validation. CVE-2026-28972: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io) Kernel Available for: macOS Sonoma Impact: An app may be able to cause unexpected system termination Description: A race condition was addressed with additional validation. CVE-2026-28986: Tristan Madani (@TristanInSec) from Talence Security, Ryan Hileman via Xint Code (xint.io), Chris Betz Kernel Available for: macOS Sonoma Impact: An app may be able to leak sensitive kernel state Description: A logging issue was addressed with improved data redaction. CVE-2026-28987: Dhiyanesh Selvaraj (@redroot97) Mail Drafts Available for: macOS Sonoma Impact: Replying to an email could display remote images in Mail in Lockdown Mode Description: A logic issue was addressed with improved checks. CVE-2026-28929: Yiğit Can YILMAZ (@yilmazcanyigit) mDNSResponder Available for: macOS Sonoma Impact: An attacker on the local network may be able to cause a denial-of-service Description: The issue was addressed with improved memory handling. CVE-2026-43653: Atul R V mDNSResponder Available for: macOS Sonoma Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2026-43668: Anton Pakhunov, Ricardo Prado mDNSResponder Available for: macOS Sonoma Impact: An attacker on the local network may be able to cause a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43666: Ian van der Wurff (ian.nl) Networking Available for: macOS Sonoma Impact: An attacker may be able to track users through their IP address Description: This issue was addressed through improved state management. CVE-2026-28906: Ilya Sc. Jowell A. PackageKit Available for: macOS Sonoma Impact: An app may be able to gain root privileges Description: A permissions issue was addressed with additional restrictions. CVE-2026-28840: Morris Richman (@morrisinlife), Andrei Dodu Quick Look Available for: macOS Sonoma Impact: Parsing a maliciously crafted file may lead to an unexpected app termination Description: An out-of-bounds write issue was addressed with improved input validation. CVE-2026-43656: Peter Malone SceneKit Available for: macOS Sonoma Impact: Processing a maliciously crafted image may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-39870: Peter Malone SceneKit Available for: macOS Sonoma Impact: A remote attacker may be able to cause unexpected app termination Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-28846: Peter Malone Shortcuts Available for: macOS Sonoma Impact: An app may be able to access user-sensitive data Description: This issue was addressed by adding an additional prompt for user consent. CVE-2026-28993: Doron Assness Storage Available for: macOS Sonoma Impact: An app may be able to access sensitive user data Description: A race condition was addressed with additional validation. CVE-2026-28996: Alex Radocea StorageKit Available for: macOS Sonoma Impact: An app may be able to gain root privileges Description: A consistency issue was addressed with improved state handling. CVE-2026-28919: Amy (amys.website) Sync Services Available for: macOS Sonoma Impact: An app may be able to access Contacts without user consent Description: A race condition was addressed with improved handling of symbolic links. CVE-2026-28924: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs TV App Available for: macOS Sonoma Impact: An app may be able to observe unprotected user data Description: A path handling issue was addressed with improved logic. CVE-2026-39871: an anonymous researcher Wi-Fi Available for: macOS Sonoma Impact: An app may be able to execute arbitrary code with kernel privileges Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-28819: Wang Yu Wi-Fi Available for: macOS Sonoma Impact: An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets Description: A use after free issue was addressed with improved memory management. CVE-2026-28994: Alex Radocea zlib Available for: macOS Sonoma Impact: Visiting a maliciously crafted website may leak sensitive data Description: An information leakage was addressed with additional validation. CVE-2026-28920: Brendon Tiszka of Google Project Zero Additional recognition Kernel We would like to acknowledge Ryan Hileman via Xint Code (xint.io) for their assistance. macOS Sonoma 14.8.7 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmoCVlYACgkQ4Ifiq8DH 7PVp5w//SglYZemu6sqjanvv4ERY0GWQbGtGOPxHspofA4uQoXGRylcbcHVOYLdV THJRmh8ycwM38xi+Md2bDeCPhCFANN1GGQHmu2rgGITd7XHkWRkRXixpvjmObm77 LWPe/jMmVM8bug7U5cfUeuX+r/lsxoC2nFonlrD/D9NCLURnxdLgcka6NDYwGX7j HknZUf2pW4LOTiVa12DgrEMrGnq/lf2Jbn3BrNWn8RRSXD9FiuSY5C7HmkRDThyq v+1bKO8NeCxrVfFwrkXMwb4TmCwuTDLz215ZOzMj9FQqBU5MdLevKf5KYZNu9y61 KuNo6Jvhmo2V9gn4P7yZSr5SpcCFFZevjrDldyDBrbVsp2zjyoXECfhvszHhjTB2 tI2wywFgCwreLM2xxSiySTeBTqTgoEyUv1Kry+47CvROMn1XgGojVHg37UXbTPF1 LunB5ZBBXBTMCshJBX8hq8hPoJW4wH+G1hI2iO8I1QfS49OXhPGl3U2tB6HGiPoI pC8QW+fBkRPCodDFVXAyewuRu2mZETEmgfb+jO344FJ77F9Y9G8NUGx1Na+YIwQ7 2Y1TzGUJGZQYxvMKA2sV2shdDnXXaP6chnFxtVYnLbdicZb7LtbWYywIlp/8KZ7X rWjdcSihzCoMTzxH0FYcx1gwQbS4qlD0Bs0PcHUH7IPg/I6YjM4= =yev/ -----END PGP SIGNATURE----- _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Apple Macos Sonoma Affected: unknown
    		Create a notification for this product.
    Credits
    Apple Product Security via Fulldisclosure
    Relationships
    reference GCVE-1988-2026-0335 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Macos Sonoma",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-05-11-2026-8 macOS Sonoma 14.8.7\n\nmacOS Sonoma 14.8.7 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/127117.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAPFS\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause unexpected system termination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28959: Dave G.\n\nAppleJPEG\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted media file may lead to\nunexpected app termination or corrupt process memory\nDescription: A memory corruption issue was addressed with improved input\nvalidation.\nCVE-2026-28956: impost0r (ret2plt)\n\nAudio\nAvailable for: macOS Sonoma\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-39869: David Ige of Beryllium Security\n\nCoreMedia\nAvailable for: macOS Sonoma\nImpact: An app may be able to access private information\nDescription: This issue was addressed through improved state management.\nCVE-2026-28922: Arni Hardarson\n\nCoreServices\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved checks.\nCVE-2026-28936: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nCUPS\nAvailable for: macOS Sonoma\nImpact: An app may be able to gain root privileges\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-28915: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nFileProvider\nAvailable for: macOS Sonoma\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with additional validation.\nCVE-2026-43659: Alex Radocea\n\nGPU Drivers\nAvailable for: macOS Sonoma\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28923: Kun Peeks (@SwayZGl1tZyyy)\n\nHFS\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28925: Dave G., Aswin Kumar Gokula Kannan\n\nIcons\nAvailable for: macOS Sonoma\nImpact: An app may be able to break out of its sandbox\nDescription: An access issue was addressed with additional sandbox\nrestrictions.\nCVE-2025-43524: Csaba Fitzl (@theevilbit) of Iru\n\nImageIO\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-28977: Suresh Sundaram\n\nImageIO\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-28990: Jiri Ha, Arni Hardarson\n\nInstaller\nAvailable for: macOS Sonoma\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28978: wdszzml and Atuin Automated Vulnerability Discovery\nEngine\n\nIOHIDFamily\nAvailable for: macOS Sonoma\nImpact: An attacker may be able to cause unexpected app termination\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nCVE-2026-28992: Johnny Franks (@zeroxjf)\n\nIOHIDFamily\nAvailable for: macOS Sonoma\nImpact: An app may be able to determine kernel memory layout\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28943: Google Threat Analysis Group\n\nIOKit\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28969: Mihalis Haatainen, Ari Hawking, Ashish Kunwar\n\nKernel\nAvailable for: macOS Sonoma\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43654: Vaagn Vardanian, Nathaniel Oh (@calysteon)\n\nKernel\nAvailable for: macOS Sonoma\nImpact: A maliciously crafted disk image may bypass Gatekeeper checks\nDescription: A file quarantine bypass was addressed with additional\nchecks.\nCVE-2026-28954: Yi\u011fit Can YILMAZ (@yilmazcanyigit)\n\nKernel\nAvailable for: macOS Sonoma\nImpact: A local user may be able to cause unexpected system termination\nor read kernel memory\nDescription: A buffer overflow was addressed with improved input\nvalidation.\nCVE-2026-28897: Robert Tran, popku1337, Billy Jheng Bing Jhong and Pan\nZhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Aswin kumar\nGokulakannan\n\nKernel\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-28952: Calif.io in collaboration with Claude and Anthropic\nResearch\n\nKernel\nAvailable for: macOS Sonoma\nImpact: An app may be able to modify protected parts of the file system\nDescription: A denial of service issue was addressed by removing the\nvulnerable code.\nCVE-2026-28908: beist\n\nKernel\nAvailable for: macOS Sonoma\nImpact: An app may be able to gain root privileges\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-28951: Csaba Fitzl (@theevilbit) of Iru\n\nKernel\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\ninput validation.\nCVE-2026-28972: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with additional validation.\nCVE-2026-28986: Tristan Madani (@TristanInSec) from Talence Security,\nRyan Hileman via Xint Code (xint.io), Chris Betz\n\nKernel\nAvailable for: macOS Sonoma\nImpact: An app may be able to leak sensitive kernel state\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28987: Dhiyanesh Selvaraj (@redroot97)\n\nMail Drafts\nAvailable for: macOS Sonoma\nImpact: Replying to an email could display remote images in Mail in\nLockdown Mode\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-28929: Yi\u011fit Can YILMAZ (@yilmazcanyigit)\n\nmDNSResponder\nAvailable for: macOS Sonoma\nImpact: An attacker on the local network may be able to cause a\ndenial-of-service\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43653: Atul R V\n\nmDNSResponder\nAvailable for: macOS Sonoma\nImpact: A remote attacker may be able to cause unexpected system\ntermination or corrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43668: Anton Pakhunov, Ricardo Prado\n\nmDNSResponder\nAvailable for: macOS Sonoma\nImpact: An attacker on the local network may be able to cause a\ndenial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43666: Ian van der Wurff (ian.nl)\n\nNetworking\nAvailable for: macOS Sonoma\nImpact: An attacker may be able to track users through their IP address\nDescription: This issue was addressed through improved state management.\nCVE-2026-28906: Ilya Sc. Jowell A.\n\nPackageKit\nAvailable for: macOS Sonoma\nImpact: An app may be able to gain root privileges\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28840: Morris Richman (@morrisinlife), Andrei Dodu\n\nQuick Look\nAvailable for: macOS Sonoma\nImpact: Parsing a maliciously crafted file may lead to an unexpected app\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\ninput validation.\nCVE-2026-43656: Peter Malone\n\nSceneKit\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-39870: Peter Malone\n\nSceneKit\nAvailable for: macOS Sonoma\nImpact: A remote attacker may be able to cause unexpected app\ntermination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28846: Peter Malone\n\nShortcuts\nAvailable for: macOS Sonoma\nImpact: An app may be able to access user-sensitive data\nDescription: This issue was addressed by adding an additional prompt for\nuser consent.\nCVE-2026-28993: Doron Assness\n\nStorage\nAvailable for: macOS Sonoma\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with additional validation.\nCVE-2026-28996: Alex Radocea\n\nStorageKit\nAvailable for: macOS Sonoma\nImpact: An app may be able to gain root privileges\nDescription: A consistency issue was addressed with improved state\nhandling.\nCVE-2026-28919: Amy (amys.website)\n\nSync Services\nAvailable for: macOS Sonoma\nImpact: An app may be able to access Contacts without user consent\nDescription: A race condition was addressed with improved handling of\nsymbolic links.\nCVE-2026-28924: YingQi Shi (@Mas0nShi) of DBAppSecurity\u0027s WeBin lab,\nAndreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nTV App\nAvailable for: macOS Sonoma\nImpact: An app may be able to observe unprotected user data\nDescription: A path handling issue was addressed with improved logic.\nCVE-2026-39871: an anonymous researcher\n\nWi-Fi\nAvailable for: macOS Sonoma\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-28819: Wang Yu\n\nWi-Fi\nAvailable for: macOS Sonoma\nImpact: An attacker in a privileged network position may be able to\nperform denial-of-service attack using crafted Wi-Fi packets\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28994: Alex Radocea\n\nzlib\nAvailable for: macOS Sonoma\nImpact: Visiting a maliciously crafted website may leak sensitive data\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-28920: Brendon Tiszka of Google Project Zero\n\nAdditional recognition\n\nKernel\nWe would like to acknowledge Ryan Hileman via Xint Code (xint.io) for\ntheir assistance.\n\nmacOS Sonoma 14.8.7 may be obtained from the Mac App Store or Apple\u0027s\nSoftware Downloads web site: https://support.apple.com/downloads/\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmoCVlYACgkQ4Ifiq8DH\n7PVp5w//SglYZemu6sqjanvv4ERY0GWQbGtGOPxHspofA4uQoXGRylcbcHVOYLdV\nTHJRmh8ycwM38xi+Md2bDeCPhCFANN1GGQHmu2rgGITd7XHkWRkRXixpvjmObm77\nLWPe/jMmVM8bug7U5cfUeuX+r/lsxoC2nFonlrD/D9NCLURnxdLgcka6NDYwGX7j\nHknZUf2pW4LOTiVa12DgrEMrGnq/lf2Jbn3BrNWn8RRSXD9FiuSY5C7HmkRDThyq\nv+1bKO8NeCxrVfFwrkXMwb4TmCwuTDLz215ZOzMj9FQqBU5MdLevKf5KYZNu9y61\nKuNo6Jvhmo2V9gn4P7yZSr5SpcCFFZevjrDldyDBrbVsp2zjyoXECfhvszHhjTB2\ntI2wywFgCwreLM2xxSiySTeBTqTgoEyUv1Kry+47CvROMn1XgGojVHg37UXbTPF1\nLunB5ZBBXBTMCshJBX8hq8hPoJW4wH+G1hI2iO8I1QfS49OXhPGl3U2tB6HGiPoI\npC8QW+fBkRPCodDFVXAyewuRu2mZETEmgfb+jO344FJ77F9Y9G8NUGx1Na+YIwQ7\n2Y1TzGUJGZQYxvMKA2sV2shdDnXXaP6chnFxtVYnLbdicZb7LtbWYywIlp/8KZ7X\nrWjdcSihzCoMTzxH0FYcx1gwQbS4qlD0Bs0PcHUH7IPg/I6YjM4=\n=yev/\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:28:27Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/7"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/7"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/downloads/"
        },
        {
          "url": "https://support.apple.com/en-us/127117"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/7"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-05-11-2026-8 macOS Sonoma 14.8.7",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-43524",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28819",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28840",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28846",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28897",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28906",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28908",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28915",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28919",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28920",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28922",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28923",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28924",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28925",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28929",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28936",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28943",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28951",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28952",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28954",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28956",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28959",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28969",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28972",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28977",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28978",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28986",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28987",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28990",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28992",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28993",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28994",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28996",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39869",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39870",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39871",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43653",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43654",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43656",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43659",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43666",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43668",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0335",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/7",
            "automated": true,
            "contentSha256": "3de0a2a5d8917369bf4052e0770a7511a5724d92e697c42c6ad3a06e9e157bed",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/7",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-11T22:33:49Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0335"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:56Z",
    "dateUpdated": "2026-09-11T11:28:27Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0335"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0338

    Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 11:28
    VLAI
    Title
    APPLE-SA-05-11-2026-11 visionOS 26.5
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-05-11-2026-11 visionOS 26.5 visionOS 26.5 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/127120. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accelerate Available for: Apple Vision Pro (all models) Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-28991: Seiji Sakurai (@HeapSmasher) Accounts Available for: Apple Vision Pro (all models) Impact: An app may be able to bypass certain Privacy preferences Description: A permissions issue was addressed with additional restrictions. CVE-2026-28988: Asaf Cohen APFS Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-28959: Dave G. App Intents Available for: Apple Vision Pro (all models) Impact: A malicious app may be able to break out of its sandbox Description: A logic issue was addressed with improved restrictions. CVE-2026-28995: Vamshi Paili, Tony Gorez (@tonygo_) for Reverse Society AppleJPEG Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted image may lead to a denial-of-service Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2026-1837 AppleJPEG Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory Description: A memory corruption issue was addressed with improved input validation. CVE-2026-28956: impost0r (ret2plt) Audio Available for: Apple Vision Pro (all models) Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: The issue was addressed with improved memory handling. CVE-2026-39869: David Ige of Beryllium Security CoreAnimation Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: An inconsistent user interface issue was addressed with improved state management. CVE-2026-28964: Alan Wang, Christopher W. Fletcher, Hovav Shacham, David Kohlbrenner, Riccardo Paccagnella CoreServices Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: The issue was addressed with improved checks. CVE-2026-28936: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs CoreSymbolication Available for: Apple Vision Pro (all models) Impact: Parsing a maliciously crafted file may lead to an unexpected app termination Description: An out-of-bounds access issue was addressed with improved bounds checking. CVE-2026-28918: Niels Hofmans, Anonymous working with TrendAI Zero Day Initiative FileProvider Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: A race condition was addressed with additional validation. CVE-2026-43659: Alex Radocea ImageIO Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: The issue was addressed with improved bounds checks. CVE-2026-28977: Suresh Sundaram ImageIO Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted image may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-28990: Jiri Ha, Arni Hardarson IOHIDFamily Available for: Apple Vision Pro (all models) Impact: An attacker may be able to cause unexpected app termination Description: A memory corruption vulnerability was addressed with improved locking. CVE-2026-28992: Johnny Franks (@zeroxjf) IOKit Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-28969: Mihalis Haatainen, Ari Hawking, Ashish Kunwar Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to disclose kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-43654: Vaagn Vardanian, Nathaniel Oh (@calysteon) Kernel Available for: Apple Vision Pro (all models) Impact: A local user may be able to cause unexpected system termination or read kernel memory Description: A buffer overflow was addressed with improved input validation. CVE-2026-28897: popku1337, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Robert Tran, Aswin kumar Gokulakannan Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination or write kernel memory Description: An out-of-bounds write issue was addressed with improved input validation. CVE-2026-28972: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io) LaunchServices Available for: Apple Vision Pro (all models) Impact: A remote attacker may be able to cause a denial of service Description: A type confusion issue was addressed with improved checks. CVE-2026-28983: Ruslan Dautov mDNSResponder Available for: Apple Vision Pro (all models) Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2026-43668: Anton Pakhunov, Ricardo Prado mDNSResponder Available for: Apple Vision Pro (all models) Impact: An attacker on the local network may be able to cause a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43666: Ian van der Wurff (ian.nl) Model I/O Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted image may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-28940: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative Networking Available for: Apple Vision Pro (all models) Impact: An attacker may be able to track users through their IP address Description: This issue was addressed through improved state management. CVE-2026-28906: Ilya Sc. Jowell A. SceneKit Available for: Apple Vision Pro (all models) Impact: A remote attacker may be able to cause unexpected app termination Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-28846: Peter Malone Shortcuts Available for: Apple Vision Pro (all models) Impact: An app may be able to access user-sensitive data Description: This issue was addressed by adding an additional prompt for user consent. CVE-2026-28993: Doron Assness Spotlight Available for: Apple Vision Pro (all models) Impact: An app may be able to cause a denial-of-service Description: This issue was addressed with improved checks to prevent unauthorized actions. CVE-2026-28974: Andy Koo (@andykoo) of Hexens Status Bar Available for: Apple Vision Pro (all models) Impact: An app may be able to capture a user's screen Description: An issue with app access to camera metadata was addressed with improved logic. CVE-2026-28957: Adriatik Raci Storage Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: A race condition was addressed with additional validation. CVE-2026-28996: Alex Radocea WebKit Available for: Apple Vision Pro (all models) Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced Description: A validation issue was addressed with improved logic. WebKit Bugzilla: 308906 CVE-2026-43660: Cantina WebKit Available for: Apple Vision Pro (all models) Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced Description: The issue was addressed with improved input validation. WebKit Bugzilla: 308675 CVE-2026-28907: Cantina WebKit Available for: Apple Vision Pro (all models) Impact: Processing maliciously crafted web content may disclose sensitive user information Description: This issue was addressed with improved access restrictions. WebKit Bugzilla: 309698 CVE-2026-28962: Luke Francis, Vaagn Vardanian, kwak kiyong / kakaogames, Vitaly Simonovich, Adel Bouachraoui, greenbynox WebKit Available for: Apple Vision Pro (all models) Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 307669 CVE-2026-43658: Do Young Park WebKit Available for: Apple Vision Pro (all models) Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 308545 CVE-2026-28905: Yuhao Hu, Yuanming Lai, Chenggang Wu, and Zhe Wang WebKit Bugzilla: 308707 CVE-2026-28847: DARKNAVY (@DarkNavyOrg), Anonymous working with TrendAI Zero Day Initiative, Daniel Rhea WebKit Bugzilla: 309601 CVE-2026-28904: Luka Rački WebKit Bugzilla: 310880 CVE-2026-28955: wac and Kookhwan Lee working with TrendAI Zero Day Initiative WebKit Bugzilla: 310303 CVE-2026-28903: Mateusz Krzywicki (iVerify.io) WebKit Bugzilla: 309628 CVE-2026-28953: Maher Azzouzi WebKit Bugzilla: 309861 CVE-2026-28902: Tristan Madani (@TristanInSec) from Talence Security, Nathaniel Oh (@calysteon) WebKit Bugzilla: 310207 CVE-2026-28901: Aisle offensive security research team (Joshua Rogers, Luigino Camastra, Igor Morgenstern, and Guido Vranken), Maher Azzouzi, Ngan Nguyen of Calif.io WebKit Available for: Apple Vision Pro (all models) Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 313939 CVE-2026-28883: kwak kiyong / kakaogames WebKit Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved data protection. WebKit Bugzilla: 311228 CVE-2026-28958: Cantina WebKit Available for: Apple Vision Pro (all models) Impact: A malicious iframe may use another website’s download settings Description: The issue was addressed with improved UI handling. WebKit Bugzilla: 311288 CVE-2026-28971: Khiem Tran WebKit Available for: Apple Vision Pro (all models) Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 312180 CVE-2026-28942: Milad Nasr and Nicholas Carlini with Claude, Anthropic WebKit Bugzilla: 310234 CVE-2026-28947: dr3dd WebKit Available for: Apple Vision Pro (all models) Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: The issue was addressed with improved input validation. WebKit Bugzilla: 310527 CVE-2026-28917: Vitaly Simonovich WebRTC Available for: Apple Vision Pro (all models) Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 311131 CVE-2026-28944: Kenneth Hsu of Palo Alto Networks, Jérôme DJOUDER, dr3dd zlib Available for: Apple Vision Pro (all models) Impact: Visiting a maliciously crafted website may leak sensitive data Description: An information leakage was addressed with additional validation. CVE-2026-28920: Brendon Tiszka of Google Project Zero Additional recognition App Intents We would like to acknowledge Mi
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Apple Visionos Affected: unknown
    		Create a notification for this product.
    Credits
    Apple Product Security via Fulldisclosure
    Relationships
    reference GCVE-1988-2026-0338 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Visionos",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-05-11-2026-11 visionOS 26.5\n\nvisionOS 26.5 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/127120.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccelerate\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-28991: Seiji Sakurai (@HeapSmasher)\n\nAccounts\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to bypass certain Privacy preferences\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28988: Asaf Cohen\n\nAPFS\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28959: Dave G.\n\nApp Intents\nAvailable for: Apple Vision Pro (all models)\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A logic issue was addressed with improved restrictions.\nCVE-2026-28995: Vamshi Paili, Tony Gorez (@tonygo_) for Reverse Society\n\nAppleJPEG\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may lead to a\ndenial-of-service\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-1837\n\nAppleJPEG\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted media file may lead to\nunexpected app termination or corrupt process memory\nDescription: A memory corruption issue was addressed with improved input\nvalidation.\nCVE-2026-28956: impost0r (ret2plt)\n\nAudio\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-39869: David Ige of Beryllium Security\n\nCoreAnimation\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: An inconsistent user interface issue was addressed with\nimproved state management.\nCVE-2026-28964: Alan Wang, Christopher W. Fletcher, Hovav Shacham, David\nKohlbrenner, Riccardo Paccagnella\n\nCoreServices\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved checks.\nCVE-2026-28936: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nCoreSymbolication\nAvailable for: Apple Vision Pro (all models)\nImpact: Parsing a maliciously crafted file may lead to an unexpected app\ntermination\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-28918: Niels Hofmans, Anonymous working with TrendAI Zero Day\nInitiative\n\nFileProvider\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with additional validation.\nCVE-2026-43659: Alex Radocea\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-28977: Suresh Sundaram\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-28990: Jiri Ha, Arni Hardarson\n\nIOHIDFamily\nAvailable for: Apple Vision Pro (all models)\nImpact: An attacker may be able to cause unexpected app termination\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nCVE-2026-28992: Johnny Franks (@zeroxjf)\n\nIOKit\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28969: Mihalis Haatainen, Ari Hawking, Ashish Kunwar\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43654: Vaagn Vardanian, Nathaniel Oh (@calysteon)\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: A local user may be able to cause unexpected system termination\nor read kernel memory\nDescription: A buffer overflow was addressed with improved input\nvalidation.\nCVE-2026-28897: popku1337, Billy Jheng Bing Jhong and Pan Zhenpeng\n(@Peterpan0927) of STAR Labs SG Pte. Ltd., Robert Tran, Aswin kumar\nGokulakannan\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\ninput validation.\nCVE-2026-28972: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)\n\nLaunchServices\nAvailable for: Apple Vision Pro (all models)\nImpact: A remote attacker may be able to cause a denial of service\nDescription: A type confusion issue was addressed with improved checks.\nCVE-2026-28983: Ruslan Dautov\n\nmDNSResponder\nAvailable for: Apple Vision Pro (all models)\nImpact: A remote attacker may be able to cause unexpected system\ntermination or corrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43668: Anton Pakhunov, Ricardo Prado\n\nmDNSResponder\nAvailable for: Apple Vision Pro (all models)\nImpact: An attacker on the local network may be able to cause a\ndenial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43666: Ian van der Wurff (ian.nl)\n\nModel I/O\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-28940: Michael DePlante (@izobashi) of TrendAI Zero Day\nInitiative\n\nNetworking\nAvailable for: Apple Vision Pro (all models)\nImpact: An attacker may be able to track users through their IP address\nDescription: This issue was addressed through improved state management.\nCVE-2026-28906: Ilya Sc. Jowell A.\n\nSceneKit\nAvailable for: Apple Vision Pro (all models)\nImpact: A remote attacker may be able to cause unexpected app\ntermination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28846: Peter Malone\n\nShortcuts\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access user-sensitive data\nDescription: This issue was addressed by adding an additional prompt for\nuser consent.\nCVE-2026-28993: Doron Assness\n\nSpotlight\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause a denial-of-service\nDescription: This issue was addressed with improved checks to prevent\nunauthorized actions.\nCVE-2026-28974: Andy Koo (@andykoo) of Hexens\n\nStatus Bar\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to capture a user\u0027s screen\nDescription: An issue with app access to camera metadata was addressed\nwith improved logic.\nCVE-2026-28957: Adriatik Raci\n\nStorage\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with additional validation.\nCVE-2026-28996: Alex Radocea\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may prevent Content\nSecurity Policy from being enforced\nDescription: A validation issue was addressed with improved logic.\nWebKit Bugzilla: 308906\nCVE-2026-43660: Cantina\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may prevent Content\nSecurity Policy from being enforced\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 308675\nCVE-2026-28907: Cantina\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may disclose\nsensitive user information\nDescription: This issue was addressed with improved access restrictions.\nWebKit Bugzilla: 309698\nCVE-2026-28962: Luke Francis, Vaagn Vardanian, kwak kiyong / kakaogames,\nVitaly Simonovich, Adel Bouachraoui, greenbynox\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 307669\nCVE-2026-43658: Do Young Park\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 308545\nCVE-2026-28905: Yuhao Hu, Yuanming Lai, Chenggang Wu, and Zhe Wang\nWebKit Bugzilla: 308707\nCVE-2026-28847: DARKNAVY (@DarkNavyOrg), Anonymous working with TrendAI\nZero Day Initiative, Daniel Rhea\nWebKit Bugzilla: 309601\nCVE-2026-28904: Luka Ra\u010dki\nWebKit Bugzilla: 310880\nCVE-2026-28955: wac and Kookhwan Lee working with TrendAI Zero Day\nInitiative\nWebKit Bugzilla: 310303\nCVE-2026-28903: Mateusz Krzywicki (iVerify.io)\nWebKit Bugzilla: 309628\nCVE-2026-28953: Maher Azzouzi\nWebKit Bugzilla: 309861\nCVE-2026-28902: Tristan Madani (@TristanInSec) from Talence Security,\nNathaniel Oh (@calysteon)\nWebKit Bugzilla: 310207\nCVE-2026-28901: Aisle offensive security research team (Joshua Rogers,\nLuigino Camastra, Igor Morgenstern, and Guido Vranken), Maher Azzouzi,\nNgan Nguyen of Calif.io\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313939\nCVE-2026-28883: kwak kiyong / kakaogames\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nWebKit Bugzilla: 311228\nCVE-2026-28958: Cantina\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: A malicious iframe may use another website\u2019s download settings\nDescription: The issue was addressed with improved UI handling.\nWebKit Bugzilla: 311288\nCVE-2026-28971: Khiem Tran\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 312180\nCVE-2026-28942: Milad Nasr and Nicholas Carlini with Claude, Anthropic\nWebKit Bugzilla: 310234\nCVE-2026-28947: dr3dd\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 310527\nCVE-2026-28917: Vitaly Simonovich\n\nWebRTC\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 311131\nCVE-2026-28944: Kenneth Hsu of Palo Alto Networks, J\u00e9r\u00f4me DJOUDER, dr3dd\n\nzlib\nAvailable for: Apple Vision Pro (all models)\nImpact: Visiting a maliciously crafted website may leak sensitive data\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-28920: Brendon Tiszka of Google Project Zero\n\nAdditional recognition\n\nApp Intents\nWe would like to acknowledge Mi"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:28:31Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/15"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/15"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/en-us/127120"
        },
        {
          "url": "https://support.apple.com/kb/HT214009"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/15"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-05-11-2026-11 visionOS 26.5",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-1837",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28846",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28847",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28883",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28897",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28901",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28902",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28903",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28904",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28905",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28906",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28907",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28917",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28918",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28920",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28936",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28940",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28942",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28944",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28947",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28953",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28955",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28956",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28957",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28958",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28959",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28962",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28964",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28969",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28971",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28972",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28974",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28977",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28983",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28988",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28990",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28991",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28992",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28993",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28995",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28996",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39869",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43654",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43658",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43659",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43660",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43666",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43668",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0338",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/15",
            "automated": true,
            "contentSha256": "d41d3eeafa51fab79df0402daf905e08347a3f2461a9cade5a868886101bbfb8",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/15",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-11T22:35:21Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0338"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:56Z",
    "dateUpdated": "2026-09-11T11:28:31Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0338"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0337

    Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 11:28
    VLAI
    Title
    APPLE-SA-05-11-2026-10 watchOS 26.5
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-05-11-2026-10 watchOS 26.5 watchOS 26.5 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/127119. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accelerate Available for: Apple Watch Series 6 and later Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-28991: Seiji Sakurai (@HeapSmasher) Accounts Available for: Apple Watch Series 6 and later Impact: An app may be able to bypass certain Privacy preferences Description: A permissions issue was addressed with additional restrictions. CVE-2026-28988: Asaf Cohen APFS Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-28959: Dave G. App Intents Available for: Apple Watch Series 6 and later Impact: A malicious app may be able to break out of its sandbox Description: A logic issue was addressed with improved restrictions. CVE-2026-28995: Vamshi Paili, Tony Gorez (@tonygo_) for Reverse Society AppleJPEG Available for: Apple Watch Series 6 and later Impact: Processing a maliciously crafted image may lead to a denial-of-service Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2026-1837 AppleJPEG Available for: Apple Watch Series 6 and later Impact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory Description: A memory corruption issue was addressed with improved input validation. CVE-2026-28956: impost0r (ret2plt) Audio Available for: Apple Watch Series 6 and later Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: The issue was addressed with improved memory handling. CVE-2026-39869: David Ige of Beryllium Security CoreSymbolication Available for: Apple Watch Series 6 and later Impact: Parsing a maliciously crafted file may lead to an unexpected app termination Description: An out-of-bounds access issue was addressed with improved bounds checking. CVE-2026-28918: Niels Hofmans, Anonymous working with TrendAI Zero Day Initiative ImageIO Available for: Apple Watch Series 6 and later Impact: Processing a maliciously crafted image may corrupt process memory Description: A buffer overflow issue was addressed with improved memory handling. CVE-2026-43661: an anonymous researcher ImageIO Available for: Apple Watch Series 6 and later Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: The issue was addressed with improved bounds checks. CVE-2026-28977: Suresh Sundaram ImageIO Available for: Apple Watch Series 6 and later Impact: Processing a maliciously crafted image may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-28990: Jiri Ha, Arni Hardarson IOHIDFamily Available for: Apple Watch Series 6 and later Impact: An attacker may be able to cause unexpected app termination Description: A memory corruption vulnerability was addressed with improved locking. CVE-2026-28992: Johnny Franks (@zeroxjf) IOHIDFamily Available for: Apple Watch Series 6 and later Impact: An app may be able to determine kernel memory layout Description: A logging issue was addressed with improved data redaction. CVE-2026-28943: Google Threat Analysis Group IOKit Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-28969: Mihalis Haatainen, Ari Hawking, Ashish Kunwar IOSurfaceAccelerator Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-43655: Somair Ansar and an anonymous researcher Kernel Available for: Apple Watch Series 6 and later Impact: An app may be able to disclose kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-43654: Vaagn Vardanian, Nathaniel Oh (@calysteon) Kernel Available for: Apple Watch Series 6 and later Impact: A local user may be able to cause unexpected system termination or read kernel memory Description: A buffer overflow was addressed with improved input validation. CVE-2026-28897: popku1337, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Robert Tran, Aswin kumar Gokulakannan Kernel Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination or write kernel memory Description: An out-of-bounds write issue was addressed with improved input validation. CVE-2026-28972: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io) Kernel Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination Description: A race condition was addressed with additional validation. CVE-2026-28986: Chris Betz, Tristan Madani (@TristanInSec) from Talence Security, Ryan Hileman via Xint Code (xint.io) Kernel Available for: Apple Watch Series 6 and later Impact: An app may be able to leak sensitive kernel state Description: A logging issue was addressed with improved data redaction. CVE-2026-28987: Dhiyanesh Selvaraj (@redroot97) LaunchServices Available for: Apple Watch Series 6 and later Impact: A remote attacker may be able to cause a denial of service Description: A type confusion issue was addressed with improved checks. CVE-2026-28983: Ruslan Dautov mDNSResponder Available for: Apple Watch Series 6 and later Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2026-43668: Anton Pakhunov, Ricardo Prado mDNSResponder Available for: Apple Watch Series 6 and later Impact: An attacker on the local network may be able to cause a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43666: Ian van der Wurff (ian.nl) SceneKit Available for: Apple Watch Series 6 and later Impact: A remote attacker may be able to cause unexpected app termination Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-28846: Peter Malone Spotlight Available for: Apple Watch Series 6 and later Impact: An app may be able to cause a denial-of-service Description: This issue was addressed with improved checks to prevent unauthorized actions. CVE-2026-28974: Andy Koo (@andykoo) of Hexens Storage Available for: Apple Watch Series 6 and later Impact: An app may be able to access sensitive user data Description: A race condition was addressed with additional validation. CVE-2026-28996: Alex Radocea WebKit Available for: Apple Watch Series 6 and later Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced Description: A validation issue was addressed with improved logic. WebKit Bugzilla: 308906 CVE-2026-43660: Cantina WebKit Available for: Apple Watch Series 6 and later Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced Description: The issue was addressed with improved input validation. WebKit Bugzilla: 308675 CVE-2026-28907: Cantina WebKit Available for: Apple Watch Series 6 and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 307669 CVE-2026-43658: Do Young Park WebKit Available for: Apple Watch Series 6 and later Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 313939 CVE-2026-28883: kwak kiyong / kakaogames WebKit Available for: Apple Watch Series 6 and later Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 308707 CVE-2026-28847: DARKNAVY (@DarkNavyOrg), Anonymous working with TrendAI Zero Day Initiative, Daniel Rhea WebKit Bugzilla: 309601 CVE-2026-28904: Luka Rački WebKit Bugzilla: 310880 CVE-2026-28955: wac and Kookhwan Lee working with TrendAI Zero Day Initiative WebKit Bugzilla: 310303 CVE-2026-28903: Mateusz Krzywicki (iVerify.io) WebKit Bugzilla: 309628 CVE-2026-28953: Maher Azzouzi WebKit Bugzilla: 309861 CVE-2026-28902: Tristan Madani (@TristanInSec) from Talence Security, Nathaniel Oh (@calysteon) WebKit Bugzilla: 310207 CVE-2026-28901: Aisle offensive security research team (Joshua Rogers, Luigino Camastra, Igor Morgenstern, and Guido Vranken), Maher Azzouzi, Ngan Nguyen of Calif.io WebKit Bugzilla: 311631 CVE-2026-28913: an anonymous researcher WebKit Available for: Apple Watch Series 6 and later Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: The issue was addressed with improved input validation. WebKit Bugzilla: 310527 CVE-2026-28917: Vitaly Simonovich WebKit Available for: Apple Watch Series 6 and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 310234 CVE-2026-28947: dr3dd WebKit Bugzilla: 312180 CVE-2026-28942: Milad Nasr and Nicholas Carlini with Claude, Anthropic Wi-Fi Available for: Apple Watch Series 6 and later Impact: An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets Description: A use after free issue was addressed with improved memory management. CVE-2026-28994: Alex Radocea zlib Available for: Apple Watch Series 6 and later Impact: Visiting a maliciously crafted website may leak sensitive data Description: An information leakage was addressed with additional validation. CVE-2026-28920: Brendon Tiszka of Google Project Zero Additional recognition App Intents We would like to acknowledge Mikael Kinnman for their assistance. Apple Account We would like to acknowledge Iván Savransky, YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab for their assistance. AuthKit We would like to acknowledge Gongyu Ma (@Mezone0) for their assistance. CoreUI We would like to acknowledge Mustafa Calap ​ for their assistance. ICU We would like to acknowledge an anonymous researcher for their assistance. Kernel We would like to acknowledge Ryan Hileman via Xint Code (xint.io), Suresh Sundaram, an anonymous researcher for their assistance. Libnotify We would like to acknowledge Ilias Morad (@A2nkF_) for their assistance. mDNSResponder We would like to acknowledge Jason Grove for their assistance. Messages We would like to acknowledge Jeffery Kimbrow for their assistance. Siri We would like to acknowledge Yoav Magid for their assistance. WebKit We would like to acknowledge Vitaly Simonovich for their assistance. Instructions on how to update your Apple Watch software are available at https://support.apple.com/kb/HT204641 To check the version on your Apple Watch, open the Apple Watch app on your iPhone and select "My Watch > General > About". Alternatively, on your watch, select "My Watch > General > About". All information is also posted on the Apple Security Releases web site:
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Apple Watchos Affected: unknown
    		Create a notification for this product.
    Credits
    Apple Product Security via Fulldisclosure
    Relationships
    reference GCVE-1988-2026-0337 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Watchos",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-05-11-2026-10 watchOS 26.5\n\nwatchOS 26.5 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/127119.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccelerate\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-28991: Seiji Sakurai (@HeapSmasher)\n\nAccounts\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to bypass certain Privacy preferences\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28988: Asaf Cohen\n\nAPFS\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28959: Dave G.\n\nApp Intents\nAvailable for: Apple Watch Series 6 and later\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A logic issue was addressed with improved restrictions.\nCVE-2026-28995: Vamshi Paili, Tony Gorez (@tonygo_) for Reverse Society\n\nAppleJPEG\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted image may lead to a\ndenial-of-service\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-1837\n\nAppleJPEG\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted media file may lead to\nunexpected app termination or corrupt process memory\nDescription: A memory corruption issue was addressed with improved input\nvalidation.\nCVE-2026-28956: impost0r (ret2plt)\n\nAudio\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-39869: David Ige of Beryllium Security\n\nCoreSymbolication\nAvailable for: Apple Watch Series 6 and later\nImpact: Parsing a maliciously crafted file may lead to an unexpected app\ntermination\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-28918: Niels Hofmans, Anonymous working with TrendAI Zero Day\nInitiative\n\nImageIO\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: A buffer overflow issue was addressed with improved memory\nhandling.\nCVE-2026-43661: an anonymous researcher\n\nImageIO\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-28977: Suresh Sundaram\n\nImageIO\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-28990: Jiri Ha, Arni Hardarson\n\nIOHIDFamily\nAvailable for: Apple Watch Series 6 and later\nImpact: An attacker may be able to cause unexpected app termination\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nCVE-2026-28992: Johnny Franks (@zeroxjf)\n\nIOHIDFamily\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to determine kernel memory layout\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28943: Google Threat Analysis Group\n\nIOKit\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28969: Mihalis Haatainen, Ari Hawking, Ashish Kunwar\n\nIOSurfaceAccelerator\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination or\nread kernel memory\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43655: Somair Ansar and an anonymous researcher\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43654: Vaagn Vardanian, Nathaniel Oh (@calysteon)\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: A local user may be able to cause unexpected system termination\nor read kernel memory\nDescription: A buffer overflow was addressed with improved input\nvalidation.\nCVE-2026-28897: popku1337, Billy Jheng Bing Jhong and Pan Zhenpeng\n(@Peterpan0927) of STAR Labs SG Pte. Ltd., Robert Tran, Aswin kumar\nGokulakannan\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\ninput validation.\nCVE-2026-28972: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with additional validation.\nCVE-2026-28986: Chris Betz, Tristan Madani (@TristanInSec) from Talence\nSecurity, Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to leak sensitive kernel state\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28987: Dhiyanesh Selvaraj (@redroot97)\n\nLaunchServices\nAvailable for: Apple Watch Series 6 and later\nImpact: A remote attacker may be able to cause a denial of service\nDescription: A type confusion issue was addressed with improved checks.\nCVE-2026-28983: Ruslan Dautov\n\nmDNSResponder\nAvailable for: Apple Watch Series 6 and later\nImpact: A remote attacker may be able to cause unexpected system\ntermination or corrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43668: Anton Pakhunov, Ricardo Prado\n\nmDNSResponder\nAvailable for: Apple Watch Series 6 and later\nImpact: An attacker on the local network may be able to cause a\ndenial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43666: Ian van der Wurff (ian.nl)\n\nSceneKit\nAvailable for: Apple Watch Series 6 and later\nImpact: A remote attacker may be able to cause unexpected app\ntermination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28846: Peter Malone\n\nSpotlight\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause a denial-of-service\nDescription: This issue was addressed with improved checks to prevent\nunauthorized actions.\nCVE-2026-28974: Andy Koo (@andykoo) of Hexens\n\nStorage\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with additional validation.\nCVE-2026-28996: Alex Radocea\n\nWebKit\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing maliciously crafted web content may prevent Content\nSecurity Policy from being enforced\nDescription: A validation issue was addressed with improved logic.\nWebKit Bugzilla: 308906\nCVE-2026-43660: Cantina\n\nWebKit\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing maliciously crafted web content may prevent Content\nSecurity Policy from being enforced\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 308675\nCVE-2026-28907: Cantina\n\nWebKit\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 307669\nCVE-2026-43658: Do Young Park\n\nWebKit\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313939\nCVE-2026-28883: kwak kiyong / kakaogames\n\nWebKit\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 308707\nCVE-2026-28847: DARKNAVY (@DarkNavyOrg), Anonymous working with TrendAI\nZero Day Initiative, Daniel Rhea\nWebKit Bugzilla: 309601\nCVE-2026-28904: Luka Ra\u010dki\nWebKit Bugzilla: 310880\nCVE-2026-28955: wac and Kookhwan Lee working with TrendAI Zero Day\nInitiative\nWebKit Bugzilla: 310303\nCVE-2026-28903: Mateusz Krzywicki (iVerify.io)\nWebKit Bugzilla: 309628\nCVE-2026-28953: Maher Azzouzi\nWebKit Bugzilla: 309861\nCVE-2026-28902: Tristan Madani (@TristanInSec) from Talence Security,\nNathaniel Oh (@calysteon)\nWebKit Bugzilla: 310207\nCVE-2026-28901: Aisle offensive security research team (Joshua Rogers,\nLuigino Camastra, Igor Morgenstern, and Guido Vranken), Maher Azzouzi,\nNgan Nguyen of Calif.io\nWebKit Bugzilla: 311631\nCVE-2026-28913: an anonymous researcher\n\nWebKit\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 310527\nCVE-2026-28917: Vitaly Simonovich\n\nWebKit\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 310234\nCVE-2026-28947: dr3dd\nWebKit Bugzilla: 312180\nCVE-2026-28942: Milad Nasr and Nicholas Carlini with Claude, Anthropic\n\nWi-Fi\nAvailable for: Apple Watch Series 6 and later\nImpact: An attacker in a privileged network position may be able to\nperform denial-of-service attack using crafted Wi-Fi packets\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28994: Alex Radocea\n\nzlib\nAvailable for: Apple Watch Series 6 and later\nImpact: Visiting a maliciously crafted website may leak sensitive data\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-28920: Brendon Tiszka of Google Project Zero\n\nAdditional recognition\n\nApp Intents\nWe would like to acknowledge Mikael Kinnman for their assistance.\n\nApple Account\nWe would like to acknowledge Iv\u00e1n Savransky, YingQi Shi (@Mas0nShi) of\nDBAppSecurity\u0027s WeBin lab for their assistance.\n\nAuthKit\nWe would like to acknowledge Gongyu Ma (@Mezone0) for their assistance.\n\nCoreUI\nWe would like to acknowledge Mustafa Calap \u200b for their assistance.\n\nICU\nWe would like to acknowledge an anonymous researcher for their\nassistance.\n\nKernel\nWe would like to acknowledge Ryan Hileman via Xint Code (xint.io),\nSuresh Sundaram, an anonymous researcher for their assistance.\n\nLibnotify\nWe would like to acknowledge Ilias Morad (@A2nkF_) for their assistance.\n\nmDNSResponder\nWe would like to acknowledge Jason Grove for their assistance.\n\nMessages\nWe would like to acknowledge Jeffery Kimbrow for their assistance.\n\nSiri\nWe would like to acknowledge Yoav Magid for their assistance.\n\nWebKit\nWe would like to acknowledge Vitaly Simonovich for their assistance.\n\nInstructions on how to update your Apple Watch software are available at\nhttps://support.apple.com/kb/HT204641\n\nTo check the version on your Apple Watch, open the Apple Watch app on\nyour iPhone and select \"My Watch \u003e General \u003e About\".\n\nAlternatively, on your watch, select \"My Watch \u003e General \u003e About\".\n\nAll information is also posted on the Apple Security Releases\nweb site:"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:28:30Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/14"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/14"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/en-us/127119"
        },
        {
          "url": "https://support.apple.com/kb/HT204641"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/14"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-05-11-2026-10 watchOS 26.5",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-1837",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28846",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28847",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28883",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28897",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28901",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28902",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28903",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28904",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28907",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28913",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28917",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28918",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28920",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28942",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28943",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28947",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28953",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28955",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28956",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28959",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28969",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28972",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28974",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28977",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28983",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28986",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28987",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28988",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28990",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28991",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28992",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28994",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28995",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28996",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39869",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43654",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43655",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43658",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43660",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43661",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43666",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43668",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0337",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/14",
            "automated": true,
            "contentSha256": "3baf5add0c01cc8ee054262d9daab2f941583d12a67f5a92738590246114b1c1",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/14",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-11T22:34:46Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0337"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:56Z",
    "dateUpdated": "2026-09-11T11:28:30Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0337"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0330

    Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 11:27
    VLAI
    Title
    APPLE-SA-05-11-2026-3 iPadOS 17.7.11
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-05-11-2026-3 iPadOS 17.7.11 iPadOS 17.7.11 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/127112. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Notification Services Available for: iPad Pro 12.9-inch 2nd generation, iPad Pro 10.5-inch, and iPad 6th generation Impact: Notifications marked for deletion could be unexpectedly retained on the device Description: A logging issue was addressed with improved data redaction. CVE-2026-28950 This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iPadOS 17.7.11". All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmoCVdUACgkQ4Ifiq8DH 7PVKVRAAlTdoPhZ0g/B6f5/zMxR62jWpuC1UyDMviQccbJNapl8c9QHsvMNG04Av HyUp2JbiVh+g4jfBlUn31gMoGttzjrEgJrgx6unfxOGny6YtkTwQbXOJ1XWIdXWg akLRZ9ENHqVVk252uiotdZd1Trvba6zaBkoUBfYrbB3v0R1bP8ZUvdQ51KwqFsYh gMO1txKvAmdkFRce9Zj9kYYg/+TyI0QQDhy9J2s5RPeanCT7DOwslsHxNUux6T+A 8Eo8x5nXzfLrBKlMJ01OBpMDijhW/cXZ+tTqe9vPkplcRoTKVqq9ssskk6YdgzZT qfbvZ2BbB82t/toPzN58PvhmJlzijIG83Xo9KdxZG1Y3BHSYimMXSOfBeT6qIieP Pr398aMI4o0HEVinY8Ymrl34sqgLuIeaFTengLSN0B4hmG3sVaNDMuwY/Ya5DFhv 9l2MzZwyxkl2IbgVHXrlzsJOq6PtmMt3x2H01wqRlESSU4Q2haNsa9BxZNMyNOoI vABAX85zrhricVJ3rBpNgUhwK3Ir2qpB5uhkb9JxI0jqmcerUBvIrrSJU5qQRf1M ZlL+iWX3X04rChzhOiB6cSLXNWgoPm08gbX5Cj6RDyDOJlcGaxEQ64IqwRlg3Hzc YXWET09wCwl/g//jZk9xTcZuR/mSGXDbKosV6RkeIqASMLfXgzE= =YlQb -----END PGP SIGNATURE----- _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Apple Ipados Affected: unknown
    		Create a notification for this product.
    Credits
    Apple Product Security via Fulldisclosure
    Relationships
    reference GCVE-1988-2026-0330 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Ipados",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-05-11-2026-3 iPadOS 17.7.11\n\niPadOS 17.7.11 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/127112.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nNotification Services\nAvailable for: iPad Pro 12.9-inch 2nd generation, iPad Pro 10.5-inch,\nand iPad 6th generation\nImpact: Notifications marked for deletion could be unexpectedly retained\non the device\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28950\n\nThis update is available through iTunes and Software Update on your iOS\ndevice, and will not appear in your computer\u0027s Software Update\napplication, or in the Apple Downloads site. Make sure you have an\nInternet connection and have installed the latest version of iTunes from\nhttps://www.apple.com/itunes/\n\niTunes and Software Update on the device will automatically check\nApple\u0027s update server on its weekly schedule. When an update is\ndetected, it is downloaded and the option to be installed is presented\nto the user when the iOS device is docked. We recommend applying the\nupdate immediately if possible. Selecting Don\u0027t Install will present the\noption the next time you connect your iOS device.\n\nThe automatic update process may take up to a week depending on the day\nthat iTunes or the device checks for updates. You may manually obtain\nthe update via the Check for Updates button within iTunes, or the\nSoftware Update on your device.\n\nTo check that the iPhone, iPod touch, or iPad has been updated:\n\n* Navigate to Settings \n* Select General \n* Select About. The version\nafter applying this update will be \"iPadOS 17.7.11\".\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmoCVdUACgkQ4Ifiq8DH\n7PVKVRAAlTdoPhZ0g/B6f5/zMxR62jWpuC1UyDMviQccbJNapl8c9QHsvMNG04Av\nHyUp2JbiVh+g4jfBlUn31gMoGttzjrEgJrgx6unfxOGny6YtkTwQbXOJ1XWIdXWg\nakLRZ9ENHqVVk252uiotdZd1Trvba6zaBkoUBfYrbB3v0R1bP8ZUvdQ51KwqFsYh\ngMO1txKvAmdkFRce9Zj9kYYg/+TyI0QQDhy9J2s5RPeanCT7DOwslsHxNUux6T+A\n8Eo8x5nXzfLrBKlMJ01OBpMDijhW/cXZ+tTqe9vPkplcRoTKVqq9ssskk6YdgzZT\nqfbvZ2BbB82t/toPzN58PvhmJlzijIG83Xo9KdxZG1Y3BHSYimMXSOfBeT6qIieP\nPr398aMI4o0HEVinY8Ymrl34sqgLuIeaFTengLSN0B4hmG3sVaNDMuwY/Ya5DFhv\n9l2MzZwyxkl2IbgVHXrlzsJOq6PtmMt3x2H01wqRlESSU4Q2haNsa9BxZNMyNOoI\nvABAX85zrhricVJ3rBpNgUhwK3Ir2qpB5uhkb9JxI0jqmcerUBvIrrSJU5qQRf1M\nZlL+iWX3X04rChzhOiB6cSLXNWgoPm08gbX5Cj6RDyDOJlcGaxEQ64IqwRlg3Hzc\nYXWET09wCwl/g//jZk9xTcZuR/mSGXDbKosV6RkeIqASMLfXgzE=\n=YlQb\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:27:25Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/8"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/8"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/en-us/127112"
        },
        {
          "url": "https://www.apple.com/itunes/"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/8"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-05-11-2026-3 iPadOS 17.7.11",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-28950",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0330",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/8",
            "automated": true,
            "contentSha256": "f5896d6b10cac44e41690b98eb8f75e3a780180a025c0b77f89e9e43b14bad32",
            "evidenceScore": 6,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/8",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-11T22:30:46Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0330"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:55Z",
    "dateUpdated": "2026-09-11T11:27:25Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0330"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0333

    Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 11:28
    VLAI
    Title
    APPLE-SA-05-11-2026-6 macOS Tahoe 26.5
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-05-11-2026-6 macOS Tahoe 26.5 macOS Tahoe 26.5 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/127115. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accelerate Available for: macOS Tahoe Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-28991: Seiji Sakurai (@HeapSmasher) Accounts Available for: macOS Tahoe Impact: An app may be able to bypass certain Privacy preferences Description: A permissions issue was addressed with additional restrictions. CVE-2026-28988: Asaf Cohen APFS Available for: macOS Tahoe Impact: An app may be able to cause unexpected system termination Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-28959: Dave G. App Intents Available for: macOS Tahoe Impact: A malicious app may be able to break out of its sandbox Description: A logic issue was addressed with improved restrictions. CVE-2026-28995: Vamshi Paili, Tony Gorez (@tonygo_) for Reverse Society AppleJPEG Available for: macOS Tahoe Impact: Processing a maliciously crafted image may lead to a denial-of-service Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2026-1837 AppleJPEG Available for: macOS Tahoe Impact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory Description: A memory corruption issue was addressed with improved input validation. CVE-2026-28956: impost0r (ret2plt) Audio Available for: macOS Tahoe Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: The issue was addressed with improved memory handling. CVE-2026-39869: David Ige of Beryllium Security CoreMedia Available for: macOS Tahoe Impact: An app may be able to access private information Description: This issue was addressed through improved state management. CVE-2026-28922: Arni Hardarson CoreServices Available for: macOS Tahoe Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: The issue was addressed with improved checks. CVE-2026-28936: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs CoreSymbolication Available for: macOS Tahoe Impact: Parsing a maliciously crafted file may lead to an unexpected app termination Description: An out-of-bounds access issue was addressed with improved bounds checking. CVE-2026-28918: Niels Hofmans, Anonymous working with TrendAI Zero Day Initiative CUPS Available for: macOS Tahoe Impact: An app may be able to gain root privileges Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-28915: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs FileProvider Available for: macOS Tahoe Impact: An app may be able to access sensitive user data Description: A race condition was addressed with additional validation. CVE-2026-43659: Alex Radocea GPU Drivers Available for: macOS Tahoe Impact: A malicious app may be able to break out of its sandbox Description: A logging issue was addressed with improved data redaction. CVE-2026-28923: Kun Peeks (@SwayZGl1tZyyy) HFS Available for: macOS Tahoe Impact: An app may be able to cause unexpected system termination or write kernel memory Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-28925: Aswin Kumar Gokula Kannan, Dave G. ImageIO Available for: macOS Tahoe Impact: Processing a maliciously crafted image may corrupt process memory Description: A buffer overflow issue was addressed with improved memory handling. CVE-2026-43661: an anonymous researcher ImageIO Available for: macOS Tahoe Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: The issue was addressed with improved bounds checks. CVE-2026-28977: Suresh Sundaram ImageIO Available for: macOS Tahoe Impact: Processing a maliciously crafted image may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-28990: Jiri Ha, Arni Hardarson Installer Available for: macOS Tahoe Impact: A malicious app may be able to break out of its sandbox Description: A permissions issue was addressed with additional restrictions. CVE-2026-28978: wdszzml and Atuin Automated Vulnerability Discovery Engine IOHIDFamily Available for: macOS Tahoe Impact: An attacker may be able to cause unexpected app termination Description: A memory corruption vulnerability was addressed with improved locking. CVE-2026-28992: Johnny Franks (@zeroxjf) IOHIDFamily Available for: macOS Tahoe Impact: An app may be able to determine kernel memory layout Description: A logging issue was addressed with improved data redaction. CVE-2026-28943: Google Threat Analysis Group IOKit Available for: macOS Tahoe Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-28969: Mihalis Haatainen, Ari Hawking, Ashish Kunwar IOSurfaceAccelerator Available for: macOS Tahoe Impact: An app may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-43655: Somair Ansar and an anonymous researcher Kernel Available for: macOS Tahoe Impact: An app may be able to disclose kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-43654: Vaagn Vardanian, Nathaniel Oh (@calysteon) Kernel Available for: macOS Tahoe Impact: An app may be able to modify protected parts of the file system Description: A denial of service issue was addressed by removing the vulnerable code. CVE-2026-28908: beist Kernel Available for: macOS Tahoe Impact: A maliciously crafted disk image may bypass Gatekeeper checks Description: A file quarantine bypass was addressed with additional checks. CVE-2026-28954: Yiğit Can YILMAZ (@yilmazcanyigit) Kernel Available for: macOS Tahoe Impact: A local user may be able to cause unexpected system termination or read kernel memory Description: A buffer overflow was addressed with improved input validation. CVE-2026-28897: popku1337, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Robert Tran, Aswin kumar Gokulakannan Kernel Available for: macOS Tahoe Impact: An app may be able to cause unexpected system termination Description: An integer overflow was addressed with improved input validation. CVE-2026-28952: Calif.io in collaboration with Claude and Anthropic Research Kernel Available for: macOS Tahoe Impact: An app may be able to gain root privileges Description: An authorization issue was addressed with improved state management. CVE-2026-28951: Csaba Fitzl (@theevilbit) of Iru Kernel Available for: macOS Tahoe Impact: An app may be able to cause unexpected system termination or write kernel memory Description: An out-of-bounds write issue was addressed with improved input validation. CVE-2026-28972: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io) Kernel Available for: macOS Tahoe Impact: An app may be able to cause unexpected system termination Description: A race condition was addressed with additional validation. CVE-2026-28986: Chris Betz, Tristan Madani (@TristanInSec) from Talence Security, Ryan Hileman via Xint Code (xint.io) Kernel Available for: macOS Tahoe Impact: An app may be able to leak sensitive kernel state Description: A logging issue was addressed with improved data redaction. CVE-2026-28987: Dhiyanesh Selvaraj (@redroot97) LaunchServices Available for: macOS Tahoe Impact: A remote attacker may be able to cause a denial of service Description: A type confusion issue was addressed with improved checks. CVE-2026-28983: Ruslan Dautov Mail Drafts Available for: macOS Tahoe Impact: Replying to an email could display remote images in Mail in Lockdown Mode Description: A logic issue was addressed with improved checks. CVE-2026-28929: Yiğit Can YILMAZ (@yilmazcanyigit) mDNSResponder Available for: macOS Tahoe Impact: An attacker on the local network may be able to cause a denial-of-service Description: The issue was addressed with improved memory handling. CVE-2026-43653: Atul R V mDNSResponder Available for: macOS Tahoe Impact: An attacker on the local network may be able to cause a denial-of-service Description: A null pointer dereference was addressed with improved input validation. CVE-2026-28985: Omar Cerrito mDNSResponder Available for: macOS Tahoe Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2026-43668: Anton Pakhunov, Ricardo Prado mDNSResponder Available for: macOS Tahoe Impact: An attacker on the local network may be able to cause a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43666: Ian van der Wurff (ian.nl) Model I/O Available for: macOS Tahoe Impact: Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents Description: The issue was addressed with improved checks. CVE-2026-28941: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative Model I/O Available for: macOS Tahoe Impact: Processing a maliciously crafted image may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-28940: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative Network Extensions Available for: macOS Tahoe Impact: An attacker with physical access to a locked device may be able to view sensitive user information Description: This issue was addressed with improved checks. CVE-2026-28961: Dan Raviv Networking Available for: macOS Tahoe Impact: An attacker may be able to track users through their IP address Description: This issue was addressed through improved state management. CVE-2026-28906: Ilya Sc. Jowell A. Quick Look Available for: macOS Tahoe Impact: Parsing a maliciously crafted file may lead to an unexpected app termination Description: An out-of-bounds write issue was addressed with improved input validation. CVE-2026-43656: Peter Malone Sandbox Available for: macOS Tahoe Impact: An app may be able to access protected user data Description: A permissions issue was addressed with additional restrictions. CVE-2026-43652: Asaf Cohen SceneKit Available for: macOS Tahoe Impact: Processing a maliciously crafted image may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-39870: Peter Malone SceneKit Available for: macOS Tahoe Impact: A remote attacker may be able to cause unexpected app termination Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-28846: Peter Malone Shortcuts Available for: macOS Tahoe Impact: An app may be able to access user-sensitive data Description: This issue was addressed by adding an additional prompt for user consent. CVE-2026-28993: Doron Assness SMB Available for: macOS Tahoe Impact: A remote attacker may be able to cause unexpected system termination Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-28848: Peter Malone, Dave G. and Alex Radocea of Supernetworks Spotlight Available for: macOS Tahoe Impact: An app may be able to access protected user data Description: A permissions issue was addressed with additional restrictions. CVE-2026-28930: Pan ZhenPeng (@P
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Apple Macos Tahoe Affected: unknown
    		Create a notification for this product.
    Credits
    Apple Product Security via Fulldisclosure
    Relationships
    reference GCVE-1988-2026-0333 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Macos Tahoe",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-05-11-2026-6 macOS Tahoe 26.5\n\nmacOS Tahoe 26.5 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/127115.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccelerate\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-28991: Seiji Sakurai (@HeapSmasher)\n\nAccounts\nAvailable for: macOS Tahoe\nImpact: An app may be able to bypass certain Privacy preferences\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28988: Asaf Cohen\n\nAPFS\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28959: Dave G.\n\nApp Intents\nAvailable for: macOS Tahoe\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A logic issue was addressed with improved restrictions.\nCVE-2026-28995: Vamshi Paili, Tony Gorez (@tonygo_) for Reverse Society\n\nAppleJPEG\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted image may lead to a\ndenial-of-service\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-1837\n\nAppleJPEG\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted media file may lead to\nunexpected app termination or corrupt process memory\nDescription: A memory corruption issue was addressed with improved input\nvalidation.\nCVE-2026-28956: impost0r (ret2plt)\n\nAudio\nAvailable for: macOS Tahoe\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-39869: David Ige of Beryllium Security\n\nCoreMedia\nAvailable for: macOS Tahoe\nImpact: An app may be able to access private information\nDescription: This issue was addressed through improved state management.\nCVE-2026-28922: Arni Hardarson\n\nCoreServices\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved checks.\nCVE-2026-28936: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nCoreSymbolication\nAvailable for: macOS Tahoe\nImpact: Parsing a maliciously crafted file may lead to an unexpected app\ntermination\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-28918: Niels Hofmans, Anonymous working with TrendAI Zero Day\nInitiative\n\nCUPS\nAvailable for: macOS Tahoe\nImpact: An app may be able to gain root privileges\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-28915: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nFileProvider\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with additional validation.\nCVE-2026-43659: Alex Radocea\n\nGPU Drivers\nAvailable for: macOS Tahoe\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28923: Kun Peeks (@SwayZGl1tZyyy)\n\nHFS\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28925: Aswin Kumar Gokula Kannan, Dave G.\n\nImageIO\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: A buffer overflow issue was addressed with improved memory\nhandling.\nCVE-2026-43661: an anonymous researcher\n\nImageIO\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-28977: Suresh Sundaram\n\nImageIO\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-28990: Jiri Ha, Arni Hardarson\n\nInstaller\nAvailable for: macOS Tahoe\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28978: wdszzml and Atuin Automated Vulnerability Discovery\nEngine\n\nIOHIDFamily\nAvailable for: macOS Tahoe\nImpact: An attacker may be able to cause unexpected app termination\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nCVE-2026-28992: Johnny Franks (@zeroxjf)\n\nIOHIDFamily\nAvailable for: macOS Tahoe\nImpact: An app may be able to determine kernel memory layout\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28943: Google Threat Analysis Group\n\nIOKit\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28969: Mihalis Haatainen, Ari Hawking, Ashish Kunwar\n\nIOSurfaceAccelerator\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination or\nread kernel memory\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43655: Somair Ansar and an anonymous researcher\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43654: Vaagn Vardanian, Nathaniel Oh (@calysteon)\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to modify protected parts of the file system\nDescription: A denial of service issue was addressed by removing the\nvulnerable code.\nCVE-2026-28908: beist\n\nKernel\nAvailable for: macOS Tahoe\nImpact: A maliciously crafted disk image may bypass Gatekeeper checks\nDescription: A file quarantine bypass was addressed with additional\nchecks.\nCVE-2026-28954: Yi\u011fit Can YILMAZ (@yilmazcanyigit)\n\nKernel\nAvailable for: macOS Tahoe\nImpact: A local user may be able to cause unexpected system termination\nor read kernel memory\nDescription: A buffer overflow was addressed with improved input\nvalidation.\nCVE-2026-28897: popku1337, Billy Jheng Bing Jhong and Pan Zhenpeng\n(@Peterpan0927) of STAR Labs SG Pte. Ltd., Robert Tran, Aswin kumar\nGokulakannan\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-28952: Calif.io in collaboration with Claude and Anthropic\nResearch\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to gain root privileges\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-28951: Csaba Fitzl (@theevilbit) of Iru\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\ninput validation.\nCVE-2026-28972: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with additional validation.\nCVE-2026-28986: Chris Betz, Tristan Madani (@TristanInSec) from Talence\nSecurity, Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to leak sensitive kernel state\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28987: Dhiyanesh Selvaraj (@redroot97)\n\nLaunchServices\nAvailable for: macOS Tahoe\nImpact: A remote attacker may be able to cause a denial of service\nDescription: A type confusion issue was addressed with improved checks.\nCVE-2026-28983: Ruslan Dautov\n\nMail Drafts\nAvailable for: macOS Tahoe\nImpact: Replying to an email could display remote images in Mail in\nLockdown Mode\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-28929: Yi\u011fit Can YILMAZ (@yilmazcanyigit)\n\nmDNSResponder\nAvailable for: macOS Tahoe\nImpact: An attacker on the local network may be able to cause a\ndenial-of-service\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43653: Atul R V\n\nmDNSResponder\nAvailable for: macOS Tahoe\nImpact: An attacker on the local network may be able to cause a\ndenial-of-service\nDescription: A null pointer dereference was addressed with improved\ninput validation.\nCVE-2026-28985: Omar Cerrito\n\nmDNSResponder\nAvailable for: macOS Tahoe\nImpact: A remote attacker may be able to cause unexpected system\ntermination or corrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43668: Anton Pakhunov, Ricardo Prado\n\nmDNSResponder\nAvailable for: macOS Tahoe\nImpact: An attacker on the local network may be able to cause a\ndenial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43666: Ian van der Wurff (ian.nl)\n\nModel I/O\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted file may lead to a\ndenial-of-service or potentially disclose memory contents\nDescription: The issue was addressed with improved checks.\nCVE-2026-28941: Michael DePlante (@izobashi) of TrendAI Zero Day\nInitiative\n\nModel I/O\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-28940: Michael DePlante (@izobashi) of TrendAI Zero Day\nInitiative\n\nNetwork Extensions\nAvailable for: macOS Tahoe\nImpact: An attacker with physical access to a locked device may be able\nto view sensitive user information\nDescription: This issue was addressed with improved checks.\nCVE-2026-28961: Dan Raviv\n\nNetworking\nAvailable for: macOS Tahoe\nImpact: An attacker may be able to track users through their IP address\nDescription: This issue was addressed through improved state management.\nCVE-2026-28906: Ilya Sc. Jowell A.\n\nQuick Look\nAvailable for: macOS Tahoe\nImpact: Parsing a maliciously crafted file may lead to an unexpected app\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\ninput validation.\nCVE-2026-43656: Peter Malone\n\nSandbox\nAvailable for: macOS Tahoe\nImpact: An app may be able to access protected user data\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-43652: Asaf Cohen\n\nSceneKit\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-39870: Peter Malone\n\nSceneKit\nAvailable for: macOS Tahoe\nImpact: A remote attacker may be able to cause unexpected app\ntermination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28846: Peter Malone\n\nShortcuts\nAvailable for: macOS Tahoe\nImpact: An app may be able to access user-sensitive data\nDescription: This issue was addressed by adding an additional prompt for\nuser consent.\nCVE-2026-28993: Doron Assness\n\nSMB\nAvailable for: macOS Tahoe\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28848: Peter Malone, Dave G. and Alex Radocea of Supernetworks\n\nSpotlight\nAvailable for: macOS Tahoe\nImpact: An app may be able to access protected user data\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28930: Pan ZhenPeng (@P"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:28:19Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/11"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/11"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/downloads/"
        },
        {
          "url": "https://support.apple.com/en-us/127115"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/11"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-05-11-2026-6 macOS Tahoe 26.5",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-1837",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28819",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28846",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28847",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28848",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28883",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28897",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28901",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28902",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28903",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28904",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28905",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28906",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28907",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28908",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28913",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28914",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28915",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28917",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28918",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28919",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28920",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28922",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28923",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28924",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28925",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28929",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28930",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28936",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28940",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28941",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28942",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28943",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28944",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28946",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28947",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28951",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28952",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28953",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28954",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28955",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28956",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28958",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28959",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28961",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28962",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28969",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28971",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28972",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28974",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28976",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28977",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28978",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28983",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28985",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28986",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28987",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28988",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28990",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28991",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28992",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28993",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28994",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28995",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28996",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39869",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39870",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39871",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43652",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43653",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43654",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43655",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43656",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43658",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43659",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43660",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43661",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43666",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43668",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0333",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/11",
            "automated": true,
            "contentSha256": "a2ec62f84ae6b32c6685ce18d20de1cbe8d4004a18fd7d143ac89e7ce011eb4b",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/11",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-11T22:32:57Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0333"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:55Z",
    "dateUpdated": "2026-09-11T11:28:19Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0333"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0303

    Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-11 11:51
    VLAI
    Title
    APPLE-SA-08-18-2026-1 Safari 26.6.1
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-18-2026-1 Safari 26.6.1 Safari 26.6.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/148286. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: An out-of-bounds access issue was addressed with improved bounds checking. WebKit Bugzilla: 317632 CVE-2026-64784: Janggoon Lee of Out of Bounds, OpenAI Codex Security - Amy Burnett WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 313452 CVE-2026-43795: wwwlk WebKit Bugzilla: 318348 CVE-2026-65338: OpenAI Codex Security - Amy Burnett WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to memory corruption Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 318405 CVE-2026-65341: Henock Habte WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A memory corruption vulnerability was addressed with improved locking. WebKit Bugzilla: 321480 CVE-2026-64782: Seonwook Kim, Shubham Chaskar, lattice, Josef Korbel WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved input validation. WebKit Bugzilla: 321484 CVE-2026-64781: Thomas Guillem WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: This issue was addressed through improved state management. WebKit Bugzilla: 321517 CVE-2026-65351: Niels Hofmans WebKit Bugzilla: 316996 CVE-2026-65340: Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Josef Korbel (Citadelo) WebKit Bugzilla: 317142 CVE-2026-65337: OpenAI Codex Security - Amy Burnett WebKit Bugzilla: 317349 CVE-2026-65336: Josef Korbel WebKit Bugzilla: 316723 CVE-2026-65335: OpenAI Codex Security - Amy Burnett WebKit Bugzilla: 317603 CVE-2026-65333: OpenAI Codex Security - Amy Burnett WebKit Bugzilla: 317450 CVE-2026-65332: OpenAI Codex Security - Amy Burnett WebKit Bugzilla: 317611 CVE-2026-65331: OpenAI Codex Security - Amy Burnett WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 316347 CVE-2026-64715: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved checks. WebKit Bugzilla: 316918 CVE-2026-64780: OpenAI Codex Security - Amy Burnett WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A memory corruption issue was addressed with improved state management. WebKit Bugzilla: 316791 CVE-2026-65334: OpenAI Codex Security - Amy Burnett WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to memory corruption Description: A memory corruption issue was addressed with improved memory handling. WebKit Bugzilla: 317317 CVE-2026-43794: Dung Do (@_piers2) of Calif.io WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected process termination Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 313703 CVE-2026-64787: 杉山 壮太, Shubham Chaskar WebKit History Available for: macOS Sonoma and macOS Sequoia Impact: Visiting a maliciously crafted website may leak sensitive data Description: The issue was addressed with improved checks. WebKit Bugzilla: 315528 CVE-2026-64778: Mohit Negi WebKit Storage Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A memory corruption vulnerability was addressed with improved locking. WebKit Bugzilla: 321485 CVE-2026-64779: Shubham Chaskar, Tommy DeVoss from Braze Security Team (@thedawgyg) Additional recognition WebKit We would like to acknowledge Henock Habte for their assistance. Safari 26.6.1 may be obtained from the Mac App Store. All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmqEtoMACgkQ4Ifiq8DH 7PXAJw//TT8E/xNXFpPvYP4AalRggghX1B0wdLSFdd2py/EsbRloEErOZf5dZ52E wl3IwcqcNoCbGrcWYx1zFhSn92sgqV6eOQ6ff4BpLp82BRTeISDllKHpX+aZ1LsR 9AL69KgQ4nQjoalq0e8vc4+cE3H59YKg4xC5vXMMt/tNZKfdzwB8x8yZNEFkl1So j7wAkOtBudbQOo4yaXs7hqBsutkMgxuPr79nIJYv0ye8fbk9IfhA3dKRnSIBYpGe 1coG9gQ/5DMn1IF0AQ0H3Tg9ZxBZcQVpSMs2EuLYzV84eUZ4Pp8lBansDnMZdaSc SKP08qQ0CRD0Q3xh2L8hzYKYocNpXtOW12BSuIaY3BC/QgPHwTZQEECbpTuleQLe NFZxY9JEWPtzr5CEq3crlaXihtNbeQA4VhgSrWhYFdUaLKDFBBHIat5wEVlMPgt1 n+ml4wUzdRdfOI9GMeCPbZqIvySdf+EALS+opMzCeXb6HJ84qo8dLi9BMUESucfp EmSW2dwAAHreuYwykHEuZoFjd3uR0eicEmTHPV/Ujm6NJOgD7qv0cO7jTfc91KuC udOqx2AcyJLKRupddWeUBYVXZLzQO9XUnUa8K5w2tIqhd3PT+HwsnFb7k4GpaUIK vj31dfQghVhRuqRDApLd+CVsjsKR6NkZenBKhhf3knDDoMX/dPI= =LOpe -----END PGP SIGNATURE----- _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Apple Safari Affected: unknown
    		Create a notification for this product.
    Credits
    Apple Product Security via Fulldisclosure
    Relationships
    reference GCVE-1988-2026-0303 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-08-18-2026-1 Safari 26.6.1\n\nSafari 26.6.1 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/148286.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nWebKit Bugzilla: 317632\nCVE-2026-64784: Janggoon Lee of Out of Bounds, OpenAI Codex Security -\nAmy Burnett\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 313452\nCVE-2026-43795: wwwlk\nWebKit Bugzilla: 318348\nCVE-2026-65338: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 318405\nCVE-2026-65341: Henock Habte\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nWebKit Bugzilla: 321480\nCVE-2026-64782: Seonwook Kim, Shubham Chaskar, lattice, Josef Korbel\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 321484\nCVE-2026-64781: Thomas Guillem\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: This issue was addressed through improved state management.\nWebKit Bugzilla: 321517\nCVE-2026-65351: Niels Hofmans\nWebKit Bugzilla: 316996\nCVE-2026-65340: Claudio Bozzato and Francesco Benvenuto of Cisco Talos,\nJosef Korbel (Citadelo)\nWebKit Bugzilla: 317142\nCVE-2026-65337: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317349\nCVE-2026-65336: Josef Korbel\nWebKit Bugzilla: 316723\nCVE-2026-65335: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317603\nCVE-2026-65333: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317450\nCVE-2026-65332: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317611\nCVE-2026-65331: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 316347\nCVE-2026-64715: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved checks.\nWebKit Bugzilla: 316918\nCVE-2026-64780: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption issue was addressed with improved state\nmanagement.\nWebKit Bugzilla: 316791\nCVE-2026-65334: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nWebKit Bugzilla: 317317\nCVE-2026-43794: Dung Do (@_piers2) of Calif.io\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process termination\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313703\nCVE-2026-64787: \u6749\u5c71 \u58ee\u592a, Shubham Chaskar\n\nWebKit History\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Visiting a maliciously crafted website may leak sensitive data\nDescription: The issue was addressed with improved checks.\nWebKit Bugzilla: 315528\nCVE-2026-64778: Mohit Negi\n\nWebKit Storage\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nWebKit Bugzilla: 321485\nCVE-2026-64779: Shubham Chaskar, Tommy DeVoss from Braze Security Team\n(@thedawgyg)\n\nAdditional recognition\n\nWebKit\nWe would like to acknowledge Henock Habte for their assistance.\n\nSafari 26.6.1 may be obtained from the Mac App Store.\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmqEtoMACgkQ4Ifiq8DH\n7PXAJw//TT8E/xNXFpPvYP4AalRggghX1B0wdLSFdd2py/EsbRloEErOZf5dZ52E\nwl3IwcqcNoCbGrcWYx1zFhSn92sgqV6eOQ6ff4BpLp82BRTeISDllKHpX+aZ1LsR\n9AL69KgQ4nQjoalq0e8vc4+cE3H59YKg4xC5vXMMt/tNZKfdzwB8x8yZNEFkl1So\nj7wAkOtBudbQOo4yaXs7hqBsutkMgxuPr79nIJYv0ye8fbk9IfhA3dKRnSIBYpGe\n1coG9gQ/5DMn1IF0AQ0H3Tg9ZxBZcQVpSMs2EuLYzV84eUZ4Pp8lBansDnMZdaSc\nSKP08qQ0CRD0Q3xh2L8hzYKYocNpXtOW12BSuIaY3BC/QgPHwTZQEECbpTuleQLe\nNFZxY9JEWPtzr5CEq3crlaXihtNbeQA4VhgSrWhYFdUaLKDFBBHIat5wEVlMPgt1\nn+ml4wUzdRdfOI9GMeCPbZqIvySdf+EALS+opMzCeXb6HJ84qo8dLi9BMUESucfp\nEmSW2dwAAHreuYwykHEuZoFjd3uR0eicEmTHPV/Ujm6NJOgD7qv0cO7jTfc91KuC\nudOqx2AcyJLKRupddWeUBYVXZLzQO9XUnUa8K5w2tIqhd3PT+HwsnFb7k4GpaUIK\nvj31dfQghVhRuqRDApLd+CVsjsKR6NkZenBKhhf3knDDoMX/dPI=\n=LOpe\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/69"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/69"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/148286"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/69"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-08-18-2026-1 Safari 26.6.1",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-43794",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43795",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64715",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64778",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64779",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64780",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64781",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64782",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64784",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64787",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65331",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65332",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65333",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65334",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65335",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65336",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65337",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65338",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65340",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65341",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65351",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0303",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/69",
            "automated": true,
            "contentSha256": "e7bc2955faffd4542bd9f546314cba669e5bbd24ea91d092114a1f773497ef5e",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/69",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T19:51:27Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0303"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:49Z",
    "dateUpdated": "2026-09-11T11:51:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0303"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0300

    Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-11 11:48
    VLAI
    Title
    APPLE-SA-08-06-2026-2 macOS Sequoia 15.7.9
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-06-2026-2 macOS Sequoia 15.7.9 macOS Sequoia 15.7.9 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/148171. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Screen Sharing Available for: macOS Sequoia Impact: An attacker on the network may be able to authenticate to Screen Sharing without valid credentials Description: An authentication issue was addressed with improved state management. CVE-2026-65400: Alfredo Pesoli (@__rev) via Bynario Atlas (bynar.io) macOS Sequoia 15.7.9 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmp038cACgkQ4Ifiq8DH 7PX5Lw/9GAmAP1eJuNJBxT5p4fvJjE3OltPezGlm65h7YURbVkA8+HOhDWUsL2Ky MafnodYGetgUbp8+6pJAC/cUJRPwV7UvUq64PGzAZK95+k4bwOMrsbehGZggsvxU 9fvt+hx/hDZc8hflIYEYLsgpM9/RloUUFyp3jG3/MvR7zStaE2AlPahKfKs6BtvK UxJTNpo35dVMoFbv/OVxjcBrUnauC9hJnf/UwLAWIYhuDB0sojIWbkIRmpYmBDST DqdeEV9GJeF113ryzQV+xdoUxyEQVIKDCMfejgbuxVdRn6Q72SaJPrWPf2t9G86L dEW8jjISA5ZQfSezIq21Rj8LmYnyo0DOAZEdQOoCQa2McGsiT8KAsJDjY2+FB3H0 8WVW+VQUWGIGHKY3Hjal7ytvNIeWIWTd6M3nYHHkqNPnQKCSM1bbqi6Qj0NHO/vL HcYiwMuBIlu970SgFNMttmrdZvks8JG1KI2GD18nNHRA2DC7eXqXiGPcK5QMX3ZB WpovpwHa1s15Sdx1pGM8LeWC5+6Qxo0zAkozKM440O58Z2N02ETFLUENQ6s8Q4Ah rCqdMCNP+IP3stoqfk5sFJq75bjfMruGqC4DfBJdDLmRIg7YZ7NaR3j9WZOMQfyO 1dIV5ILTaIow0TeBFb6n9iC3SxvGvQQArtcIQkxO+LEBwakKj5M= =6Ozt -----END PGP SIGNATURE----- _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Apple Macos Sequoia Affected: unknown
    		Create a notification for this product.
    Credits
    Apple Product Security via Fulldisclosure
    Relationships
    reference GCVE-1988-2026-0300 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Macos Sequoia",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-08-06-2026-2 macOS Sequoia 15.7.9\n\nmacOS Sequoia 15.7.9 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/148171.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nScreen Sharing\nAvailable for: macOS Sequoia\nImpact: An attacker on the network may be able to authenticate to Screen\nSharing without valid credentials\nDescription: An authentication issue was addressed with improved state\nmanagement.\nCVE-2026-65400: Alfredo Pesoli (@__rev) via Bynario Atlas (bynar.io)\n\nmacOS Sequoia 15.7.9 may be obtained from the Mac App Store or Apple\u0027s\nSoftware Downloads web site: https://support.apple.com/downloads/\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmp038cACgkQ4Ifiq8DH\n7PX5Lw/9GAmAP1eJuNJBxT5p4fvJjE3OltPezGlm65h7YURbVkA8+HOhDWUsL2Ky\nMafnodYGetgUbp8+6pJAC/cUJRPwV7UvUq64PGzAZK95+k4bwOMrsbehGZggsvxU\n9fvt+hx/hDZc8hflIYEYLsgpM9/RloUUFyp3jG3/MvR7zStaE2AlPahKfKs6BtvK\nUxJTNpo35dVMoFbv/OVxjcBrUnauC9hJnf/UwLAWIYhuDB0sojIWbkIRmpYmBDST\nDqdeEV9GJeF113ryzQV+xdoUxyEQVIKDCMfejgbuxVdRn6Q72SaJPrWPf2t9G86L\ndEW8jjISA5ZQfSezIq21Rj8LmYnyo0DOAZEdQOoCQa2McGsiT8KAsJDjY2+FB3H0\n8WVW+VQUWGIGHKY3Hjal7ytvNIeWIWTd6M3nYHHkqNPnQKCSM1bbqi6Qj0NHO/vL\nHcYiwMuBIlu970SgFNMttmrdZvks8JG1KI2GD18nNHRA2DC7eXqXiGPcK5QMX3ZB\nWpovpwHa1s15Sdx1pGM8LeWC5+6Qxo0zAkozKM440O58Z2N02ETFLUENQ6s8Q4Ah\nrCqdMCNP+IP3stoqfk5sFJq75bjfMruGqC4DfBJdDLmRIg7YZ7NaR3j9WZOMQfyO\n1dIV5ILTaIow0TeBFb6n9iC3SxvGvQQArtcIQkxO+LEBwakKj5M=\n=6Ozt\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:48:28Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/37"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/37"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/downloads/"
        },
        {
          "url": "https://support.apple.com/en-us/148171"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/37"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-08-06-2026-2 macOS Sequoia 15.7.9",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-65400",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0300",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/37",
            "automated": true,
            "contentSha256": "26acdac926213e8f1719d54af58285bc35919794c339c3c79e698b1907bf4547",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/37",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-06T21:40:26Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0300"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:48Z",
    "dateUpdated": "2026-09-11T11:48:28Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0300"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0301

    Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-11 11:48
    VLAI
    Title
    APPLE-SA-08-06-2026-3 macOS Sonoma 14.8.9
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-06-2026-3 macOS Sonoma 14.8.9 macOS Sonoma 14.8.9 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/148172. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Screen Sharing Available for: macOS Sonoma Impact: An attacker on the network may be able to authenticate to Screen Sharing without valid credentials Description: An authentication issue was addressed with improved state management. CVE-2026-65400: Alfredo Pesoli (@__rev) via Bynario Atlas (bynar.io) macOS Sonoma 14.8.9 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmp0398ACgkQ4Ifiq8DH 7PWKMBAAvu5xxYJxYrHC6Oj94mG6HrnUKB65O7T36D022gyXCWYCyQW1zeMRPpNZ 6UlYiVQ4VJ211Ycgk8DWMqe3Z/slaoyF1sBk7kchBDu4Uu+cNB1YpvCskYFkVSJu CS0CekYlsAjedz69+Q9OfwtccVyfg1pECt8SiTN1aGJwqyD1WamJt+/cxWD3Vwby xnsjk8/7balvtsNihbGgrt63145pCBNd5h/51731cLv1c5AOA5Yj3uShbRcnDf/f WyKl2ADehEaRd0Fm/Curc5d2h2Ca6LNtpKcsvTPvCzudqW/UItJ+E+b4LJTDmY/P H5/Vgwv2O9cxZDE7hc4i8HomhPAgIMceqv/Of+qA49Nee6ksxvsaUPketxQ59XVS jm3ZNOasRohb4puIKKbS3kAyo0+3CTAPMWG8a/mwSo0vdBfue9wk3Mfr0tNiW2dP 8VeBueXF4aMfxXqy8TFruo3eO68XwsE7Qzt5TX8kKlHmq7j76CO6ewohzPES8AYS 5tjPWVHKBIzT7qhO7IqVqNl1WlDlxHs8sROxT9/s9GAZctxzI7oonmChXVTECwN1 TXHc5jd1QlwY7zKN5sBN84xMv43bzf19/h2IPJdmYGX5aBs8WyteGFvQQSxOCOlf pLlLXhaWg0eBom3v9H/+vhkmEBU1ax9gMhxbmqS68PK3r2swecE= =XrU0 -----END PGP SIGNATURE----- _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Apple Macos Sonoma Affected: unknown
    		Create a notification for this product.
    Credits
    Apple Product Security via Fulldisclosure
    Relationships
    reference GCVE-1988-2026-0301 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Macos Sonoma",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-08-06-2026-3 macOS Sonoma 14.8.9\n\nmacOS Sonoma 14.8.9 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/148172.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nScreen Sharing\nAvailable for: macOS Sonoma\nImpact: An attacker on the network may be able to authenticate to Screen\nSharing without valid credentials\nDescription: An authentication issue was addressed with improved state\nmanagement.\nCVE-2026-65400: Alfredo Pesoli (@__rev) via Bynario Atlas (bynar.io)\n\nmacOS Sonoma 14.8.9 may be obtained from the Mac App Store or Apple\u0027s\nSoftware Downloads web site: https://support.apple.com/downloads/\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmp0398ACgkQ4Ifiq8DH\n7PWKMBAAvu5xxYJxYrHC6Oj94mG6HrnUKB65O7T36D022gyXCWYCyQW1zeMRPpNZ\n6UlYiVQ4VJ211Ycgk8DWMqe3Z/slaoyF1sBk7kchBDu4Uu+cNB1YpvCskYFkVSJu\nCS0CekYlsAjedz69+Q9OfwtccVyfg1pECt8SiTN1aGJwqyD1WamJt+/cxWD3Vwby\nxnsjk8/7balvtsNihbGgrt63145pCBNd5h/51731cLv1c5AOA5Yj3uShbRcnDf/f\nWyKl2ADehEaRd0Fm/Curc5d2h2Ca6LNtpKcsvTPvCzudqW/UItJ+E+b4LJTDmY/P\nH5/Vgwv2O9cxZDE7hc4i8HomhPAgIMceqv/Of+qA49Nee6ksxvsaUPketxQ59XVS\njm3ZNOasRohb4puIKKbS3kAyo0+3CTAPMWG8a/mwSo0vdBfue9wk3Mfr0tNiW2dP\n8VeBueXF4aMfxXqy8TFruo3eO68XwsE7Qzt5TX8kKlHmq7j76CO6ewohzPES8AYS\n5tjPWVHKBIzT7qhO7IqVqNl1WlDlxHs8sROxT9/s9GAZctxzI7oonmChXVTECwN1\nTXHc5jd1QlwY7zKN5sBN84xMv43bzf19/h2IPJdmYGX5aBs8WyteGFvQQSxOCOlf\npLlLXhaWg0eBom3v9H/+vhkmEBU1ax9gMhxbmqS68PK3r2swecE=\n=XrU0\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:48:27Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/36"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/36"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/downloads/"
        },
        {
          "url": "https://support.apple.com/en-us/148172"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/36"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-08-06-2026-3 macOS Sonoma 14.8.9",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-65400",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0301",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/36",
            "automated": true,
            "contentSha256": "016461bdaf6fbe1eace4507eae57efa6bca93c0328b1afdd3bf1e17926f2361b",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/36",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-06T21:40:59Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0301"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:48Z",
    "dateUpdated": "2026-09-11T11:48:27Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0301"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0294

    Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-11 11:47
    VLAI
    Title
    APPLE-SA-07-27-2026-8 Safari 26.6
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-07-27-2026-8 Safari 26.6 Safari 26.6 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/128073. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Safari Available for: macOS Sonoma and macOS Sequoia Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-43792: Ilya Andr (andrd3v) WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may result in the disclosure of process memory Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 308046 CVE-2026-43740: Arni Hardarson, Nathaniel Oh (@calysteon) WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Websites may know if the user has visited a given link Description: This issue was addressed with improved checks. WebKit Bugzilla: 316827 CVE-2026-64713: Kwak Kiyong, Song Nuri WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Visiting a website that frames malicious content may lead to UI spoofing Description: The issue was addressed with improved UI. WebKit Bugzilla: 311660 CVE-2026-64730: Kagami Rosylight of Mozilla WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Maliciously crafted web content may violate iframe sandboxing policy Description: A permissions issue was addressed with improved validation. WebKit Bugzilla: 313220 CVE-2026-64728: an anonymous researcher WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 313521 CVE-2026-64783: 杉山 壮太, lattice, Behzad Najjarpour Jabbari (@_G4ru_), Junyeong Lee, Mooth.ai, OGINOME Tomohito, Using GLM From Z.AI, Gia Bui (@yabeow) from Calif.io WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A memory corruption issue was addressed with improved state management. WebKit Bugzilla: 315082 CVE-2026-64757: Milad Nasr and Nicholas Carlini with Claude, Anthropic WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Visiting a website may lead to an app denial-of-service Description: This issue was addressed through improved state management. WebKit Bugzilla: 316816 CVE-2026-43804: Heiko Kiesel of SEEMOO, TU Darmstadt WebKit Available for: macOS Sonoma and macOS Sequoia Impact: An app may be able to read files outside of its sandbox Description: An access issue was addressed with improved access restrictions. WebKit Bugzilla: 314867 CVE-2026-43821: Brian Carpenter WebKit Canvas Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 313935 CVE-2026-64718: OGINOME Tomohito, an anonymous researcher WebRTC Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: An out-of-bounds access issue was addressed with improved bounds checking. WebKit Bugzilla: 319404 CVE-2026-64719: Shaheen Fazim Additional recognition Safari Downloads We would like to acknowledge Alfaz Hossain for their assistance. WebKit We would like to acknowledge Jaya Surya Kommireddy, Jaya surya Kommireddy, Lukas Knittel (@kunte_ctf) of Ruhr-University Bochum, Nikos Fanourakis of Technical University of Crete, Sotiris Ioannidis of Technical University of Crete, Panagiotis Ilia of Cyprus University of Technology, and Kostas Drakonakis of Technical University of Crete, Tony Gorez (@tonygo_) for Reverse Society, Vitaly Simonovich, Youngjoon Kim of Team-Atlanta & sslab at Georgia Tech, s3zer0 for their assistance. WebKit Canvas We would like to acknowledge Codex Security - Khai Tran, Daisuke Hatakeyama and Ryohei Ueki (@SYZD Research), David Bors at Snyk Security Labs, Giovanni Vignone and Robert van Eijk of Octane Security (octane.security), Kwak Kiyong, Song nuri, Luat Nguyen (CyberJutsu Academy), Tom Van Goethem, an anonymous researcher, dr3dd for their assistance. WebKit Storage We would like to acknowledge Gurpreet Shergill, Luke Francis, Milad Nasr and Nicholas Carlini with Claude, Anthropic, Oleh Konko of 1seal (1seal.org), Vitaly Simonovich for their assistance. Safari 26.6 may be obtained from the Mac App Store. All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmpn4iMACgkQ4Ifiq8DH 7PUTig//dN43HRyvQWDfL6xMYj1NvUVLsWy8KXyMy33uJ4A3K+7H0lsFPpVusN5R TAPd6SOjmrMAH04dveKIy6isyZUxG6P6Ez7nLZXkalw8UCRt0QDzFZJQT2dgPzrY n57bQLrkw5HXAStWcviCbQCU9OjZVg44kWOHkI18AngBnpgF6Xcdn2KsO8A1UVj6 MLtFMg9AArwT+FMC1mqJv5IYGQZaDmcCNjz9+dm4ryHeOBpHm5t3stPr8fiOLgM8 nYuzKQc0ABsS+ne8/Ivter+iLDYM2ZH/EhswBDeIWuS7RTwAAsOwwMi6HGJAkpJU WNrPz+yMY+oO1M/+6KRDP+3L6H1P4hSxgCRcreokE1JnjuvGgDEiq2s1r7GGJL2L +RCnKAnL0c+B0EEedYH6Yi3jcLzaqKXnlfJBdVu7IKW7VjRcr07IwmemeIMfFF+O ctCTvHUGT723b63D131qqCcnUgiprijhJ02Sw/IaHQckxUeNt/USY0eYuQbhfC+y X1olXowGzDRXznuCze2L33jCjYy9MFJp/8K2s2ap4yTAR9jlohdP1GrxQcDj1NUu XaDKOq3VUF2Z+S1OpEOVn8pgax4evoHyu8Nh7AsuwiTw07VKq3qfg/0SZbuOcnLq aKYx+4St5AyBVKlzR489dL3V9fRkov1dwA3iPVLR35vCan8E83w= =3nQh -----END PGP SIGNATURE----- _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Apple Safari Affected: unknown
    		Create a notification for this product.
    Credits
    Apple Product Security via Fulldisclosure
    Relationships
    reference GCVE-1988-2026-0294 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-07-27-2026-8 Safari 26.6\n\nSafari 26.6 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/128073.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nSafari\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-43792: Ilya Andr (andrd3v)\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may result in the\ndisclosure of process memory\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 308046\nCVE-2026-43740: Arni Hardarson, Nathaniel Oh (@calysteon)\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Websites may know if the user has visited a given link\nDescription: This issue was addressed with improved checks.\nWebKit Bugzilla: 316827\nCVE-2026-64713: Kwak Kiyong, Song Nuri\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Visiting a website that frames malicious content may lead to UI\nspoofing\nDescription: The issue was addressed with improved UI.\nWebKit Bugzilla: 311660\nCVE-2026-64730: Kagami Rosylight of Mozilla\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Maliciously crafted web content may violate iframe sandboxing\npolicy\nDescription: A permissions issue was addressed with improved validation.\nWebKit Bugzilla: 313220\nCVE-2026-64728: an anonymous researcher\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313521\nCVE-2026-64783: \u6749\u5c71 \u58ee\u592a, lattice, Behzad Najjarpour Jabbari (@_G4ru_),\nJunyeong Lee, Mooth.ai, OGINOME Tomohito, Using GLM From Z.AI, Gia Bui\n(@yabeow) from Calif.io\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption issue was addressed with improved state\nmanagement.\nWebKit Bugzilla: 315082\nCVE-2026-64757: Milad Nasr and Nicholas Carlini with Claude, Anthropic\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Visiting a website may lead to an app denial-of-service\nDescription: This issue was addressed through improved state management.\nWebKit Bugzilla: 316816\nCVE-2026-43804: Heiko Kiesel of SEEMOO, TU Darmstadt\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: An app may be able to read files outside of its sandbox\nDescription: An access issue was addressed with improved access\nrestrictions.\nWebKit Bugzilla: 314867\nCVE-2026-43821: Brian Carpenter\n\nWebKit Canvas\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313935\nCVE-2026-64718: OGINOME Tomohito, an anonymous researcher\n\nWebRTC\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nWebKit Bugzilla: 319404\nCVE-2026-64719: Shaheen Fazim\n\nAdditional recognition\n\nSafari Downloads\nWe would like to acknowledge Alfaz Hossain for their assistance.\n\nWebKit\nWe would like to acknowledge Jaya Surya Kommireddy, Jaya surya\nKommireddy, Lukas Knittel (@kunte_ctf) of Ruhr-University Bochum, Nikos\nFanourakis of Technical University of Crete, Sotiris Ioannidis of\nTechnical University of Crete, Panagiotis Ilia of Cyprus University of\nTechnology, and Kostas Drakonakis of Technical University of Crete, Tony\nGorez (@tonygo_) for Reverse Society, Vitaly Simonovich, Youngjoon Kim\nof Team-Atlanta \u0026 sslab at Georgia Tech, s3zer0 for their assistance.\n\nWebKit Canvas\nWe would like to acknowledge Codex Security - Khai Tran, Daisuke\nHatakeyama and Ryohei Ueki (@SYZD Research), David Bors at Snyk Security\nLabs, Giovanni Vignone and Robert van Eijk of Octane Security\n(octane.security), Kwak Kiyong, Song nuri, Luat Nguyen (CyberJutsu\nAcademy), Tom Van Goethem, an anonymous researcher, dr3dd for their\nassistance.\n\nWebKit Storage\nWe would like to acknowledge Gurpreet Shergill, Luke Francis, Milad Nasr\nand Nicholas Carlini with Claude, Anthropic, Oleh Konko of 1seal\n(1seal.org), Vitaly Simonovich for their assistance.\n\nSafari 26.6 may be obtained from the Mac App Store.\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmpn4iMACgkQ4Ifiq8DH\n7PUTig//dN43HRyvQWDfL6xMYj1NvUVLsWy8KXyMy33uJ4A3K+7H0lsFPpVusN5R\nTAPd6SOjmrMAH04dveKIy6isyZUxG6P6Ez7nLZXkalw8UCRt0QDzFZJQT2dgPzrY\nn57bQLrkw5HXAStWcviCbQCU9OjZVg44kWOHkI18AngBnpgF6Xcdn2KsO8A1UVj6\nMLtFMg9AArwT+FMC1mqJv5IYGQZaDmcCNjz9+dm4ryHeOBpHm5t3stPr8fiOLgM8\nnYuzKQc0ABsS+ne8/Ivter+iLDYM2ZH/EhswBDeIWuS7RTwAAsOwwMi6HGJAkpJU\nWNrPz+yMY+oO1M/+6KRDP+3L6H1P4hSxgCRcreokE1JnjuvGgDEiq2s1r7GGJL2L\n+RCnKAnL0c+B0EEedYH6Yi3jcLzaqKXnlfJBdVu7IKW7VjRcr07IwmemeIMfFF+O\nctCTvHUGT723b63D131qqCcnUgiprijhJ02Sw/IaHQckxUeNt/USY0eYuQbhfC+y\nX1olXowGzDRXznuCze2L33jCjYy9MFJp/8K2s2ap4yTAR9jlohdP1GrxQcDj1NUu\nXaDKOq3VUF2Z+S1OpEOVn8pgax4evoHyu8Nh7AsuwiTw07VKq3qfg/0SZbuOcnLq\naKYx+4St5AyBVKlzR489dL3V9fRkov1dwA3iPVLR35vCan8E83w=\n=3nQh\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:47:50Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/23"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/23"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/en-us/128073"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/23"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-07-27-2026-8 Safari 26.6",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-43740",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43792",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43804",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43821",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64713",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64718",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64719",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64728",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64730",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64757",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64783",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0294",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/23",
            "automated": true,
            "contentSha256": "38f987ac49c6174abe8e7fb441f3c17c5e00305bda36174c90f11839c358c339",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/23",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-28T00:27:54Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0294"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:48Z",
    "dateUpdated": "2026-09-11T11:47:50Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0294"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0293

    Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-11 11:47
    VLAI
    Title
    APPLE-SA-07-27-2026-7 visionOS 26.6
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-07-27-2026-7 visionOS 26.6 visionOS 26.6 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/128070. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accounts Framework Available for: Apple Vision Pro (all models) Impact: An app may be able to fingerprint the user Description: This issue was addressed with improved data protection. CVE-2026-64733: Rosyna Keller of Totally Not Malicious Software (paradisefacade.com) App Store Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved checks. CVE-2026-43801: Rahul Raj Audio Available for: Apple Vision Pro (all models) Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/) AuthKit Available for: Apple Vision Pro (all models) Impact: An app may be able to fingerprint the user Description: A permissions issue was addressed with additional restrictions. CVE-2026-43730: David Strnadel AVEVideoEncoder Available for: Apple Vision Pro (all models) Impact: An app may be able to execute arbitrary code with kernel privileges Description: A buffer overflow was addressed with improved size validation. CVE-2026-64747: Franco Belman at Blackwing Intelligence BackgroundAssets Available for: Apple Vision Pro (all models) Impact: An app may be able to delete files for which it does not have permission Description: A permissions issue was addressed with improved validation. CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab CloudAttestation Available for: Apple Vision Pro (all models) Impact: A maliciously crafted app may be able to bypass code signing enforcement Description: A validation issue was addressed with improved input sanitization. CVE-2026-43813: Anton Pakhunov Contacts Available for: Apple Vision Pro (all models) Impact: An app may be able to add contacts without user authorization Description: An authorization issue was addressed with improved validation. CVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel Febrero Contacts Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted contact may leak sensitive data Description: The issue was addressed with improved checks. CVE-2026-64734: Daniel Williams CoreAudio Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted audio file may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative CoreAudio Available for: Apple Vision Pro (all models) Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43744: Mathis Mansière, an anonymous researcher CoreAudio Available for: Apple Vision Pro (all models) Impact: A remote attacker may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43803: Rahul Raj CoreMedia Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: A memory corruption issue was addressed with improved memory handling. CVE-2026-43711: James Duffy (@0x4A616D657344) Foundation Available for: Apple Vision Pro (all models) Impact: A malicious app may be able to access protected user data Description: The issue was addressed with improved input sanitization. CVE-2026-43714: an anonymous researcher FrontBoard Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: This issue was addressed by using HTTPS when sending information over the network. CVE-2026-64742: Huỳnh Tấn Ngàn Game Center Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved data protection. CVE-2026-43796: Ilya Andr (andrd3v) of Positive Technologies, Stanislav Jelezoglo Heimdal Available for: Apple Vision Pro (all models) Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64692: Redon Gashi ImageIO Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted texture may lead to unexpected app termination Description: An integer overflow was addressed with improved input validation. CVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative ImageIO Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted image may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-64716: Arni Hardarson, Jonathan Alush-Aben, Peter Malone ImageIO Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: The issue was addressed with improved bounds checks. CVE-2026-64758: 진규정 (Gyujeong Jin, @G1uN4sh) ImageIO Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted file may lead to a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64754: PETOWORKS의 Bugeun Choi (@Bugeun), Rahul Raj ImageIO Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted image may lead to a denial-of-service Description: A type confusion issue was addressed with improved checks. CVE-2026-64693: Geonha Lee (@leegn4a) Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64749: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ashish Kunwar, Hiroki Imai (LAC Co., Ltd.), hxr1 Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2026-43778: f0r of MurphySec, Feng Xue and XGPT of ThreatBook, Mahmoud Abdelmoniem, an anonymous researcher, Wang Yu, Lyutoon, Hiroki Imai (LAC Co., Ltd.), DARKNAVY (@DarkNavyOrg), Fábio Luís @scanpt, Nicolas Rabrenovic Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to disclose kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64709: Pasquale Scola, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple Vision Pro (all models) Impact: A remote attacker may be able to bypass network filters Description: An inconsistent user interface issue was addressed with improved state management. CVE-2026-64735: Gor Aleksanyan Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43739: impost0r (ret2plt), Ruslan Dautov, Aleksandr Tarasikov, jay, Dhiyanesh Selvaraj (@redroot97), Vinay Kumar Rasala (Xplo8E) from Appknox, Lyutoon, DongJun Kim (smlijun) with UIUC, Hwiwon Lee (hwiwonl) with UIUC, Jongseong Kim (nevul37) with UIUC, Younggi Park (grill66) with UIUC, Peter Malone, an anonymous researcher, Hari Shanmugam (The Hxr1), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Marco Grassi, Dun, Daniele Castronovo, Michal Kosiorek CVE-2026-43816: Josh Maine of Calif.io, Ruslan Dautov, 재영 정, @rootxran (Rao Ali Nawaz), Chanwit Muenprakoddee (ChemIndy), an anonymous researcher, Ye Zhang (@VAR10CK) of Baidu Security, Franco Belman at Blackwing Intelligence, Christian Figueroa, Johnny Franks (@zeroxjf), Ashmit Sharma & Atul RV, Peter Malone, Muhamad Syaiful, Muneeb Amin Bhat, Dhiyanesh Selvaraj (@redroot97), Ali Marzouq, Bountyy Oy - Mihalis Haatainen, Huy Nguyen (@34306) of Calif.io Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-43822: Eddy Tsalolikhin, Michal Kosiorek CVE-2026-64729: Josh Maine of Calif.io, beist, Adam Doupé of ASU SEFCOM, Dun, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Johnny Franks (@zeroxjf) CVE-2026-64700: Asjid Kalam (@odinshell) CVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-43817: Huy Nguyen (@34306) of Calif.io Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination or write kernel memory Description: The issue was addressed with improved input sanitization. CVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel) Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination Description: An integer overflow was addressed with improved input validation. CVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple Vision Pro (all models) Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-43810: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination Description: A memory initialization issue was addressed with improved memory handling. CVE-2026-64775: Ryan Hileman via Xint Code (xint.io) Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: This issue was addressed with improved input validation. CVE-2026-39868: Vladislav Shevchenko (Positive Technologies), Ye Zhang (@VAR10CK) of Baidu Security, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination or write kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2026-64751: N.M.Praveen Nawarathne (@zblockrat) Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: This issue was addressed through improved state management. CVE-2026-64721: Lukas Gerlach libarchive Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted file may result in disclosure of process memory Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2026-4424 Libnotify Available for: Apple Vision Pro (all models) Impact: An attacker may be able to cause unexpected app termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64739: Feng Xue and XGPT of ThreatBook, Dun libxslt Available for: Apple Vis
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Apple Visionos Affected: unknown
    		Create a notification for this product.
    Credits
    Apple Product Security via Fulldisclosure
    Relationships
    reference GCVE-1988-2026-0293 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Visionos",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-07-27-2026-7 visionOS 26.6\n\nvisionOS 26.6 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/128070.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccounts Framework\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to fingerprint the user\nDescription: This issue was addressed with improved data protection.\nCVE-2026-64733: Rosyna Keller of Totally Not Malicious Software\n(paradisefacade.com)\n\nApp Store\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved checks.\nCVE-2026-43801: Rahul Raj\n\nAudio\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\nAuthKit\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to fingerprint the user\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-43730: David Strnadel\n\nAVEVideoEncoder\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges\nDescription: A buffer overflow was addressed with improved size\nvalidation.\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\nBackgroundAssets\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to delete files for which it does not have\npermission\nDescription: A permissions issue was addressed with improved validation.\nCVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity\u0027s WeBin lab\n\nCloudAttestation\nAvailable for: Apple Vision Pro (all models)\nImpact: A maliciously crafted app may be able to bypass code signing\nenforcement\nDescription: A validation issue was addressed with improved input\nsanitization.\nCVE-2026-43813: Anton Pakhunov\n\nContacts\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to add contacts without user authorization\nDescription: An authorization issue was addressed with improved\nvalidation.\nCVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel\nFebrero\n\nContacts\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted contact may leak sensitive data\nDescription: The issue was addressed with improved checks.\nCVE-2026-64734: Daniel Williams\n\nCoreAudio\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted audio file may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\nCoreAudio\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43744: Mathis Mansi\u00e8re, an anonymous researcher\n\nCoreAudio\nAvailable for: Apple Vision Pro (all models)\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43803: Rahul Raj\n\nCoreMedia\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\nFoundation\nAvailable for: Apple Vision Pro (all models)\nImpact: A malicious app may be able to access protected user data\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43714: an anonymous researcher\n\nFrontBoard\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed by using HTTPS when sending\ninformation over the network.\nCVE-2026-64742: Hu\u1ef3nh T\u1ea5n Ng\u00e0n\n\nGame Center\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43796: Ilya Andr (andrd3v) of Positive Technologies, Stanislav\nJelezoglo\n\nHeimdal\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64692: Redon Gashi\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted texture may lead to unexpected\napp termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day\nInitiative\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64716: Arni Hardarson, Jonathan Alush-Aben, Peter Malone\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-64758: \uc9c4\uaddc\uc815 (Gyujeong Jin, @G1uN4sh)\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted file may lead to a\ndenial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64754: PETOWORKS\uc758 Bugeun Choi (@Bugeun), Rahul Raj\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may lead to a\ndenial-of-service\nDescription: A type confusion issue was addressed with improved checks.\nCVE-2026-64693: Geonha Lee (@leegn4a)\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64749: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd., Ashish Kunwar, Hiroki Imai (LAC Co., Ltd.),\nhxr1\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43778: f0r of MurphySec, Feng Xue and XGPT of ThreatBook,\nMahmoud Abdelmoniem, an anonymous researcher, Wang Yu, Lyutoon, Hiroki\nImai (LAC Co., Ltd.), DARKNAVY (@DarkNavyOrg), F\u00e1bio Lu\u00eds @scanpt,\nNicolas Rabrenovic\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64709: Pasquale Scola, Billy Jheng Bing Jhong and Pan Zhenpeng\n(@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: A remote attacker may be able to bypass network filters\nDescription: An inconsistent user interface issue was addressed with\nimproved state management.\nCVE-2026-64735: Gor Aleksanyan\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43739: impost0r (ret2plt), Ruslan Dautov, Aleksandr Tarasikov,\njay, Dhiyanesh Selvaraj (@redroot97), Vinay Kumar Rasala (Xplo8E) from\nAppknox, Lyutoon, DongJun Kim (smlijun) with UIUC, Hwiwon Lee (hwiwonl)\nwith UIUC, Jongseong Kim (nevul37) with UIUC, Younggi Park (grill66)\nwith UIUC, Peter Malone, an anonymous researcher, Hari Shanmugam (The\nHxr1), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR\nLabs SG Pte. Ltd., Marco Grassi, Dun, Daniele Castronovo, Michal\nKosiorek\nCVE-2026-43816: Josh Maine of Calif.io, Ruslan Dautov, \uc7ac\uc601 \uc815, @rootxran\n(Rao Ali Nawaz), Chanwit Muenprakoddee (ChemIndy), an anonymous\nresearcher, Ye Zhang (@VAR10CK) of Baidu Security, Franco Belman at\nBlackwing Intelligence, Christian Figueroa, Johnny Franks (@zeroxjf),\nAshmit Sharma \u0026 Atul RV, Peter Malone, Muhamad Syaiful, Muneeb Amin\nBhat, Dhiyanesh Selvaraj (@redroot97), Ali Marzouq, Bountyy Oy - Mihalis\nHaatainen, Huy Nguyen (@34306) of Calif.io\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43822: Eddy Tsalolikhin, Michal Kosiorek\nCVE-2026-64729: Josh Maine of Calif.io, beist, Adam Doup\u00e9 of ASU SEFCOM,\nDun, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR\nLabs SG Pte. Ltd., Johnny Franks (@zeroxjf)\nCVE-2026-64700: Asjid Kalam (@odinshell)\nCVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43817: Huy Nguyen (@34306) of Calif.io\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel)\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: A remote user may be able to cause unexpected system termination\nor corrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43810: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A memory initialization issue was addressed with improved\nmemory handling.\nCVE-2026-64775: Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: This issue was addressed with improved input validation.\nCVE-2026-39868: Vladislav Shevchenko (Positive Technologies), Ye Zhang\n(@VAR10CK) of Baidu Security, Billy Jheng Bing Jhong and Pan Zhenpeng\n(@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-64751: N.M.Praveen Nawarathne (@zblockrat)\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed through improved state management.\nCVE-2026-64721: Lukas Gerlach\n\nlibarchive\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted file may result in disclosure\nof process memory\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-4424\n\nLibnotify\nAvailable for: Apple Vision Pro (all models)\nImpact: An attacker may be able to cause unexpected app termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64739: Feng Xue and XGPT of ThreatBook, Dun\n\nlibxslt\nAvailable for: Apple Vis"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:47:48Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/22"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/22"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/en-us/128070"
        },
        {
          "url": "https://support.apple.com/kb/HT214009"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/22"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-07-27-2026-7 visionOS 26.6",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-28979",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39868",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39872",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43663",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43673",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43676",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43699",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43700",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43701",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43703",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43704",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43705",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43706",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43707",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43708",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43709",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43711",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43712",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43713",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43714",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43715",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43718",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43720",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43721",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43723",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43724",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43725",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43726",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43727",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43729",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43730",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43731",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43732",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43734",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43735",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43739",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43740",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43742",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43744",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43745",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43769",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43778",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43780",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43796",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43799",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43801",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43803",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43804",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43807",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43810",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43812",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43813",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43816",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43817",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43821",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43822",
              "type": "related"
            },
            {
              "destId": "CVE-2026-4424",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64692",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64693",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64700",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64707",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64709",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64713",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64716",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64718",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64719",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64721",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64724",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64725",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64726",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64728",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64729",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64730",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64733",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64734",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64735",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64739",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64741",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64742",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64743",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64746",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64747",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64749",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64751",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64754",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64757",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64758",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64763",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64764",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64765",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64766",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64768",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64769",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64770",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64771",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64772",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64774",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64775",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64783",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0293",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/22",
            "automated": true,
            "contentSha256": "da2c350129029fa4308f6df35ea2d022edc32b98e588d4408fd70659909849a8",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/22",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-28T00:27:26Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0293"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:48Z",
    "dateUpdated": "2026-09-11T11:47:48Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0293"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0292

    Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-11 11:47
    VLAI
    Title
    APPLE-SA-07-27-2026-6 watchOS 26.6
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-07-27-2026-6 watchOS 26.6 watchOS 26.6 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/128068. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accounts Framework Available for: Apple Watch Series 6 and later Impact: An app may be able to fingerprint the user Description: This issue was addressed with improved data protection. CVE-2026-64733: Rosyna Keller of Totally Not Malicious Software (paradisefacade.com) App Store Available for: Apple Watch Series 6 and later Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved checks. CVE-2026-43801: Rahul Raj Apple Neural Engine Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-28928: Dun Audio Available for: Apple Watch Series 6 and later Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/) AuthKit Available for: Apple Watch Series 6 and later Impact: An app may be able to fingerprint the user Description: A permissions issue was addressed with additional restrictions. CVE-2026-43730: David Strnadel AVEVideoEncoder Available for: Apple Watch Series 6 and later Impact: An app may be able to execute arbitrary code with kernel privileges Description: A buffer overflow was addressed with improved size validation. CVE-2026-64747: Franco Belman at Blackwing Intelligence CloudAttestation Available for: Apple Watch Series 6 and later Impact: A maliciously crafted app may be able to bypass code signing enforcement Description: A validation issue was addressed with improved input sanitization. CVE-2026-43813: Anton Pakhunov Contacts Available for: Apple Watch Series 6 and later Impact: An app may be able to add contacts without user authorization Description: An authorization issue was addressed with improved validation. CVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel Febrero Contacts Available for: Apple Watch Series 6 and later Impact: Processing a maliciously crafted contact may leak sensitive data Description: The issue was addressed with improved checks. CVE-2026-64734: Daniel Williams CoreAudio Available for: Apple Watch Series 6 and later Impact: Processing a maliciously crafted audio file may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative CoreAudio Available for: Apple Watch Series 6 and later Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43744: Mathis Mansière, an anonymous researcher CoreAudio Available for: Apple Watch Series 6 and later Impact: A remote attacker may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43803: Rahul Raj CoreMedia Available for: Apple Watch Series 6 and later Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: A memory corruption issue was addressed with improved memory handling. CVE-2026-43711: James Duffy (@0x4A616D657344) CoreMedia Available for: Apple Watch Series 6 and later Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-43759: 이재영, Rajdip Dey Sarkar, Arni Hardarson (Neonix Security) curl Available for: Apple Watch Series 6 and later Impact: Authentication credentials may be sent to a server on another origin Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2026-3784 CVE-2026-3783 Data Detectors UI Available for: Apple Watch Series 6 and later Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-43758: HvxyZLF Foundation Available for: Apple Watch Series 6 and later Impact: A malicious app may be able to access protected user data Description: The issue was addressed with improved input sanitization. CVE-2026-43714: an anonymous researcher FrontBoard Available for: Apple Watch Series 6 and later Impact: An app may be able to access sensitive user data Description: This issue was addressed by using HTTPS when sending information over the network. CVE-2026-64742: Huỳnh Tấn Ngàn Game Center Available for: Apple Watch Series 6 and later Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved data protection. CVE-2026-43796: Ilya Andr (andrd3v) of Positive Technologies, Stanislav Jelezoglo Heimdal Available for: Apple Watch Series 6 and later Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64692: Redon Gashi ImageIO Available for: Apple Watch Series 6 and later Impact: Processing a maliciously crafted texture may lead to unexpected app termination Description: An integer overflow was addressed with improved input validation. CVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative ImageIO Available for: Apple Watch Series 6 and later Impact: Processing a maliciously crafted image may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-64716: Arni Hardarson, Jonathan Alush-Aben, Peter Malone ImageIO Available for: Apple Watch Series 6 and later Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: The issue was addressed with improved bounds checks. CVE-2026-64758: 진규정 (Gyujeong Jin, @G1uN4sh) ImageIO Available for: Apple Watch Series 6 and later Impact: Processing a maliciously crafted file may lead to a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64754: PETOWORKS의 Bugeun Choi (@Bugeun), Rahul Raj ImageIO Available for: Apple Watch Series 6 and later Impact: Processing a maliciously crafted image may lead to a denial-of-service Description: A type confusion issue was addressed with improved checks. CVE-2026-64693: Geonha Lee (@leegn4a) IOGPUFamily Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination Description: A race condition was addressed with improved state handling. CVE-2026-43743: Lyutoon, Dun IOKit Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination or write kernel memory Description: A race condition was addressed with improved state handling. CVE-2026-43805: 이재영 Kernel Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2026-43778: f0r of MurphySec, Feng Xue and XGPT of ThreatBook, Mahmoud Abdelmoniem, an anonymous researcher, Wang Yu, Lyutoon, Hiroki Imai (LAC Co., Ltd.), DARKNAVY (@DarkNavyOrg), Fábio Luís @scanpt, Nicolas Rabrenovic Kernel Available for: Apple Watch Series 6 and later Impact: An app may be able to disclose kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64709: Pasquale Scola, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple Watch Series 6 and later Impact: A remote attacker may be able to bypass network filters Description: An inconsistent user interface issue was addressed with improved state management. CVE-2026-64735: Gor Aleksanyan Kernel Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43739: impost0r (ret2plt), Ruslan Dautov, Aleksandr Tarasikov, jay, Dhiyanesh Selvaraj (@redroot97), Vinay Kumar Rasala (Xplo8E) from Appknox, Lyutoon, DongJun Kim (smlijun) with UIUC, Hwiwon Lee (hwiwonl) with UIUC, Jongseong Kim (nevul37) with UIUC, Younggi Park (grill66) with UIUC, Peter Malone, an anonymous researcher, Hari Shanmugam (The Hxr1), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Marco Grassi, Dun, Daniele Castronovo, Michal Kosiorek CVE-2026-43816: Josh Maine of Calif.io, Ruslan Dautov, 재영 정, @rootxran (Rao Ali Nawaz), Chanwit Muenprakoddee (ChemIndy), an anonymous researcher, Ye Zhang (@VAR10CK) of Baidu Security, Franco Belman at Blackwing Intelligence, Christian Figueroa, Johnny Franks (@zeroxjf), Ashmit Sharma & Atul RV, Peter Malone, Muhamad Syaiful, Muneeb Amin Bhat, Dhiyanesh Selvaraj (@redroot97), Ali Marzouq, Bountyy Oy - Mihalis Haatainen, Huy Nguyen (@34306) of Calif.io Kernel Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-43822: Eddy Tsalolikhin, Michal Kosiorek CVE-2026-64729: Josh Maine of Calif.io, beist, Adam Doupé of ASU SEFCOM, Dun, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Johnny Franks (@zeroxjf) CVE-2026-43814: Somair Ansar, Huy Nguyen (@34306) of Calif.io CVE-2026-64700: Asjid Kalam (@odinshell) CVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple Watch Series 6 and later Impact: Connecting to a malicious NFS server may lead to kernel memory corruption Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-28931: Redon Gashi, Abhijeet Singh (linkedin.com/in/abhiunix/), Peter Malone, Omar Cerrito Kernel Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-43817: Huy Nguyen (@34306) of Calif.io Kernel Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination or write kernel memory Description: The issue was addressed with improved input sanitization. CVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel) Kernel Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination Description: An integer overflow was addressed with improved input validation. CVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple Watch Series 6 and later Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-43810: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination Description: A memory initialization issue was addressed with improved memory handling. CVE-2026-64775: Ryan Hileman via Xint Code (xint.io) Kernel Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: This issue was addressed with improved input validation. CVE-2026-39868: V
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Apple Watchos Affected: unknown
    		Create a notification for this product.
    Credits
    Apple Product Security via Fulldisclosure
    Relationships
    reference GCVE-1988-2026-0292 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Watchos",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-07-27-2026-6 watchOS 26.6\n\nwatchOS 26.6 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/128068.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccounts Framework\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to fingerprint the user\nDescription: This issue was addressed with improved data protection.\nCVE-2026-64733: Rosyna Keller of Totally Not Malicious Software\n(paradisefacade.com)\n\nApp Store\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved checks.\nCVE-2026-43801: Rahul Raj\n\nApple Neural Engine\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28928: Dun\n\nAudio\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\nAuthKit\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to fingerprint the user\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-43730: David Strnadel\n\nAVEVideoEncoder\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges\nDescription: A buffer overflow was addressed with improved size\nvalidation.\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\nCloudAttestation\nAvailable for: Apple Watch Series 6 and later\nImpact: A maliciously crafted app may be able to bypass code signing\nenforcement\nDescription: A validation issue was addressed with improved input\nsanitization.\nCVE-2026-43813: Anton Pakhunov\n\nContacts\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to add contacts without user authorization\nDescription: An authorization issue was addressed with improved\nvalidation.\nCVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel\nFebrero\n\nContacts\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted contact may leak sensitive data\nDescription: The issue was addressed with improved checks.\nCVE-2026-64734: Daniel Williams\n\nCoreAudio\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted audio file may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\nCoreAudio\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43744: Mathis Mansi\u00e8re, an anonymous researcher\n\nCoreAudio\nAvailable for: Apple Watch Series 6 and later\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43803: Rahul Raj\n\nCoreMedia\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\nCoreMedia\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-43759: \uc774\uc7ac\uc601, Rajdip Dey Sarkar, Arni Hardarson (Neonix Security)\n\ncurl\nAvailable for: Apple Watch Series 6 and later\nImpact: Authentication credentials may be sent to a server on another\norigin\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-3784\nCVE-2026-3783\n\nData Detectors UI\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-43758: HvxyZLF\n\nFoundation\nAvailable for: Apple Watch Series 6 and later\nImpact: A malicious app may be able to access protected user data\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43714: an anonymous researcher\n\nFrontBoard\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed by using HTTPS when sending\ninformation over the network.\nCVE-2026-64742: Hu\u1ef3nh T\u1ea5n Ng\u00e0n\n\nGame Center\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43796: Ilya Andr (andrd3v) of Positive Technologies, Stanislav\nJelezoglo\n\nHeimdal\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64692: Redon Gashi\n\nImageIO\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted texture may lead to unexpected\napp termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day\nInitiative\n\nImageIO\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64716: Arni Hardarson, Jonathan Alush-Aben, Peter Malone\n\nImageIO\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-64758: \uc9c4\uaddc\uc815 (Gyujeong Jin, @G1uN4sh)\n\nImageIO\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted file may lead to a\ndenial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64754: PETOWORKS\uc758 Bugeun Choi (@Bugeun), Rahul Raj\n\nImageIO\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted image may lead to a\ndenial-of-service\nDescription: A type confusion issue was addressed with improved checks.\nCVE-2026-64693: Geonha Lee (@leegn4a)\n\nIOGPUFamily\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-43743: Lyutoon, Dun\n\nIOKit\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-43805: \uc774\uc7ac\uc601\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43778: f0r of MurphySec, Feng Xue and XGPT of ThreatBook,\nMahmoud Abdelmoniem, an anonymous researcher, Wang Yu, Lyutoon, Hiroki\nImai (LAC Co., Ltd.), DARKNAVY (@DarkNavyOrg), F\u00e1bio Lu\u00eds @scanpt,\nNicolas Rabrenovic\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64709: Pasquale Scola, Billy Jheng Bing Jhong and Pan Zhenpeng\n(@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: A remote attacker may be able to bypass network filters\nDescription: An inconsistent user interface issue was addressed with\nimproved state management.\nCVE-2026-64735: Gor Aleksanyan\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43739: impost0r (ret2plt), Ruslan Dautov, Aleksandr Tarasikov,\njay, Dhiyanesh Selvaraj (@redroot97), Vinay Kumar Rasala (Xplo8E) from\nAppknox, Lyutoon, DongJun Kim (smlijun) with UIUC, Hwiwon Lee (hwiwonl)\nwith UIUC, Jongseong Kim (nevul37) with UIUC, Younggi Park (grill66)\nwith UIUC, Peter Malone, an anonymous researcher, Hari Shanmugam (The\nHxr1), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR\nLabs SG Pte. Ltd., Marco Grassi, Dun, Daniele Castronovo, Michal\nKosiorek\nCVE-2026-43816: Josh Maine of Calif.io, Ruslan Dautov, \uc7ac\uc601 \uc815, @rootxran\n(Rao Ali Nawaz), Chanwit Muenprakoddee (ChemIndy), an anonymous\nresearcher, Ye Zhang (@VAR10CK) of Baidu Security, Franco Belman at\nBlackwing Intelligence, Christian Figueroa, Johnny Franks (@zeroxjf),\nAshmit Sharma \u0026 Atul RV, Peter Malone, Muhamad Syaiful, Muneeb Amin\nBhat, Dhiyanesh Selvaraj (@redroot97), Ali Marzouq, Bountyy Oy - Mihalis\nHaatainen, Huy Nguyen (@34306) of Calif.io\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43822: Eddy Tsalolikhin, Michal Kosiorek\nCVE-2026-64729: Josh Maine of Calif.io, beist, Adam Doup\u00e9 of ASU SEFCOM,\nDun, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR\nLabs SG Pte. Ltd., Johnny Franks (@zeroxjf)\nCVE-2026-43814: Somair Ansar, Huy Nguyen (@34306) of Calif.io\nCVE-2026-64700: Asjid Kalam (@odinshell)\nCVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: Connecting to a malicious NFS server may lead to kernel memory\ncorruption\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28931: Redon Gashi, Abhijeet Singh (linkedin.com/in/abhiunix/),\nPeter Malone, Omar Cerrito\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43817: Huy Nguyen (@34306) of Calif.io\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel)\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: A remote user may be able to cause unexpected system termination\nor corrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43810: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A memory initialization issue was addressed with improved\nmemory handling.\nCVE-2026-64775: Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: This issue was addressed with improved input validation.\nCVE-2026-39868: V"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:47:47Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/21"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/21"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/en-us/128068"
        },
        {
          "url": "https://support.apple.com/kb/HT204641"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/21"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-07-27-2026-6 watchOS 26.6",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-28928",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28931",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28973",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28979",
              "type": "related"
            },
            {
              "destId": "CVE-2026-3783",
              "type": "related"
            },
            {
              "destId": "CVE-2026-3784",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39868",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39872",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43663",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43673",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43676",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43699",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43700",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43701",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43703",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43704",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43705",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43706",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43707",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43708",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43709",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43711",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43712",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43713",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43714",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43715",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43717",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43718",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43720",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43721",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43723",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43724",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43725",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43726",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43727",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43730",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43731",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43732",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43734",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43735",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43739",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43740",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43742",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43743",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43744",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43745",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43758",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43759",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43769",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43778",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43780",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43796",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43799",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43800",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43801",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43803",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43805",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43807",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43810",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43813",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43814",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43816",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43817",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43821",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43822",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64692",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64693",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64700",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64709",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64713",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64716",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64718",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64719",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64720",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64721",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64724",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64725",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64726",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64728",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64729",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64730",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64733",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64734",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64735",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64739",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64741",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64742",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64743",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64746",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64747",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64751",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64754",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64757",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64758",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64763",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64764",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64765",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64766",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64775",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64783",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0292",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/21",
            "automated": true,
            "contentSha256": "ffd6955a65f961da5d777187fc4e1798b0627198e546dddbe139826655056ca6",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/21",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-28T00:27:00Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0292"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:48Z",
    "dateUpdated": "2026-09-11T11:47:47Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0292"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0291

    Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-11 11:47
    VLAI
    Title
    APPLE-SA-07-27-2026-5 tvOS 26.6
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-07-27-2026-5 tvOS 26.6 tvOS 26.6 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/128069. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accounts Framework Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to fingerprint the user Description: This issue was addressed with improved data protection. CVE-2026-64733: Rosyna Keller of Totally Not Malicious Software (paradisefacade.com) App Store Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved checks. CVE-2026-43801: Rahul Raj Apple Neural Engine Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-28928: Dun Audio Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/) AuthKit Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to fingerprint the user Description: A permissions issue was addressed with additional restrictions. CVE-2026-43730: David Strnadel AVEVideoEncoder Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to execute arbitrary code with kernel privileges Description: A buffer overflow was addressed with improved size validation. CVE-2026-64747: Franco Belman at Blackwing Intelligence CloudAttestation Available for: Apple TV HD and Apple TV 4K (all models) Impact: A maliciously crafted app may be able to bypass code signing enforcement Description: A validation issue was addressed with improved input sanitization. CVE-2026-43813: Anton Pakhunov CoreAudio Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing a maliciously crafted audio file may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative CoreAudio Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43744: Mathis Mansière, an anonymous researcher CoreAudio Available for: Apple TV HD and Apple TV 4K (all models) Impact: A remote attacker may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43803: Rahul Raj CoreMedia Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: A memory corruption issue was addressed with improved memory handling. CVE-2026-43711: James Duffy (@0x4A616D657344) curl Available for: Apple TV HD and Apple TV 4K (all models) Impact: Authentication credentials may be sent to a server on another origin Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2026-3784 CVE-2026-3783 FrontBoard Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to access sensitive user data Description: This issue was addressed by using HTTPS when sending information over the network. CVE-2026-64742: Huỳnh Tấn Ngàn Game Center Available for: Apple TV HD and Apple TV 4K (all models) Impact: A malicious app may be able to break out of its sandbox Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-64740: Manuel Fernandez (Stackhopper Security) Game Center Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved data protection. CVE-2026-43796: Ilya Andr (andrd3v) of Positive Technologies, Stanislav Jelezoglo Heimdal Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64692: Redon Gashi ImageIO Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing a maliciously crafted texture may lead to unexpected app termination Description: An integer overflow was addressed with improved input validation. CVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative ImageIO Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing a maliciously crafted image may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-64716: Arni Hardarson, Jonathan Alush-Aben, Peter Malone ImageIO Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: The issue was addressed with improved bounds checks. CVE-2026-64758: 진규정 (Gyujeong Jin, @G1uN4sh) ImageIO Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing a maliciously crafted file may lead to a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64754: PETOWORKS의 Bugeun Choi (@Bugeun), Rahul Raj ImageIO Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing a maliciously crafted image may lead to a denial-of-service Description: A type confusion issue was addressed with improved checks. CVE-2026-64693: Geonha Lee (@leegn4a) IOGPUFamily Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to cause unexpected system termination Description: A race condition was addressed with improved state handling. CVE-2026-43743: Lyutoon, Dun Kernel Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2026-43778: f0r of MurphySec, Feng Xue and XGPT of ThreatBook, Mahmoud Abdelmoniem, an anonymous researcher, Wang Yu, Lyutoon, Hiroki Imai (LAC Co., Ltd.), DARKNAVY (@DarkNavyOrg), Fábio Luís @scanpt, Nicolas Rabrenovic Kernel Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to disclose kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64709: Pasquale Scola, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple TV HD and Apple TV 4K (all models) Impact: A remote attacker may be able to bypass network filters Description: An inconsistent user interface issue was addressed with improved state management. CVE-2026-64735: Gor Aleksanyan Kernel Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43739: impost0r (ret2plt), Ruslan Dautov, Aleksandr Tarasikov, jay, Dhiyanesh Selvaraj (@redroot97), Vinay Kumar Rasala (Xplo8E) from Appknox, Lyutoon, DongJun Kim (smlijun) with UIUC, Hwiwon Lee (hwiwonl) with UIUC, Jongseong Kim (nevul37) with UIUC, Younggi Park (grill66) with UIUC, Peter Malone, an anonymous researcher, Hari Shanmugam (The Hxr1), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Marco Grassi, Dun, Daniele Castronovo, Michal Kosiorek CVE-2026-43816: Josh Maine of Calif.io, Ruslan Dautov, 재영 정, @rootxran (Rao Ali Nawaz), Chanwit Muenprakoddee (ChemIndy), an anonymous researcher, Ye Zhang (@VAR10CK) of Baidu Security, Franco Belman at Blackwing Intelligence, Christian Figueroa, Johnny Franks (@zeroxjf), Ashmit Sharma & Atul RV, Peter Malone, Muhamad Syaiful, Muneeb Amin Bhat, Dhiyanesh Selvaraj (@redroot97), Ali Marzouq, Bountyy Oy - Mihalis Haatainen, Huy Nguyen (@34306) of Calif.io Kernel Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-43822: Eddy Tsalolikhin, Michal Kosiorek CVE-2026-64729: Josh Maine of Calif.io, beist, Adam Doupé of ASU SEFCOM, Dun, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Johnny Franks (@zeroxjf) CVE-2026-43814: Somair Ansar, Huy Nguyen (@34306) of Calif.io CVE-2026-64700: Asjid Kalam (@odinshell) CVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple TV HD and Apple TV 4K (all models) Impact: Connecting to a malicious NFS server may lead to kernel memory corruption Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-28931: Redon Gashi, Abhijeet Singh (linkedin.com/in/abhiunix/), Peter Malone, Omar Cerrito Kernel Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-43817: Huy Nguyen (@34306) of Calif.io Kernel Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to cause unexpected system termination or write kernel memory Description: The issue was addressed with improved input sanitization. CVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel) Kernel Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to cause unexpected system termination Description: An integer overflow was addressed with improved input validation. CVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to cause unexpected system termination Description: A type confusion issue was addressed with improved memory handling. CVE-2026-64727: Ye Zhang (@VAR10CK) of Baidu Security Kernel Available for: Apple TV HD and Apple TV 4K (all models) Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-43810: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to cause unexpected system termination Description: A memory initialization issue was addressed with improved memory handling. CVE-2026-64775: Ryan Hileman via Xint Code (xint.io) Kernel Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: This issue was addressed with improved input validation. CVE-2026-39868: Vladislav Shevchenko (Positive Technologies), Ye Zhang (@VAR10CK) of Baidu Security, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to cause unexpected system termination Description: A race condition was addressed with improved state handling. CVE-2026-64720: an anonymous researcher, Asjid Kalam (@odinshell), Jian Zhou and Ye Zhang Kernel Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to cause unexpected system
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Apple Tvos Affected: unknown
    		Create a notification for this product.
    Credits
    Apple Product Security via Fulldisclosure
    Relationships
    reference GCVE-1988-2026-0291 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Tvos",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-07-27-2026-5 tvOS 26.6\n\ntvOS 26.6 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/128069.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccounts Framework\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to fingerprint the user\nDescription: This issue was addressed with improved data protection.\nCVE-2026-64733: Rosyna Keller of Totally Not Malicious Software\n(paradisefacade.com)\n\nApp Store\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved checks.\nCVE-2026-43801: Rahul Raj\n\nApple Neural Engine\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28928: Dun\n\nAudio\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\nAuthKit\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to fingerprint the user\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-43730: David Strnadel\n\nAVEVideoEncoder\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges\nDescription: A buffer overflow was addressed with improved size\nvalidation.\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\nCloudAttestation\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: A maliciously crafted app may be able to bypass code signing\nenforcement\nDescription: A validation issue was addressed with improved input\nsanitization.\nCVE-2026-43813: Anton Pakhunov\n\nCoreAudio\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted audio file may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\nCoreAudio\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43744: Mathis Mansi\u00e8re, an anonymous researcher\n\nCoreAudio\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43803: Rahul Raj\n\nCoreMedia\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\ncurl\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Authentication credentials may be sent to a server on another\norigin\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-3784\nCVE-2026-3783\n\nFrontBoard\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed by using HTTPS when sending\ninformation over the network.\nCVE-2026-64742: Hu\u1ef3nh T\u1ea5n Ng\u00e0n\n\nGame Center\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\nGame Center\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43796: Ilya Andr (andrd3v) of Positive Technologies, Stanislav\nJelezoglo\n\nHeimdal\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64692: Redon Gashi\n\nImageIO\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted texture may lead to unexpected\napp termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day\nInitiative\n\nImageIO\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64716: Arni Hardarson, Jonathan Alush-Aben, Peter Malone\n\nImageIO\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-64758: \uc9c4\uaddc\uc815 (Gyujeong Jin, @G1uN4sh)\n\nImageIO\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted file may lead to a\ndenial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64754: PETOWORKS\uc758 Bugeun Choi (@Bugeun), Rahul Raj\n\nImageIO\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted image may lead to a\ndenial-of-service\nDescription: A type confusion issue was addressed with improved checks.\nCVE-2026-64693: Geonha Lee (@leegn4a)\n\nIOGPUFamily\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-43743: Lyutoon, Dun\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43778: f0r of MurphySec, Feng Xue and XGPT of ThreatBook,\nMahmoud Abdelmoniem, an anonymous researcher, Wang Yu, Lyutoon, Hiroki\nImai (LAC Co., Ltd.), DARKNAVY (@DarkNavyOrg), F\u00e1bio Lu\u00eds @scanpt,\nNicolas Rabrenovic\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64709: Pasquale Scola, Billy Jheng Bing Jhong and Pan Zhenpeng\n(@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: A remote attacker may be able to bypass network filters\nDescription: An inconsistent user interface issue was addressed with\nimproved state management.\nCVE-2026-64735: Gor Aleksanyan\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43739: impost0r (ret2plt), Ruslan Dautov, Aleksandr Tarasikov,\njay, Dhiyanesh Selvaraj (@redroot97), Vinay Kumar Rasala (Xplo8E) from\nAppknox, Lyutoon, DongJun Kim (smlijun) with UIUC, Hwiwon Lee (hwiwonl)\nwith UIUC, Jongseong Kim (nevul37) with UIUC, Younggi Park (grill66)\nwith UIUC, Peter Malone, an anonymous researcher, Hari Shanmugam (The\nHxr1), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR\nLabs SG Pte. Ltd., Marco Grassi, Dun, Daniele Castronovo, Michal\nKosiorek\nCVE-2026-43816: Josh Maine of Calif.io, Ruslan Dautov, \uc7ac\uc601 \uc815, @rootxran\n(Rao Ali Nawaz), Chanwit Muenprakoddee (ChemIndy), an anonymous\nresearcher, Ye Zhang (@VAR10CK) of Baidu Security, Franco Belman at\nBlackwing Intelligence, Christian Figueroa, Johnny Franks (@zeroxjf),\nAshmit Sharma \u0026 Atul RV, Peter Malone, Muhamad Syaiful, Muneeb Amin\nBhat, Dhiyanesh Selvaraj (@redroot97), Ali Marzouq, Bountyy Oy - Mihalis\nHaatainen, Huy Nguyen (@34306) of Calif.io\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43822: Eddy Tsalolikhin, Michal Kosiorek\nCVE-2026-64729: Josh Maine of Calif.io, beist, Adam Doup\u00e9 of ASU SEFCOM,\nDun, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR\nLabs SG Pte. Ltd., Johnny Franks (@zeroxjf)\nCVE-2026-43814: Somair Ansar, Huy Nguyen (@34306) of Calif.io\nCVE-2026-64700: Asjid Kalam (@odinshell)\nCVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Connecting to a malicious NFS server may lead to kernel memory\ncorruption\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28931: Redon Gashi, Abhijeet Singh (linkedin.com/in/abhiunix/),\nPeter Malone, Omar Cerrito\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43817: Huy Nguyen (@34306) of Calif.io\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel)\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A type confusion issue was addressed with improved memory\nhandling.\nCVE-2026-64727: Ye Zhang (@VAR10CK) of Baidu Security\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: A remote user may be able to cause unexpected system termination\nor corrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43810: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A memory initialization issue was addressed with improved\nmemory handling.\nCVE-2026-64775: Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: This issue was addressed with improved input validation.\nCVE-2026-39868: Vladislav Shevchenko (Positive Technologies), Ye Zhang\n(@VAR10CK) of Baidu Security, Billy Jheng Bing Jhong and Pan Zhenpeng\n(@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-64720: an anonymous researcher, Asjid Kalam (@odinshell), Jian\nZhou and Ye Zhang\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system "
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:47:46Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/20"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/20"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/en-us/128069"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/20"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-07-27-2026-5 tvOS 26.6",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-28928",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28931",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28979",
              "type": "related"
            },
            {
              "destId": "CVE-2026-3783",
              "type": "related"
            },
            {
              "destId": "CVE-2026-3784",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39868",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39872",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43663",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43673",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43699",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43700",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43701",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43703",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43704",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43705",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43706",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43707",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43708",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43709",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43711",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43712",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43713",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43715",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43717",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43718",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43720",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43721",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43723",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43724",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43725",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43726",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43729",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43730",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43731",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43732",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43734",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43735",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43739",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43740",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43742",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43743",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43744",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43745",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43769",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43770",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43778",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43780",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43796",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43799",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43800",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43801",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43803",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43807",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43810",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43812",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43813",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43814",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43816",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43817",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43821",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43822",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64692",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64693",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64700",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64709",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64713",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64716",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64718",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64719",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64720",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64721",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64724",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64725",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64726",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64727",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64728",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64729",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64730",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64733",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64735",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64739",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64740",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64741",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64742",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64743",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64747",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64751",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64754",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64758",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64763",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64764",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64765",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64766",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64768",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64769",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64770",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64771",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64772",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64774",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64775",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0291",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/20",
            "automated": true,
            "contentSha256": "2aca66bf0b36d14d22534543b23c469e414626d904471132d2e37c7f2a16abf1",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/20",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-28T00:24:11Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0291"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:47Z",
    "dateUpdated": "2026-09-11T11:47:46Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0291"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0290

    Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-11 11:47
    VLAI
    Title
    APPLE-SA-07-27-2026-4 macOS Sonoma 14.8.8
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-07-27-2026-4 macOS Sonoma 14.8.8 macOS Sonoma 14.8.8 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/128072. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accounts Available for: macOS Sonoma Impact: An app may be able to gain root privileges Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-43749: Adam Franke, Trung Nguyen (@everping) of CyStack, Ashish Kunwar afpfs Available for: macOS Sonoma Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-64767: Dave G. apache Available for: macOS Sonoma Impact: A remote attacker may be able to cause a denial-of-service Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2026-23918: Юлия Мерцалова APFS Available for: macOS Sonoma Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64695: Peter Malone App Store Available for: macOS Sonoma Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved checks. CVE-2026-43801: Rahul Raj Apple Account Available for: macOS Sonoma Impact: An app may be able to access sensitive user data Description: A race condition was addressed with improved state handling. CVE-2026-43781: Pinak Oza Apple Account Available for: macOS Sonoma Impact: A malicious app may be able to break out of its sandbox Description: An authorization issue was addressed with improved state management. CVE-2026-64737: Robert Mindo AppleRAID Available for: macOS Sonoma Impact: A local user may be able to read kernel memory Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-43681: impost0r (ret2plt), David Ige - Beryllium Security Assets Available for: macOS Sonoma Impact: A malicious application may be able to bypass Privacy preferences Description: An authorization issue was addressed with improved state management. CVE-2026-43672: 이재영 ATS Available for: macOS Sonoma Impact: An app may be able to read files outside of its sandbox Description: A permissions issue was addressed by removing the vulnerable code. CVE-2026-43763: Pavan Nallamothu, Jared Reyes Audio Available for: macOS Sonoma Impact: An app may be able to break out of its sandbox Description: An access issue was addressed with additional sandbox restrictions. CVE-2026-64702: John Lussier Audio Available for: macOS Sonoma Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/) AVEVideoEncoder Available for: macOS Sonoma Impact: An app may be able to execute arbitrary code with kernel privileges Description: A buffer overflow was addressed with improved size validation. CVE-2026-64747: Franco Belman at Blackwing Intelligence AVEVideoEncoder Available for: macOS Sonoma Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun BackgroundAssets Available for: macOS Sonoma Impact: An app may be able to delete files for which it does not have permission Description: A permissions issue was addressed with improved validation. CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab BOM Available for: macOS Sonoma Impact: A maliciously crafted ZIP archive may bypass Gatekeeper checks Description: The issue was addressed with improved checks. CVE-2026-28849: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs cd9660 Available for: macOS Sonoma Impact: An app may be able to cause unexpected system termination or read kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64698: Richard Zana, Peter Malone, Nathaniel Oh (@calysteon), an anonymous researcher Contacts Available for: macOS Sonoma Impact: Processing a maliciously crafted contact may leak sensitive data Description: The issue was addressed with improved checks. CVE-2026-64734: Daniel Williams Control Center Available for: macOS Sonoma Impact: An app may be able to access user-sensitive data Description: A logic issue was addressed with improved validation. CVE-2026-43756: 이재영 Core Services Available for: macOS Sonoma Impact: An app may be able to gain root privileges Description: A race condition was addressed with improved state handling. CVE-2026-43693: Gergely Kalman (@gergely_kalman) CoreAudio Available for: macOS Sonoma Impact: Processing a maliciously crafted audio file may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative CoreAudio Available for: macOS Sonoma Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43744: Mathis Mansière, an anonymous researcher CoreAudio Available for: macOS Sonoma Impact: A remote attacker may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43803: Rahul Raj CoreMedia Available for: macOS Sonoma Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: A memory corruption issue was addressed with improved memory handling. CVE-2026-43711: James Duffy (@0x4A616D657344) CoreServices Available for: macOS Sonoma Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: The issue was addressed with improved checks. CVE-2026-28936: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs CoreUI Available for: macOS Sonoma Impact: Processing a maliciously crafted asset catalog may result in disclosure of process memory Description: The issue was addressed with improved memory handling. CVE-2026-43738: Peter Malone CoreVideo Available for: macOS Sonoma Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43802: an anonymous researcher Crash Reporter Available for: macOS Sonoma Impact: An app may be able to leak sensitive user information Description: A privacy issue was addressed by removing sensitive data. CVE-2026-64710: Matthew Schneider CUPS Available for: macOS Sonoma Impact: A malicious app may be able to gain root privileges Description: A permissions issue was addressed with additional restrictions. CVE-2026-39875: XBreach.ai, Dallas Dubs, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs, Aaron Grattafiori - NVIDIA AI Red Team CUPS Available for: macOS Sonoma Impact: An app may be able to gain root privileges Description: An injection issue was addressed with improved validation. CVE-2026-43698: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs curl Available for: macOS Sonoma Impact: Authentication credentials may be sent to a server on another origin Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2026-3784 CVE-2026-3783 Data Detectors UI Available for: macOS Sonoma Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-43758: HvxyZLF DesktopServices Available for: macOS Sonoma Impact: An app may bypass Gatekeeper checks Description: A file quarantine bypass was addressed with additional checks. CVE-2026-64708: Lance Cain - Offensive Security Engineer, SpecterOps Inc. Disk Images Available for: macOS Sonoma Impact: An app may be able to elevate privileges Description: A race condition was addressed with improved state handling. CVE-2026-28926: Jonathan Bar Or (@yo_yo_yo_jbo) Disk Images Available for: macOS Sonoma Impact: Parsing a maliciously crafted file may lead to an unexpected app termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-43747: Anthony Laou Hine Tsuei (@anarcheuz) Disk Images Available for: macOS Sonoma Impact: An app may be able to cause unexpected system termination Description: An integer overflow was addressed with improved input validation. CVE-2026-64694: Gil Portnoy & Henry Disk Images Available for: macOS Sonoma Impact: An app may be able to bypass network restrictions Description: A permissions issue was addressed with additional sandbox restrictions. CVE-2026-28945: Ayaan Ahmad Disk Images Available for: macOS Sonoma Impact: An app may be able to disclose kernel memory Description: The issue was addressed with improved bounds checks. CVE-2026-64776: Hyunwoo Kim (@v4bel) DriverKit Available for: macOS Sonoma Impact: An app may be able to cause unexpected system termination Description: An issue existed in the handling of environment variables. This issue was addressed with improved validation. CVE-2026-43793: erdene-och Byambabayar DriverKit Available for: macOS Sonoma Impact: An attacker with physical access to a locked device may be able to view sensitive user information Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-43753: Niels Hofmans Foundation Available for: macOS Sonoma Impact: A malicious app may be able to access protected user data Description: The issue was addressed with improved input sanitization. CVE-2026-43714: an anonymous researcher Game Center Available for: macOS Sonoma Impact: A malicious app may be able to break out of its sandbox Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-64740: Manuel Fernandez (Stackhopper Security) Game Center Available for: macOS Sonoma Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved data protection. CVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive Technologies Heimdal Available for: macOS Sonoma Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64692: Redon Gashi HFS Available for: macOS Sonoma Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-43682: Trung Nguyen (@everping) of CyStack, Peter Malone, Nicolas Rabrenovic, Dave G., Atul R V & Ashmit Sharma HFS Available for: macOS Sonoma Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-28981: Hcamael and 章鱼哥@aipy （aipyaipy.com）, Aswin Kumar Gokulakannan, Surya Narayan Kushwaha, Dun HFS Available for: macOS Sonoma Impact: Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-43773: Surya Narayan Kushwaha, Richard Zana, Peter Malone, Hyunwoo Kim (@v4bel), Cem Onat Karagun HFS Available for: macOS Sonoma Impact: An app may be able to cause unexpected system termination Description: The issue was addressed with
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Apple Macos Sonoma Affected: unknown
    		Create a notification for this product.
    Credits
    Apple Product Security via Fulldisclosure
    Relationships
    reference GCVE-1988-2026-0290 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Macos Sonoma",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-07-27-2026-4 macOS Sonoma 14.8.8\n\nmacOS Sonoma 14.8.8 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/128072.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccounts\nAvailable for: macOS Sonoma\nImpact: An app may be able to gain root privileges\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-43749: Adam Franke, Trung Nguyen (@everping) of CyStack, Ashish\nKunwar\n\nafpfs\nAvailable for: macOS Sonoma\nImpact: A remote attacker may be able to cause unexpected system\ntermination or corrupt kernel memory\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-64767: Dave G.\n\napache\nAvailable for: macOS Sonoma\nImpact: A remote attacker may be able to cause a denial-of-service\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-23918: \u042e\u043b\u0438\u044f \u041c\u0435\u0440\u0446\u0430\u043b\u043e\u0432\u0430\n\nAPFS\nAvailable for: macOS Sonoma\nImpact: A remote user may be able to cause unexpected system termination\nor corrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64695: Peter Malone\n\nApp Store\nAvailable for: macOS Sonoma\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved checks.\nCVE-2026-43801: Rahul Raj\n\nApple Account\nAvailable for: macOS Sonoma\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-43781: Pinak Oza\n\nApple Account\nAvailable for: macOS Sonoma\nImpact: A malicious app may be able to break out of its sandbox\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-64737: Robert Mindo\n\nAppleRAID\nAvailable for: macOS Sonoma\nImpact: A local user may be able to read kernel memory\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-43681: impost0r (ret2plt), David Ige - Beryllium Security\n\nAssets\nAvailable for: macOS Sonoma\nImpact: A malicious application may be able to bypass Privacy\npreferences\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-43672: \uc774\uc7ac\uc601\n\nATS\nAvailable for: macOS Sonoma\nImpact: An app may be able to read files outside of its sandbox\nDescription: A permissions issue was addressed by removing the\nvulnerable code.\nCVE-2026-43763: Pavan Nallamothu, Jared Reyes\n\nAudio\nAvailable for: macOS Sonoma\nImpact: An app may be able to break out of its sandbox\nDescription: An access issue was addressed with additional sandbox\nrestrictions.\nCVE-2026-64702: John Lussier\n\nAudio\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\nAVEVideoEncoder\nAvailable for: macOS Sonoma\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges\nDescription: A buffer overflow was addressed with improved size\nvalidation.\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\nAVEVideoEncoder\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun\n\nBackgroundAssets\nAvailable for: macOS Sonoma\nImpact: An app may be able to delete files for which it does not have\npermission\nDescription: A permissions issue was addressed with improved validation.\nCVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity\u0027s WeBin lab\n\nBOM\nAvailable for: macOS Sonoma\nImpact: A maliciously crafted ZIP archive may bypass Gatekeeper checks\nDescription: The issue was addressed with improved checks.\nCVE-2026-28849: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\ncd9660\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause unexpected system termination or\nread kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64698: Richard Zana, Peter Malone, Nathaniel Oh (@calysteon),\nan anonymous researcher\n\nContacts\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted contact may leak sensitive data\nDescription: The issue was addressed with improved checks.\nCVE-2026-64734: Daniel Williams\n\nControl Center\nAvailable for: macOS Sonoma\nImpact: An app may be able to access user-sensitive data\nDescription: A logic issue was addressed with improved validation.\nCVE-2026-43756: \uc774\uc7ac\uc601\n\nCore Services\nAvailable for: macOS Sonoma\nImpact: An app may be able to gain root privileges\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-43693: Gergely Kalman (@gergely_kalman)\n\nCoreAudio\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted audio file may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\nCoreAudio\nAvailable for: macOS Sonoma\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43744: Mathis Mansi\u00e8re, an anonymous researcher\n\nCoreAudio\nAvailable for: macOS Sonoma\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43803: Rahul Raj\n\nCoreMedia\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\nCoreServices\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved checks.\nCVE-2026-28936: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nCoreUI\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted asset catalog may result in\ndisclosure of process memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43738: Peter Malone\n\nCoreVideo\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43802: an anonymous researcher\n\nCrash Reporter\nAvailable for: macOS Sonoma\nImpact: An app may be able to leak sensitive user information\nDescription: A privacy issue was addressed by removing sensitive data.\nCVE-2026-64710: Matthew Schneider\n\nCUPS\nAvailable for: macOS Sonoma\nImpact: A malicious app may be able to gain root privileges\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-39875: XBreach.ai, Dallas Dubs, Andreas Jaegersberger \u0026 Ro\nAchterberg of Nosebeard Labs, Aaron Grattafiori - NVIDIA AI Red Team\n\nCUPS\nAvailable for: macOS Sonoma\nImpact: An app may be able to gain root privileges\nDescription: An injection issue was addressed with improved validation.\nCVE-2026-43698: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\ncurl\nAvailable for: macOS Sonoma\nImpact: Authentication credentials may be sent to a server on another\norigin\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-3784\nCVE-2026-3783\n\nData Detectors UI\nAvailable for: macOS Sonoma\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-43758: HvxyZLF\n\nDesktopServices\nAvailable for: macOS Sonoma\nImpact: An app may bypass Gatekeeper checks\nDescription: A file quarantine bypass was addressed with additional\nchecks.\nCVE-2026-64708: Lance Cain - Offensive Security Engineer, SpecterOps\nInc.\n\nDisk Images\nAvailable for: macOS Sonoma\nImpact: An app may be able to elevate privileges\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-28926: Jonathan Bar Or (@yo_yo_yo_jbo)\n\nDisk Images\nAvailable for: macOS Sonoma\nImpact: Parsing a maliciously crafted file may lead to an unexpected app\ntermination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43747: Anthony Laou Hine Tsuei (@anarcheuz)\n\nDisk Images\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-64694: Gil Portnoy \u0026 Henry\n\nDisk Images\nAvailable for: macOS Sonoma\nImpact: An app may be able to bypass network restrictions\nDescription: A permissions issue was addressed with additional sandbox\nrestrictions.\nCVE-2026-28945: Ayaan Ahmad\n\nDisk Images\nAvailable for: macOS Sonoma\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-64776: Hyunwoo Kim (@v4bel)\n\nDriverKit\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause unexpected system termination\nDescription: An issue existed in the handling of environment variables.\nThis issue was addressed with improved validation.\nCVE-2026-43793: erdene-och Byambabayar\n\nDriverKit\nAvailable for: macOS Sonoma\nImpact: An attacker with physical access to a locked device may be able\nto view sensitive user information\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43753: Niels Hofmans\n\nFoundation\nAvailable for: macOS Sonoma\nImpact: A malicious app may be able to access protected user data\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43714: an anonymous researcher\n\nGame Center\nAvailable for: macOS Sonoma\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\nGame Center\nAvailable for: macOS Sonoma\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive\nTechnologies\n\nHeimdal\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64692: Redon Gashi\n\nHFS\nAvailable for: macOS Sonoma\nImpact: A remote user may be able to cause unexpected system termination\nor corrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43682: Trung Nguyen (@everping) of CyStack, Peter Malone,\nNicolas Rabrenovic, Dave G., Atul R V \u0026 Ashmit Sharma\n\nHFS\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted image may lead to arbitrary\ncode execution\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28981: Hcamael and \u7ae0\u9c7c\u54e5@aipy \uff08aipyaipy.com\uff09, Aswin Kumar\nGokulakannan, Surya Narayan Kushwaha, Dun\n\nHFS\nAvailable for: macOS Sonoma\nImpact: Mounting a maliciously crafted disk image may cause unexpected\nsystem termination or corrupt kernel memory\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43773: Surya Narayan Kushwaha, Richard Zana, Peter Malone,\nHyunwoo Kim (@v4bel), Cem Onat Karagun\n\nHFS\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause unexpected system termination\nDescription: The issue was addressed with"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:47:41Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/19"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/19"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/downloads/"
        },
        {
          "url": "https://support.apple.com/en-us/128072"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/19"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-07-27-2026-4 macOS Sonoma 14.8.8",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-43325",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20672",
              "type": "related"
            },
            {
              "destId": "CVE-2026-23918",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28849",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28896",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28900",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28911",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28914",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28926",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28932",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28936",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28945",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28961",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28973",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28981",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28982",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28983",
              "type": "related"
            },
            {
              "destId": "CVE-2026-3783",
              "type": "related"
            },
            {
              "destId": "CVE-2026-3784",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39868",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39873",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39874",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39875",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39877",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43661",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43665",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43672",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43673",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43681",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43682",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43693",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43694",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43698",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43703",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43706",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43710",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43711",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43714",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43722",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43723",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43724",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43738",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43744",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43747",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43749",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43750",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43753",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43754",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43755",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43756",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43757",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43758",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43760",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43763",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43764",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43765",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43766",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43767",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43768",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43769",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43770",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43771",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43772",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43773",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43774",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43777",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43778",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43779",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43780",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43781",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43782",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43793",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43796",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43799",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43801",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43802",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43803",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43805",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43807",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43809",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43810",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43818",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43822",
              "type": "related"
            },
            {
              "destId": "CVE-2026-4424",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64692",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64693",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64694",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64695",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64696",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64697",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64698",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64699",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64700",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64702",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64703",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64704",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64707",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64708",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64709",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64710",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64711",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64716",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64721",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64723",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64724",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64725",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64734",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64735",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64737",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64738",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64739",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64740",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64744",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64747",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64754",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64762",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64763",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64764",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64765",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64766",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64767",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64768",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64769",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64770",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64774",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64775",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64776",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0290",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/19",
            "automated": true,
            "contentSha256": "ec03a2d218b69dc7ce06cd9f0bf5f6850a1964223cc1bef0f9466ca4f7384d34",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/19",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-28T00:21:11Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0290"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:47Z",
    "dateUpdated": "2026-09-11T11:47:41Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0290"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0289

    Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-11 11:47
    VLAI
    Title
    APPLE-SA-07-27-2026-3 macOS Sequoia 15.7.8
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-07-27-2026-3 macOS Sequoia 15.7.8 macOS Sequoia 15.7.8 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/128071. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accounts Available for: macOS Sequoia Impact: An app may be able to gain root privileges Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-43749: Adam Franke, Trung Nguyen (@everping) of CyStack, Ashish Kunwar afpfs Available for: macOS Sequoia Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-64767: Dave G. apache Available for: macOS Sequoia Impact: A remote attacker may be able to cause a denial-of-service Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2026-23918: Юлия Мерцалова APFS Available for: macOS Sequoia Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64695: Peter Malone App Store Available for: macOS Sequoia Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved checks. CVE-2026-43801: Rahul Raj Apple Account Available for: macOS Sequoia Impact: An app may be able to access sensitive user data Description: A race condition was addressed with improved state handling. CVE-2026-43781: Pinak Oza Apple Account Available for: macOS Sequoia Impact: A malicious app may be able to break out of its sandbox Description: An authorization issue was addressed with improved state management. CVE-2026-64737: Robert Mindo Apple Neural Engine Available for: macOS Sequoia Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43748: an anonymous researcher, tamdao, Franco Belman at Blackwing Intelligence AppleDouble Available for: macOS Sequoia Impact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-43776: Peter Malone, Nicolas Rabrenovic, Irvin Wang AppleRAID Available for: macOS Sequoia Impact: A local user may be able to read kernel memory Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-43681: impost0r (ret2plt), David Ige - Beryllium Security Assets Available for: macOS Sequoia Impact: A malicious application may be able to bypass Privacy preferences Description: An authorization issue was addressed with improved state management. CVE-2026-43672: 이재영 ATS Available for: macOS Sequoia Impact: An app may be able to read files outside of its sandbox Description: A permissions issue was addressed by removing the vulnerable code. CVE-2026-43763: Pavan Nallamothu, Jared Reyes Audio Available for: macOS Sequoia Impact: An app may be able to break out of its sandbox Description: An access issue was addressed with additional sandbox restrictions. CVE-2026-64702: John Lussier Audio Available for: macOS Sequoia Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/) AVEVideoEncoder Available for: macOS Sequoia Impact: An app may be able to execute arbitrary code with kernel privileges Description: A buffer overflow was addressed with improved size validation. CVE-2026-64747: Franco Belman at Blackwing Intelligence AVEVideoEncoder Available for: macOS Sequoia Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun BackgroundAssets Available for: macOS Sequoia Impact: An app may be able to delete files for which it does not have permission Description: A permissions issue was addressed with improved validation. CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab BOM Available for: macOS Sequoia Impact: A maliciously crafted ZIP archive may bypass Gatekeeper checks Description: The issue was addressed with improved checks. CVE-2026-28849: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs cd9660 Available for: macOS Sequoia Impact: An app may be able to cause unexpected system termination or read kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64698: Richard Zana, Peter Malone, Nathaniel Oh (@calysteon), an anonymous researcher Contacts Available for: macOS Sequoia Impact: Processing a maliciously crafted contact may leak sensitive data Description: The issue was addressed with improved checks. CVE-2026-64734: Daniel Williams Control Center Available for: macOS Sequoia Impact: An app may be able to access user-sensitive data Description: A logic issue was addressed with improved validation. CVE-2026-43756: 이재영 Core Services Available for: macOS Sequoia Impact: An app may be able to gain root privileges Description: A race condition was addressed with improved state handling. CVE-2026-43693: Gergely Kalman (@gergely_kalman) CoreAudio Available for: macOS Sequoia Impact: Processing a maliciously crafted audio file may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative CoreAudio Available for: macOS Sequoia Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43744: Mathis Mansière, an anonymous researcher CoreAudio Available for: macOS Sequoia Impact: A remote attacker may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43803: Rahul Raj CoreMedia Available for: macOS Sequoia Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-43775: Csaba Fitzl (@theevilbit) of Iru CoreMedia Available for: macOS Sequoia Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: A memory corruption issue was addressed with improved memory handling. CVE-2026-43711: James Duffy (@0x4A616D657344) CoreServices Available for: macOS Sequoia Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: The issue was addressed with improved checks. CVE-2026-28936: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs CoreUI Available for: macOS Sequoia Impact: Processing a maliciously crafted asset catalog may result in disclosure of process memory Description: The issue was addressed with improved memory handling. CVE-2026-43738: Peter Malone CoreVideo Available for: macOS Sequoia Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43802: an anonymous researcher Crash Reporter Available for: macOS Sequoia Impact: An app may be able to leak sensitive user information Description: A privacy issue was addressed by removing sensitive data. CVE-2026-64710: Matthew Schneider CUPS Available for: macOS Sequoia Impact: A malicious app may be able to gain root privileges Description: A permissions issue was addressed with additional restrictions. CVE-2026-39875: XBreach.ai, Dallas Dubs, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs, Aaron Grattafiori - NVIDIA AI Red Team CUPS Available for: macOS Sequoia Impact: An app may be able to gain root privileges Description: An injection issue was addressed with improved validation. CVE-2026-43698: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs curl Available for: macOS Sequoia Impact: Authentication credentials may be sent to a server on another origin Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2026-3784 CVE-2026-3783 Data Detectors UI Available for: macOS Sequoia Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-43758: HvxyZLF DesktopServices Available for: macOS Sequoia Impact: An app may bypass Gatekeeper checks Description: A file quarantine bypass was addressed with additional checks. CVE-2026-64708: Lance Cain - Offensive Security Engineer, SpecterOps Inc. Disk Images Available for: macOS Sequoia Impact: An app may be able to elevate privileges Description: A race condition was addressed with improved state handling. CVE-2026-28926: Jonathan Bar Or (@yo_yo_yo_jbo) Disk Images Available for: macOS Sequoia Impact: Parsing a maliciously crafted file may lead to an unexpected app termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-43747: Anthony Laou Hine Tsuei (@anarcheuz) Disk Images Available for: macOS Sequoia Impact: An app may be able to cause unexpected system termination Description: An integer overflow was addressed with improved input validation. CVE-2026-64694: Gil Portnoy & Henry Disk Images Available for: macOS Sequoia Impact: An app may be able to bypass network restrictions Description: A permissions issue was addressed with additional sandbox restrictions. CVE-2026-28945: Ayaan Ahmad Disk Images Available for: macOS Sequoia Impact: An app may be able to disclose kernel memory Description: The issue was addressed with improved bounds checks. CVE-2026-64776: Hyunwoo Kim (@v4bel) DriverKit Available for: macOS Sequoia Impact: An app may be able to cause unexpected system termination Description: An issue existed in the handling of environment variables. This issue was addressed with improved validation. CVE-2026-43793: erdene-och Byambabayar DriverKit Available for: macOS Sequoia Impact: An attacker with physical access to a locked device may be able to view sensitive user information Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-43753: Niels Hofmans Foundation Available for: macOS Sequoia Impact: A malicious app may be able to access protected user data Description: The issue was addressed with improved input sanitization. CVE-2026-43714: an anonymous researcher Game Center Available for: macOS Sequoia Impact: A malicious app may be able to break out of its sandbox Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-64740: Manuel Fernandez (Stackhopper Security) Game Center Available for: macOS Sequoia Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved data protection. CVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive Technologies Heimdal Available for: macOS Sequoia Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64692: Redon Gashi HFS Available for: macOS Sequoia Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-43682: Trung Nguyen (@everpi
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Apple Macos Sequoia Affected: unknown
    		Create a notification for this product.
    Credits
    Apple Product Security via Fulldisclosure
    Relationships
    reference GCVE-1988-2026-0289 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Macos Sequoia",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-07-27-2026-3 macOS Sequoia 15.7.8\n\nmacOS Sequoia 15.7.8 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/128071.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccounts\nAvailable for: macOS Sequoia\nImpact: An app may be able to gain root privileges\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-43749: Adam Franke, Trung Nguyen (@everping) of CyStack, Ashish\nKunwar\n\nafpfs\nAvailable for: macOS Sequoia\nImpact: A remote attacker may be able to cause unexpected system\ntermination or corrupt kernel memory\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-64767: Dave G.\n\napache\nAvailable for: macOS Sequoia\nImpact: A remote attacker may be able to cause a denial-of-service\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-23918: \u042e\u043b\u0438\u044f \u041c\u0435\u0440\u0446\u0430\u043b\u043e\u0432\u0430\n\nAPFS\nAvailable for: macOS Sequoia\nImpact: A remote user may be able to cause unexpected system termination\nor corrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64695: Peter Malone\n\nApp Store\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved checks.\nCVE-2026-43801: Rahul Raj\n\nApple Account\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-43781: Pinak Oza\n\nApple Account\nAvailable for: macOS Sequoia\nImpact: A malicious app may be able to break out of its sandbox\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-64737: Robert Mindo\n\nApple Neural Engine\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43748: an anonymous researcher, tamdao, Franco Belman at\nBlackwing Intelligence\n\nAppleDouble\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination or arbitrary code execution\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-43776: Peter Malone, Nicolas Rabrenovic, Irvin Wang\n\nAppleRAID\nAvailable for: macOS Sequoia\nImpact: A local user may be able to read kernel memory\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-43681: impost0r (ret2plt), David Ige - Beryllium Security\n\nAssets\nAvailable for: macOS Sequoia\nImpact: A malicious application may be able to bypass Privacy\npreferences\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-43672: \uc774\uc7ac\uc601\n\nATS\nAvailable for: macOS Sequoia\nImpact: An app may be able to read files outside of its sandbox\nDescription: A permissions issue was addressed by removing the\nvulnerable code.\nCVE-2026-43763: Pavan Nallamothu, Jared Reyes\n\nAudio\nAvailable for: macOS Sequoia\nImpact: An app may be able to break out of its sandbox\nDescription: An access issue was addressed with additional sandbox\nrestrictions.\nCVE-2026-64702: John Lussier\n\nAudio\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\nAVEVideoEncoder\nAvailable for: macOS Sequoia\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges\nDescription: A buffer overflow was addressed with improved size\nvalidation.\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\nAVEVideoEncoder\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun\n\nBackgroundAssets\nAvailable for: macOS Sequoia\nImpact: An app may be able to delete files for which it does not have\npermission\nDescription: A permissions issue was addressed with improved validation.\nCVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity\u0027s WeBin lab\n\nBOM\nAvailable for: macOS Sequoia\nImpact: A maliciously crafted ZIP archive may bypass Gatekeeper checks\nDescription: The issue was addressed with improved checks.\nCVE-2026-28849: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\ncd9660\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination or\nread kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64698: Richard Zana, Peter Malone, Nathaniel Oh (@calysteon),\nan anonymous researcher\n\nContacts\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted contact may leak sensitive data\nDescription: The issue was addressed with improved checks.\nCVE-2026-64734: Daniel Williams\n\nControl Center\nAvailable for: macOS Sequoia\nImpact: An app may be able to access user-sensitive data\nDescription: A logic issue was addressed with improved validation.\nCVE-2026-43756: \uc774\uc7ac\uc601\n\nCore Services\nAvailable for: macOS Sequoia\nImpact: An app may be able to gain root privileges\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-43693: Gergely Kalman (@gergely_kalman)\n\nCoreAudio\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted audio file may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\nCoreAudio\nAvailable for: macOS Sequoia\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43744: Mathis Mansi\u00e8re, an anonymous researcher\n\nCoreAudio\nAvailable for: macOS Sequoia\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43803: Rahul Raj\n\nCoreMedia\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-43775: Csaba Fitzl (@theevilbit) of Iru\n\nCoreMedia\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\nCoreServices\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved checks.\nCVE-2026-28936: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nCoreUI\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted asset catalog may result in\ndisclosure of process memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43738: Peter Malone\n\nCoreVideo\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43802: an anonymous researcher\n\nCrash Reporter\nAvailable for: macOS Sequoia\nImpact: An app may be able to leak sensitive user information\nDescription: A privacy issue was addressed by removing sensitive data.\nCVE-2026-64710: Matthew Schneider\n\nCUPS\nAvailable for: macOS Sequoia\nImpact: A malicious app may be able to gain root privileges\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-39875: XBreach.ai, Dallas Dubs, Andreas Jaegersberger \u0026 Ro\nAchterberg of Nosebeard Labs, Aaron Grattafiori - NVIDIA AI Red Team\n\nCUPS\nAvailable for: macOS Sequoia\nImpact: An app may be able to gain root privileges\nDescription: An injection issue was addressed with improved validation.\nCVE-2026-43698: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\ncurl\nAvailable for: macOS Sequoia\nImpact: Authentication credentials may be sent to a server on another\norigin\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-3784\nCVE-2026-3783\n\nData Detectors UI\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-43758: HvxyZLF\n\nDesktopServices\nAvailable for: macOS Sequoia\nImpact: An app may bypass Gatekeeper checks\nDescription: A file quarantine bypass was addressed with additional\nchecks.\nCVE-2026-64708: Lance Cain - Offensive Security Engineer, SpecterOps\nInc.\n\nDisk Images\nAvailable for: macOS Sequoia\nImpact: An app may be able to elevate privileges\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-28926: Jonathan Bar Or (@yo_yo_yo_jbo)\n\nDisk Images\nAvailable for: macOS Sequoia\nImpact: Parsing a maliciously crafted file may lead to an unexpected app\ntermination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43747: Anthony Laou Hine Tsuei (@anarcheuz)\n\nDisk Images\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-64694: Gil Portnoy \u0026 Henry\n\nDisk Images\nAvailable for: macOS Sequoia\nImpact: An app may be able to bypass network restrictions\nDescription: A permissions issue was addressed with additional sandbox\nrestrictions.\nCVE-2026-28945: Ayaan Ahmad\n\nDisk Images\nAvailable for: macOS Sequoia\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-64776: Hyunwoo Kim (@v4bel)\n\nDriverKit\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: An issue existed in the handling of environment variables.\nThis issue was addressed with improved validation.\nCVE-2026-43793: erdene-och Byambabayar\n\nDriverKit\nAvailable for: macOS Sequoia\nImpact: An attacker with physical access to a locked device may be able\nto view sensitive user information\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43753: Niels Hofmans\n\nFoundation\nAvailable for: macOS Sequoia\nImpact: A malicious app may be able to access protected user data\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43714: an anonymous researcher\n\nGame Center\nAvailable for: macOS Sequoia\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\nGame Center\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive\nTechnologies\n\nHeimdal\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64692: Redon Gashi\n\nHFS\nAvailable for: macOS Sequoia\nImpact: A remote user may be able to cause unexpected system termination\nor corrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43682: Trung Nguyen (@everpi"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:47:39Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/18"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/18"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/downloads/"
        },
        {
          "url": "https://support.apple.com/en-us/128071"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/18"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-07-27-2026-3 macOS Sequoia 15.7.8",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-43325",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20672",
              "type": "related"
            },
            {
              "destId": "CVE-2026-23918",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28849",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28896",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28900",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28912",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28914",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28926",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28932",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28936",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28945",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28961",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28973",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28981",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28982",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28983",
              "type": "related"
            },
            {
              "destId": "CVE-2026-3783",
              "type": "related"
            },
            {
              "destId": "CVE-2026-3784",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39868",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39873",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39874",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39875",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39877",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43653",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43661",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43665",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43672",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43673",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43681",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43682",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43693",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43694",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43698",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43703",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43706",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43710",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43711",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43714",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43722",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43723",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43724",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43729",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43733",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43738",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43744",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43747",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43748",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43749",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43750",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43753",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43754",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43756",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43757",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43758",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43763",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43764",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43765",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43766",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43767",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43768",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43769",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43770",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43771",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43772",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43773",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43774",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43775",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43776",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43777",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43778",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43779",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43780",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43781",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43782",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43793",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43796",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43799",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43801",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43802",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43803",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43805",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43807",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43809",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43810",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43812",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43818",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43822",
              "type": "related"
            },
            {
              "destId": "CVE-2026-4424",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64692",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64693",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64694",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64695",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64696",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64697",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64698",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64699",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64700",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64702",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64703",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64704",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64707",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64708",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64709",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64710",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64711",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64716",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64721",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64722",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64723",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64724",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64725",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64731",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64734",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64735",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64737",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64738",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64739",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64740",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64744",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64745",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64747",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64749",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64754",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64762",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64763",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64764",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64765",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64766",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64767",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64768",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64769",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64770",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64771",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64772",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64774",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64775",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64776",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0289",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/18",
            "automated": true,
            "contentSha256": "e64d1a889f433769bd47797e78ee4704310ebdb153b485d5ecb930df45b5b7a7",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/18",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-28T00:20:41Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0289"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:46Z",
    "dateUpdated": "2026-09-11T11:47:39Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0289"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0288

    Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-11 11:47
    VLAI
    Title
    APPLE-SA-07-27-2026-2 macOS Tahoe 26.6
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-07-27-2026-2 macOS Tahoe 26.6 macOS Tahoe 26.6 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/128067. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accounts Available for: macOS Tahoe Impact: An app may be able to access sensitive user data Description: An access issue was addressed with additional sandbox restrictions. CVE-2026-43819: Omar Cerrito Accounts Available for: macOS Tahoe Impact: An app may be able to gain root privileges Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-43749: Adam Franke, Ashish Kunwar, Trung Nguyen (@everping) of CyStack Accounts Framework Available for: macOS Tahoe Impact: An app may be able to fingerprint the user Description: This issue was addressed with improved data protection. CVE-2026-64733: Rosyna Keller of Totally Not Malicious Software (paradisefacade.com) afpfs Available for: macOS Tahoe Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-64767: Dave G. apache Available for: macOS Tahoe Impact: A remote attacker may be able to cause a denial-of-service Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2026-23918: Юлия Мерцалова APFS Available for: macOS Tahoe Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64695: Peter Malone App Store Available for: macOS Tahoe Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved checks. CVE-2026-43801: Rahul Raj Apple Account Available for: macOS Tahoe Impact: An app may be able to access sensitive user data Description: A race condition was addressed with improved state handling. CVE-2026-43781: Pinak Oza Apple Account Available for: macOS Tahoe Impact: A malicious app may be able to break out of its sandbox Description: An authorization issue was addressed with improved state management. CVE-2026-64737: Robert Mindo Apple Neural Engine Available for: macOS Tahoe Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43748: an anonymous researcher, tamdao, Franco Belman at Blackwing Intelligence Apple Neural Engine Available for: macOS Tahoe Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-28928: Dun AppleDouble Available for: macOS Tahoe Impact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-43776: Irvin Wang, Peter Malone, Nicolas Rabrenovic AppleRAID Available for: macOS Tahoe Impact: A local user may be able to read kernel memory Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-43681: impost0r (ret2plt), David Ige - Beryllium Security Assets Available for: macOS Tahoe Impact: A malicious application may be able to bypass Privacy preferences Description: An authorization issue was addressed with improved state management. CVE-2026-43672: 이재영 ATS Available for: macOS Tahoe Impact: An app may be able to read files outside of its sandbox Description: A permissions issue was addressed by removing the vulnerable code. CVE-2026-43763: Pavan Nallamothu, Jared Reyes Audio Available for: macOS Tahoe Impact: An app may be able to break out of its sandbox Description: An access issue was addressed with additional sandbox restrictions. CVE-2026-64702: John Lussier Audio Available for: macOS Tahoe Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/) AuthKit Available for: macOS Tahoe Impact: An app may be able to fingerprint the user Description: A permissions issue was addressed with additional restrictions. CVE-2026-43730: David Strnadel AVEVideoEncoder Available for: macOS Tahoe Impact: An app may be able to execute arbitrary code with kernel privileges Description: A buffer overflow was addressed with improved size validation. CVE-2026-64747: Franco Belman at Blackwing Intelligence AVEVideoEncoder Available for: macOS Tahoe Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64762: Dun, Franco Belman at Blackwing Intelligence BackgroundAssets Available for: macOS Tahoe Impact: An app may be able to delete files for which it does not have permission Description: A permissions issue was addressed with improved validation. CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab cd9660 Available for: macOS Tahoe Impact: An app may be able to cause unexpected system termination or read kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64698: an anonymous researcher, Richard Zana, Nathaniel Oh (@calysteon), Peter Malone CloudAttestation Available for: macOS Tahoe Impact: A maliciously crafted app may be able to bypass code signing enforcement Description: A validation issue was addressed with improved input sanitization. CVE-2026-43813: Anton Pakhunov Contacts Available for: macOS Tahoe Impact: An app may be able to add contacts without user authorization Description: An authorization issue was addressed with improved validation. CVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel Febrero Contacts Available for: macOS Tahoe Impact: Processing a maliciously crafted contact may leak sensitive data Description: The issue was addressed with improved checks. CVE-2026-64734: Daniel Williams Contacts Available for: macOS Tahoe Impact: An app may be able to access information about a user's contacts Description: This issue was addressed with improved checks. CVE-2026-43797: Arni Hardarson (Neonix Security) Control Center Available for: macOS Tahoe Impact: An app may be able to access user-sensitive data Description: A logic issue was addressed with improved validation. CVE-2026-43756: 이재영 Core Services Available for: macOS Tahoe Impact: An app may be able to gain root privileges Description: A race condition was addressed with improved state handling. CVE-2026-43693: Gergely Kalman (@gergely_kalman) CoreAudio Available for: macOS Tahoe Impact: Processing a maliciously crafted audio file may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative CoreAudio Available for: macOS Tahoe Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43744: Mathis Mansière, an anonymous researcher CoreAudio Available for: macOS Tahoe Impact: A remote attacker may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43803: Rahul Raj CoreMedia Available for: macOS Tahoe Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-43775: Csaba Fitzl (@theevilbit) of Iru CVE-2026-43759: 이재영, Rajdip Dey Sarkar, Arni Hardarson (Neonix Security) CoreMedia Available for: macOS Tahoe Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: A memory corruption issue was addressed with improved memory handling. CVE-2026-43711: James Duffy (@0x4A616D657344) CoreVideo Available for: macOS Tahoe Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43802: an anonymous researcher Crash Reporter Available for: macOS Tahoe Impact: An app may be able to leak sensitive user information Description: A privacy issue was addressed by removing sensitive data. CVE-2026-64710: Matthew Schneider CUPS Available for: macOS Tahoe Impact: A malicious app may be able to gain root privileges Description: A permissions issue was addressed with additional restrictions. CVE-2026-39875: Dallas Dubs, Aaron Grattafiori - NVIDIA AI Red Team, XBreach.ai, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs CUPS Available for: macOS Tahoe Impact: An app may be able to gain root privileges Description: An injection issue was addressed with improved validation. CVE-2026-43698: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs curl Available for: macOS Tahoe Impact: Authentication credentials may be sent to a server on another origin Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2026-3784 CVE-2026-3783 Data Detectors UI Available for: macOS Tahoe Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-43758: HvxyZLF DesktopServices Available for: macOS Tahoe Impact: An app may bypass Gatekeeper checks Description: A file quarantine bypass was addressed with additional checks. CVE-2026-64708: Lance Cain - Offensive Security Engineer, SpecterOps Inc. Disk Images Available for: macOS Tahoe Impact: An app may be able to disclose kernel memory Description: The issue was addressed with improved bounds checks. CVE-2026-64776: Hyunwoo Kim (@v4bel) Disk Images Available for: macOS Tahoe Impact: An app may be able to cause unexpected system termination Description: An integer overflow was addressed with improved input validation. CVE-2026-64694: Gil Portnoy & Henry Disk Images Available for: macOS Tahoe Impact: Parsing a maliciously crafted file may lead to an unexpected app termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-43747: Anthony Laou Hine Tsuei (@anarcheuz) Disk Images Available for: macOS Tahoe Impact: An app may be able to bypass network restrictions Description: A permissions issue was addressed with additional sandbox restrictions. CVE-2026-28945: Ayaan Ahmad DriverKit Available for: macOS Tahoe Impact: An app may be able to cause unexpected system termination Description: An issue existed in the handling of environment variables. This issue was addressed with improved validation. CVE-2026-43793: erdene-och Byambabayar DriverKit Available for: macOS Tahoe Impact: An attacker with physical access to a locked device may be able to view sensitive user information Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-43753: Niels Hofmans Foundation Available for: macOS Tahoe Impact: A malicious app may be able to access protected user data Description: The issue was addressed with improved input sanitization. CVE-2026-43714: an anonymous researcher Game Center Available for: macOS Tahoe Impact: A malicious app may be able to break out of its sandbox Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-64740: Manuel Fernandez (Stackhopper Security) Game Center Available for: macOS Tahoe Impact: An app may be ab
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Apple Macos Tahoe Affected: unknown
    		Create a notification for this product.
    Credits
    Apple Product Security via Fulldisclosure
    Relationships
    reference GCVE-1988-2026-0288 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Macos Tahoe",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-07-27-2026-2 macOS Tahoe 26.6\n\nmacOS Tahoe 26.6 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/128067.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccounts\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: An access issue was addressed with additional sandbox\nrestrictions.\nCVE-2026-43819: Omar Cerrito\n\nAccounts\nAvailable for: macOS Tahoe\nImpact: An app may be able to gain root privileges\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-43749: Adam Franke, Ashish Kunwar, Trung Nguyen (@everping) of\nCyStack\n\nAccounts Framework\nAvailable for: macOS Tahoe\nImpact: An app may be able to fingerprint the user\nDescription: This issue was addressed with improved data protection.\nCVE-2026-64733: Rosyna Keller of Totally Not Malicious Software\n(paradisefacade.com)\n\nafpfs\nAvailable for: macOS Tahoe\nImpact: A remote attacker may be able to cause unexpected system\ntermination or corrupt kernel memory\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-64767: Dave G.\n\napache\nAvailable for: macOS Tahoe\nImpact: A remote attacker may be able to cause a denial-of-service\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-23918: \u042e\u043b\u0438\u044f \u041c\u0435\u0440\u0446\u0430\u043b\u043e\u0432\u0430\n\nAPFS\nAvailable for: macOS Tahoe\nImpact: A remote user may be able to cause unexpected system termination\nor corrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64695: Peter Malone\n\nApp Store\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved checks.\nCVE-2026-43801: Rahul Raj\n\nApple Account\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-43781: Pinak Oza\n\nApple Account\nAvailable for: macOS Tahoe\nImpact: A malicious app may be able to break out of its sandbox\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-64737: Robert Mindo\n\nApple Neural Engine\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43748: an anonymous researcher, tamdao, Franco Belman at\nBlackwing Intelligence\n\nApple Neural Engine\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28928: Dun\n\nAppleDouble\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination or arbitrary code execution\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-43776: Irvin Wang, Peter Malone, Nicolas Rabrenovic\n\nAppleRAID\nAvailable for: macOS Tahoe\nImpact: A local user may be able to read kernel memory\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-43681: impost0r (ret2plt), David Ige - Beryllium Security\n\nAssets\nAvailable for: macOS Tahoe\nImpact: A malicious application may be able to bypass Privacy\npreferences\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-43672: \uc774\uc7ac\uc601\n\nATS\nAvailable for: macOS Tahoe\nImpact: An app may be able to read files outside of its sandbox\nDescription: A permissions issue was addressed by removing the\nvulnerable code.\nCVE-2026-43763: Pavan Nallamothu, Jared Reyes\n\nAudio\nAvailable for: macOS Tahoe\nImpact: An app may be able to break out of its sandbox\nDescription: An access issue was addressed with additional sandbox\nrestrictions.\nCVE-2026-64702: John Lussier\n\nAudio\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\nAuthKit\nAvailable for: macOS Tahoe\nImpact: An app may be able to fingerprint the user\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-43730: David Strnadel\n\nAVEVideoEncoder\nAvailable for: macOS Tahoe\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges\nDescription: A buffer overflow was addressed with improved size\nvalidation.\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\nAVEVideoEncoder\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64762: Dun, Franco Belman at Blackwing Intelligence\n\nBackgroundAssets\nAvailable for: macOS Tahoe\nImpact: An app may be able to delete files for which it does not have\npermission\nDescription: A permissions issue was addressed with improved validation.\nCVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity\u0027s WeBin lab\n\ncd9660\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination or\nread kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64698: an anonymous researcher, Richard Zana, Nathaniel Oh\n(@calysteon), Peter Malone\n\nCloudAttestation\nAvailable for: macOS Tahoe\nImpact: A maliciously crafted app may be able to bypass code signing\nenforcement\nDescription: A validation issue was addressed with improved input\nsanitization.\nCVE-2026-43813: Anton Pakhunov\n\nContacts\nAvailable for: macOS Tahoe\nImpact: An app may be able to add contacts without user authorization\nDescription: An authorization issue was addressed with improved\nvalidation.\nCVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel\nFebrero\n\nContacts\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted contact may leak sensitive data\nDescription: The issue was addressed with improved checks.\nCVE-2026-64734: Daniel Williams\n\nContacts\nAvailable for: macOS Tahoe\nImpact: An app may be able to access information about a user\u0027s contacts\nDescription: This issue was addressed with improved checks.\nCVE-2026-43797: Arni Hardarson (Neonix Security)\n\nControl Center\nAvailable for: macOS Tahoe\nImpact: An app may be able to access user-sensitive data\nDescription: A logic issue was addressed with improved validation.\nCVE-2026-43756: \uc774\uc7ac\uc601\n\nCore Services\nAvailable for: macOS Tahoe\nImpact: An app may be able to gain root privileges\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-43693: Gergely Kalman (@gergely_kalman)\n\nCoreAudio\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted audio file may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\nCoreAudio\nAvailable for: macOS Tahoe\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43744: Mathis Mansi\u00e8re, an anonymous researcher\n\nCoreAudio\nAvailable for: macOS Tahoe\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43803: Rahul Raj\n\nCoreMedia\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-43775: Csaba Fitzl (@theevilbit) of Iru\nCVE-2026-43759: \uc774\uc7ac\uc601, Rajdip Dey Sarkar, Arni Hardarson (Neonix Security)\n\nCoreMedia\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\nCoreVideo\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43802: an anonymous researcher\n\nCrash Reporter\nAvailable for: macOS Tahoe\nImpact: An app may be able to leak sensitive user information\nDescription: A privacy issue was addressed by removing sensitive data.\nCVE-2026-64710: Matthew Schneider\n\nCUPS\nAvailable for: macOS Tahoe\nImpact: A malicious app may be able to gain root privileges\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-39875: Dallas Dubs, Aaron Grattafiori - NVIDIA AI Red Team,\nXBreach.ai, Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nCUPS\nAvailable for: macOS Tahoe\nImpact: An app may be able to gain root privileges\nDescription: An injection issue was addressed with improved validation.\nCVE-2026-43698: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\ncurl\nAvailable for: macOS Tahoe\nImpact: Authentication credentials may be sent to a server on another\norigin\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-3784\nCVE-2026-3783\n\nData Detectors UI\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-43758: HvxyZLF\n\nDesktopServices\nAvailable for: macOS Tahoe\nImpact: An app may bypass Gatekeeper checks\nDescription: A file quarantine bypass was addressed with additional\nchecks.\nCVE-2026-64708: Lance Cain - Offensive Security Engineer, SpecterOps\nInc.\n\nDisk Images\nAvailable for: macOS Tahoe\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-64776: Hyunwoo Kim (@v4bel)\n\nDisk Images\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-64694: Gil Portnoy \u0026 Henry\n\nDisk Images\nAvailable for: macOS Tahoe\nImpact: Parsing a maliciously crafted file may lead to an unexpected app\ntermination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43747: Anthony Laou Hine Tsuei (@anarcheuz)\n\nDisk Images\nAvailable for: macOS Tahoe\nImpact: An app may be able to bypass network restrictions\nDescription: A permissions issue was addressed with additional sandbox\nrestrictions.\nCVE-2026-28945: Ayaan Ahmad\n\nDriverKit\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: An issue existed in the handling of environment variables.\nThis issue was addressed with improved validation.\nCVE-2026-43793: erdene-och Byambabayar\n\nDriverKit\nAvailable for: macOS Tahoe\nImpact: An attacker with physical access to a locked device may be able\nto view sensitive user information\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43753: Niels Hofmans\n\nFoundation\nAvailable for: macOS Tahoe\nImpact: A malicious app may be able to access protected user data\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43714: an anonymous researcher\n\nGame Center\nAvailable for: macOS Tahoe\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\nGame Center\nAvailable for: macOS Tahoe\nImpact: An app may be ab"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:47:08Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/17"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/17"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/downloads/"
        },
        {
          "url": "https://support.apple.com/en-us/128067"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/17"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-07-27-2026-2 macOS Tahoe 26.6",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-23918",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28911",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28912",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28928",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28931",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28932",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28945",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28973",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28981",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28982",
              "type": "related"
            },
            {
              "destId": "CVE-2026-3783",
              "type": "related"
            },
            {
              "destId": "CVE-2026-3784",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39873",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39874",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39875",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43672",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43673",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43681",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43682",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43693",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43694",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43698",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43710",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43711",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43714",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43723",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43728",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43729",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43730",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43733",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43739",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43740",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43744",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43747",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43748",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43749",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43750",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43753",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43754",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43755",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43756",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43757",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43758",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43759",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43760",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43763",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43764",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43765",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43766",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43767",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43768",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43769",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43770",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43771",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43772",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43773",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43774",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43775",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43776",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43777",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43778",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43779",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43780",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43781",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43782",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43792",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43793",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43796",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43797",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43799",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43800",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43801",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43802",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43803",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43804",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43805",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43806",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43809",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43810",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43812",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43813",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43814",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43816",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43817",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43818",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43819",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43821",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43822",
              "type": "related"
            },
            {
              "destId": "CVE-2026-4424",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64691",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64692",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64693",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64694",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64695",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64696",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64697",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64698",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64699",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64700",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64702",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64703",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64704",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64707",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64708",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64709",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64710",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64711",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64713",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64716",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64718",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64719",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64720",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64721",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64722",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64723",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64724",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64725",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64726",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64727",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64728",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64729",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64730",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64731",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64733",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64734",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64735",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64737",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64738",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64739",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64740",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64743",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64744",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64745",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64746",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64747",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64749",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64751",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64754",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64757",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64758",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64762",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64763",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64764",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64765",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64766",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64767",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64768",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64769",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64770",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64771",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64772",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64774",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64775",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64776",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64783",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0288",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/17",
            "automated": true,
            "contentSha256": "b77e3bd23b7d5a05b59a0b0fb5b935fc5cdd5feabeb5315eef61d4ad5269540e",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/17",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-28T00:20:15Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0288"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:46Z",
    "dateUpdated": "2026-09-11T11:47:08Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0288"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0284

    Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-09 10:11
    VLAI
    Title
    APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10 iOS 18.7.10 and iPadOS 18.7.10 addresses the following issues. Information about the security content is also available at https://support.apple.com/148287. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accessibility Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An attacker with physical access may be able to access sensitive user data during iPhone Mirroring Description: This issue was addressed through improved state management. CVE-2026-64732: Jorge Welch (@jorgwelch) AirDrop Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An attacker in a privileged network position may be able to cause a denial-of-service Description: A reachable assertion was addressed with improved input validation. CVE-2026-43667: Arash Ale Ebrahim from SCy-Phy research group of CISPA Helmholtz Center for Information Security APFS Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64695: Narendra Singh (@_3P1C), Peter Malone App Store Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved checks. CVE-2026-43801: Rahul Raj AppleDouble Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-43776: Peter Malone, Nicolas Rabrenovic, Irvin Wang Audio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/) AVEVideoEncoder Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to execute arbitrary code with kernel privileges Description: A buffer overflow was addressed with improved size validation. CVE-2026-64747: Franco Belman at Blackwing Intelligence AVEVideoEncoder Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun BackgroundAssets Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to delete files for which it does not have permission Description: A permissions issue was addressed with improved validation. CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab Books Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to modify protected parts of the file system Description: A race condition was addressed with improved checks. CVE-2026-43811: Rodolphe Brunetti (@eisw0lf) of Lupus Nova Contacts Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to add contacts without user authorization Description: An authorization issue was addressed with improved validation. CVE-2026-64746: Rodolphe Brunetti (@eisw0lf) of Lupus Nova, Daniel Febrero Contacts Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted contact may leak sensitive data Description: The issue was addressed with improved checks. CVE-2026-64734: Daniel Williams Contacts Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to access information about a user's contacts Description: This issue was addressed with improved checks. CVE-2026-43797: Arni Hardarson (Neonix Security) CoreAudio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted audio file may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative CoreAudio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43744: ret2happy, Mathis Mansière, an anonymous researcher CoreAudio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A remote attacker may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43803: Rahul Raj CoreMedia Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: A memory corruption issue was addressed with improved memory handling. CVE-2026-43711: James Duffy (@0x4A616D657344) CoreUI Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted asset catalog may result in disclosure of process memory Description: The issue was addressed with improved memory handling. CVE-2026-43738: Peter Malone CoreVideo Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43802: an anonymous researcher curl Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Authentication credentials may be sent to a server on another origin Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2026-3784 CVE-2026-3783 Foundation Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A malicious app may be able to access protected user data Description: The issue was addressed with improved input sanitization. CVE-2026-43714: an anonymous researcher FrontBoard Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to access sensitive user data Description: This issue was addressed by using HTTPS when sending information over the network. CVE-2026-64742: Huỳnh Tấn Ngàn Game Center Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A malicious app may be able to break out of its sandbox Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-64740: Manuel Fernandez (Stackhopper Security) Game Center Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to read a persistent device identifier Description: This issue was addressed with improved data protection. CVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive Technologies Heimdal Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64692: Redon Gashi ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-64716: Peter Malone, Jonathan Alush-Aben, Arni Hardarson CVE-2026-28990: Jiri Ha, Arni Hardarson ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may corrupt process memory Description: A buffer overflow issue was addressed with improved memory handling. CVE-2026-43661: Gandalf4a of PKU-ICODE, Anton Pakhunov, an anonymous researcher ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An integer overflow was addressed with improved input validation. CVE-2026-43818: an anonymous researcher ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may lead to a denial-of-service Description: A type confusion issue was addressed with improved checks. CVE-2026-64693: Geonha Lee (@leegn4a) IOSkywalkFamily Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to disclose kernel memory Description: A memory corruption issue was addressed with improved memory handling. CVE-2026-39877: Richard Zana, Dhiyanesh Selvaraj (@redroot97) IOSurfaceAccelerator Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to leak sensitive kernel state Description: An information leakage was addressed with additional validation. CVE-2026-64760: Seiji Sakurai (@HeapSmasher), Franco Belman at Blackwing Intelligence, an anonymous researcher Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64749: hxr1, Hiroki Imai (LAC Co., Ltd.), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ashish Kunwar Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to disclose kernel memory Description: An information leakage was addressed with additional validation. CVE-2026-64744: Ryan Hileman via Xint Code (xint.io) Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2026-43778: Ashish Kunwar, f0r of MurphySec, Mahmoud Abdelmoniem, Feng Xue and XGPT of ThreatBook, Wang Yu, Nicolas Rabrenovic, Lyutoon, Hiroki Imai (LAC Co., Ltd.), Fábio Luís @scanpt, DARKNAVY (@DarkNavyOrg), an anonymous researcher Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A remote attacker may be able to bypass network filters Description: An inconsistent user interface issue was addressed with improved state management. CVE-2026-64735: Gor Aleksanyan Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-43822: Michal Kosiorek, Eddy Tsalolikhin CVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. CVE-2026-64700: Asjid Kalam (@odinshell) Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination or write kernel memory Description: The issue was addressed with improved input sanitization. CVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel) Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: An integer overflow was addressed with improved input validation. CVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR L
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Credits
    Apple Product Security via Fulldisclosure
    Relationships
    reference GCVE-1988-2026-0284 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "APPLE-SA-08-17-2026-2 iOS",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10\n\niOS 18.7.10 and iPadOS 18.7.10 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/148287.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccessibility\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An attacker with physical access may be able to access sensitive\nuser data during iPhone Mirroring\nDescription: This issue was addressed through improved state management.\nCVE-2026-64732: Jorge Welch (@jorgwelch)\n\nAirDrop\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An attacker in a privileged network position may be able to\ncause a denial-of-service\nDescription: A reachable assertion was addressed with improved input\nvalidation.\nCVE-2026-43667: Arash Ale Ebrahim from SCy-Phy research group of CISPA\nHelmholtz Center for Information Security\n\nAPFS\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote user may be able to cause unexpected system termination\nor corrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64695: Narendra Singh (@_3P1C), Peter Malone\n\nApp Store\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved checks.\nCVE-2026-43801: Rahul Raj\n\nAppleDouble\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination or arbitrary code execution\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-43776: Peter Malone, Nicolas Rabrenovic, Irvin Wang\n\nAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\nAVEVideoEncoder\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges\nDescription: A buffer overflow was addressed with improved size\nvalidation.\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\nAVEVideoEncoder\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun\n\nBackgroundAssets\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to delete files for which it does not have\npermission\nDescription: A permissions issue was addressed with improved validation.\nCVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity\u0027s WeBin lab\n\nBooks\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to modify protected parts of the file system\nDescription: A race condition was addressed with improved checks.\nCVE-2026-43811: Rodolphe Brunetti (@eisw0lf) of Lupus Nova\n\nContacts\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to add contacts without user authorization\nDescription: An authorization issue was addressed with improved\nvalidation.\nCVE-2026-64746: Rodolphe Brunetti (@eisw0lf) of Lupus Nova, Daniel\nFebrero\n\nContacts\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted contact may leak sensitive data\nDescription: The issue was addressed with improved checks.\nCVE-2026-64734: Daniel Williams\n\nContacts\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access information about a user\u0027s contacts\nDescription: This issue was addressed with improved checks.\nCVE-2026-43797: Arni Hardarson (Neonix Security)\n\nCoreAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted audio file may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\nCoreAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43744: ret2happy, Mathis Mansi\u00e8re, an anonymous researcher\n\nCoreAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43803: Rahul Raj\n\nCoreMedia\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\nCoreUI\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted asset catalog may result in\ndisclosure of process memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43738: Peter Malone\n\nCoreVideo\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43802: an anonymous researcher\n\ncurl\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Authentication credentials may be sent to a server on another\norigin\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-3784\nCVE-2026-3783\n\nFoundation\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A malicious app may be able to access protected user data\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43714: an anonymous researcher\n\nFrontBoard\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed by using HTTPS when sending\ninformation over the network.\nCVE-2026-64742: Hu\u1ef3nh T\u1ea5n Ng\u00e0n\n\nGame Center\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\nGame Center\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to read a persistent device identifier\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive\nTechnologies\n\nHeimdal\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64692: Redon Gashi\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64716: Peter Malone, Jonathan Alush-Aben, Arni Hardarson\nCVE-2026-28990: Jiri Ha, Arni Hardarson\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: A buffer overflow issue was addressed with improved memory\nhandling.\nCVE-2026-43661: Gandalf4a of PKU-ICODE, Anton Pakhunov, an anonymous\nresearcher\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may lead to arbitrary\ncode execution\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43818: an anonymous researcher\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may lead to a\ndenial-of-service\nDescription: A type confusion issue was addressed with improved checks.\nCVE-2026-64693: Geonha Lee (@leegn4a)\n\nIOSkywalkFamily\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to disclose kernel memory\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-39877: Richard Zana, Dhiyanesh Selvaraj (@redroot97)\n\nIOSurfaceAccelerator\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to leak sensitive kernel state\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-64760: Seiji Sakurai (@HeapSmasher), Franco Belman at Blackwing\nIntelligence, an anonymous researcher\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64749: hxr1, Hiroki Imai (LAC Co., Ltd.), Billy Jheng Bing\nJhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ashish\nKunwar\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to disclose kernel memory\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-64744: Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43778: Ashish Kunwar, f0r of MurphySec, Mahmoud Abdelmoniem,\nFeng Xue and XGPT of ThreatBook, Wang Yu, Nicolas Rabrenovic, Lyutoon,\nHiroki Imai (LAC Co., Ltd.), F\u00e1bio Lu\u00eds @scanpt, DARKNAVY\n(@DarkNavyOrg), an anonymous researcher\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote attacker may be able to bypass network filters\nDescription: An inconsistent user interface issue was addressed with\nimproved state management.\nCVE-2026-64735: Gor Aleksanyan\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43822: Michal Kosiorek, Eddy Tsalolikhin\nCVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\nCVE-2026-64700: Asjid Kalam (@odinshell)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR L"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:11:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/38"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/38"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/148287"
        },
        {
          "url": "https://www.apple.com/itunes/"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/38"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-28947",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28958",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28973",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28979",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28984",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28990",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28996",
              "type": "related"
            },
            {
              "destId": "CVE-2026-3783",
              "type": "related"
            },
            {
              "destId": "CVE-2026-3784",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39868",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39872",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39877",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43658",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43661",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43663",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43667",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43673",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43676",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43699",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43700",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43701",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43705",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43708",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43711",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43714",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43717",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43720",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43722",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43723",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43724",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43725",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43726",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43727",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43729",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43731",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43733",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43734",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43735",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43738",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43742",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43744",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43745",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43754",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43757",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43769",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43776",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43778",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43794",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43795",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43796",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43797",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43799",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43800",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43801",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43802",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43803",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43807",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43809",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43810",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43811",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43812",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43818",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43821",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43822",
              "type": "related"
            },
            {
              "destId": "CVE-2026-4424",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64692",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64693",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64695",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64700",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64707",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64709",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64715",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64716",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64719",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64721",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64722",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64723",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64724",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64725",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64726",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64732",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64734",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64735",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64738",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64739",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64740",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64742",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64743",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64744",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64746",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64747",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64749",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64755",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64757",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64760",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64762",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64763",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64764",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64765",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64766",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64768",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64769",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64770",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64771",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64772",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64774",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64778",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64779",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64780",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64781",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64782",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64784",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65331",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65332",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65333",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65334",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65335",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65336",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65337",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65338",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65340",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65341",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0284",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/38",
            "automated": true,
            "contentSha256": "4f94a9072b82830135f0c238c7ec5b4f85054d563fda541bcdc667d3f5f62d48",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/38",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-17T22:00:58Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0284"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:45Z",
    "dateUpdated": "2026-09-09T10:11:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0284"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0286

    Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-11 11:50
    VLAI
    Title
    APPLE-SA-08-17-2026-3 macOS Tahoe 26.6.2
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-17-2026-3 macOS Tahoe 26.6.2 macOS Tahoe 26.6.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/148281. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Audio Available for: macOS Tahoe Impact: An app may be able to leak sensitive user information Description: A logic issue was addressed with improved checks. CVE-2026-65339: Meta Red Team X - Nik Tsytsarkin ImageIO Available for: macOS Tahoe Impact: Processing an image may lead to a denial-of-service Description: The issue was addressed with improved checks. CVE-2026-65347: Geonha Lee (@leegn4a) ImageIO Available for: macOS Tahoe Impact: Processing an image may lead to arbitrary code execution Description: An integer overflow was addressed with improved input validation. CVE-2026-65346: Meta Red Team X - Nik Tsytsarkin IOGPUFamily Available for: macOS Tahoe Impact: Processing maliciously crafted web content may lead to memory corruption Description: The issue was addressed with improved memory handling. CVE-2026-64788: f00l (@PPPF00L) and 3ndy1(@_3ndy1) and Minghao Lin@Y1nkoc and 云散花折, Arjanit Isufi Kernel Available for: macOS Tahoe Impact: A remote attacker may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-65343: Drinor Selmanaj (Sentry), Surya Narayan Kushwaha Kernel Available for: macOS Tahoe Impact: An app may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2026-65349: an anonymous researcher Kernel Available for: macOS Tahoe Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-65330: Bhaswanth Chigurupati, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. WebKit Available for: macOS Tahoe Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: An out-of-bounds access issue was addressed with improved bounds checking. WebKit Bugzilla: 317632 CVE-2026-64784: Janggoon Lee of Out of Bounds, OpenAI Codex Security - Amy Burnett WebKit Available for: macOS Tahoe Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 313452 CVE-2026-43795: wwwlk WebKit Bugzilla: 318348 CVE-2026-65338: OpenAI Codex Security - Amy Burnett WebKit Available for: macOS Tahoe Impact: Processing maliciously crafted web content may lead to memory corruption Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 318405 CVE-2026-65341: Henock Habte WebKit Available for: macOS Tahoe Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A memory corruption vulnerability was addressed with improved locking. WebKit Bugzilla: 321480 CVE-2026-64782: Seonwook Kim, Shubham Chaskar, lattice, Josef Korbel WebKit Available for: macOS Tahoe Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved input validation. WebKit Bugzilla: 321484 CVE-2026-64781: Thomas Guillem WebKit Available for: macOS Tahoe Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: This issue was addressed through improved state management. WebKit Bugzilla: 321517 CVE-2026-65351: Niels Hofmans WebKit Bugzilla: 316996 CVE-2026-65340: Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Josef Korbel (Citadelo) WebKit Bugzilla: 317142 CVE-2026-65337: OpenAI Codex Security - Amy Burnett WebKit Bugzilla: 317349 CVE-2026-65336: Josef Korbel WebKit Bugzilla: 316723 CVE-2026-65335: OpenAI Codex Security - Amy Burnett WebKit Bugzilla: 317603 CVE-2026-65333: OpenAI Codex Security - Amy Burnett WebKit Bugzilla: 317450 CVE-2026-65332: OpenAI Codex Security - Amy Burnett WebKit Bugzilla: 317611 CVE-2026-65331: OpenAI Codex Security - Amy Burnett WebKit Available for: macOS Tahoe Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 316347 CVE-2026-64715: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative WebKit Available for: macOS Tahoe Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved checks. WebKit Bugzilla: 316918 CVE-2026-64780: OpenAI Codex Security - Amy Burnett WebKit Available for: macOS Tahoe Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A memory corruption issue was addressed with improved state management. WebKit Bugzilla: 316791 CVE-2026-65334: OpenAI Codex Security - Amy Burnett WebKit Available for: macOS Tahoe Impact: Processing maliciously crafted web content may lead to memory corruption Description: A memory corruption issue was addressed with improved memory handling. WebKit Bugzilla: 317317 CVE-2026-43794: Dung Do (@_piers2) of Calif.io WebKit Available for: macOS Tahoe Impact: Processing maliciously crafted web content may lead to an unexpected process termination Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 313703 CVE-2026-64787: 杉山 壮太, Shubham Chaskar WebKit History Available for: macOS Tahoe Impact: Visiting a maliciously crafted website may leak sensitive data Description: The issue was addressed with improved checks. WebKit Bugzilla: 315528 CVE-2026-64778: Mohit Negi WebKit Storage Available for: macOS Tahoe Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A memory corruption vulnerability was addressed with improved locking. WebKit Bugzilla: 321485 CVE-2026-64779: Shubham Chaskar, Tommy DeVoss from Braze Security Team (@thedawgyg) Additional recognition Compression We would like to acknowledge Tommy DeVoss from Braze Security Team (@thedawgyg) for their assistance. libcryptex We would like to acknowledge Ashish Kunwar for their assistance. WebKit We would like to acknowledge Henock Habte for their assistance. macOS Tahoe 26.6.2 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmqDg+oACgkQ4Ifiq8DH 7PWG8RAAj5K07fb3nf4q9cM3iv9IMLsix0MY6YmhhmzMyuNt1RCOrYRYlKbupgI4 0ANdkreGcpUwdDLUmJGG4NZY172uOolWCa46PvI5XD6Obikp4REYndtn7ohOYRx1 1haRwYVAWi6oe5PVQB6WUUA7jI2cIEba3ZIoK0eSjVtuurZEslq6nBIImyFuDesU /u7LaSnfkazIALDREjhUF/6Ii1xm3qZr5P4h6k9uK4+wcMoBOQHUXdJymT/jNa+d 8A384E2Mc/y93ya6DQDCoZzshhiWzA9B0jd+pEefKrSZBpVhzVniAlXAS1nqQN+n bZjSjT6NTAQ5QsttEu5Ki8VXy1MnknUHE0WgG94qQCqHndIo1XEScBmdk8VPffht oE5v8zQ5rJkLFu4zriTtWx4JmgI6TukwgvQOLA8AtfW19VJbamqDKkQHMrtF6hNG DtgFA9+ooFwZEwlyieW46HrvQqZ596IVDgdaTOoVJa12osQpSfGp46qYtej4waWU Kqr3LSva5E/kw9jpLrIua0Tfjd0yluqXS7IziACFo1T836WFyl09eg+rhCutXHB/ QgcAuDG+hVl59tclNWBVQDHoLsENfpK9ujExnS1h8d3fLhAScxRM+2j/nNByNsat Ufzl4d8RejGkpvrjp/+IVL5iyDg0XuDLZ45X3aa6jbN+HbwropA= =n5Vc -----END PGP SIGNATURE----- _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Apple Macos Tahoe Affected: unknown
    		Create a notification for this product.
    Credits
    Apple Product Security via Fulldisclosure
    Relationships
    reference GCVE-1988-2026-0286 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Macos Tahoe",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-08-17-2026-3 macOS Tahoe 26.6.2\n\nmacOS Tahoe 26.6.2 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/148281.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAudio\nAvailable for: macOS Tahoe\nImpact: An app may be able to leak sensitive user information\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-65339: Meta Red Team X - Nik Tsytsarkin\n\nImageIO\nAvailable for: macOS Tahoe\nImpact: Processing an image may lead to a denial-of-service\nDescription: The issue was addressed with improved checks.\nCVE-2026-65347: Geonha Lee (@leegn4a)\n\nImageIO\nAvailable for: macOS Tahoe\nImpact: Processing an image may lead to arbitrary code execution\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-65346: Meta Red Team X - Nik Tsytsarkin\n\nIOGPUFamily\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64788: f00l (@PPPF00L) and 3ndy1(@_3ndy1) and Minghao\nLin@Y1nkoc and \u4e91\u6563\u82b1\u6298, Arjanit Isufi\n\nKernel\nAvailable for: macOS Tahoe\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-65343: Drinor Selmanaj (Sentry), Surya Narayan Kushwaha\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination or\nread kernel memory\nDescription: An out-of-bounds read was addressed with improved input\nvalidation.\nCVE-2026-65349: an anonymous researcher\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-65330: Bhaswanth Chigurupati, Billy Jheng Bing Jhong and Pan\nZhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nWebKit Bugzilla: 317632\nCVE-2026-64784: Janggoon Lee of Out of Bounds, OpenAI Codex Security -\nAmy Burnett\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 313452\nCVE-2026-43795: wwwlk\nWebKit Bugzilla: 318348\nCVE-2026-65338: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 318405\nCVE-2026-65341: Henock Habte\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nWebKit Bugzilla: 321480\nCVE-2026-64782: Seonwook Kim, Shubham Chaskar, lattice, Josef Korbel\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 321484\nCVE-2026-64781: Thomas Guillem\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: This issue was addressed through improved state management.\nWebKit Bugzilla: 321517\nCVE-2026-65351: Niels Hofmans\nWebKit Bugzilla: 316996\nCVE-2026-65340: Claudio Bozzato and Francesco Benvenuto of Cisco Talos,\nJosef Korbel (Citadelo)\nWebKit Bugzilla: 317142\nCVE-2026-65337: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317349\nCVE-2026-65336: Josef Korbel\nWebKit Bugzilla: 316723\nCVE-2026-65335: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317603\nCVE-2026-65333: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317450\nCVE-2026-65332: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317611\nCVE-2026-65331: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 316347\nCVE-2026-64715: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved checks.\nWebKit Bugzilla: 316918\nCVE-2026-64780: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption issue was addressed with improved state\nmanagement.\nWebKit Bugzilla: 316791\nCVE-2026-65334: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nWebKit Bugzilla: 317317\nCVE-2026-43794: Dung Do (@_piers2) of Calif.io\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process termination\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313703\nCVE-2026-64787: \u6749\u5c71 \u58ee\u592a, Shubham Chaskar\n\nWebKit History\nAvailable for: macOS Tahoe\nImpact: Visiting a maliciously crafted website may leak sensitive data\nDescription: The issue was addressed with improved checks.\nWebKit Bugzilla: 315528\nCVE-2026-64778: Mohit Negi\n\nWebKit Storage\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nWebKit Bugzilla: 321485\nCVE-2026-64779: Shubham Chaskar, Tommy DeVoss from Braze Security Team\n(@thedawgyg)\n\nAdditional recognition\n\nCompression\nWe would like to acknowledge Tommy DeVoss from Braze Security Team\n(@thedawgyg) for their assistance.\n\nlibcryptex\nWe would like to acknowledge Ashish Kunwar for their assistance.\n\nWebKit\nWe would like to acknowledge Henock Habte for their assistance.\n\nmacOS Tahoe 26.6.2 may be obtained from the Mac App Store or Apple\u0027s\nSoftware Downloads web site: https://support.apple.com/downloads/\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmqDg+oACgkQ4Ifiq8DH\n7PWG8RAAj5K07fb3nf4q9cM3iv9IMLsix0MY6YmhhmzMyuNt1RCOrYRYlKbupgI4\n0ANdkreGcpUwdDLUmJGG4NZY172uOolWCa46PvI5XD6Obikp4REYndtn7ohOYRx1\n1haRwYVAWi6oe5PVQB6WUUA7jI2cIEba3ZIoK0eSjVtuurZEslq6nBIImyFuDesU\n/u7LaSnfkazIALDREjhUF/6Ii1xm3qZr5P4h6k9uK4+wcMoBOQHUXdJymT/jNa+d\n8A384E2Mc/y93ya6DQDCoZzshhiWzA9B0jd+pEefKrSZBpVhzVniAlXAS1nqQN+n\nbZjSjT6NTAQ5QsttEu5Ki8VXy1MnknUHE0WgG94qQCqHndIo1XEScBmdk8VPffht\noE5v8zQ5rJkLFu4zriTtWx4JmgI6TukwgvQOLA8AtfW19VJbamqDKkQHMrtF6hNG\nDtgFA9+ooFwZEwlyieW46HrvQqZ596IVDgdaTOoVJa12osQpSfGp46qYtej4waWU\nKqr3LSva5E/kw9jpLrIua0Tfjd0yluqXS7IziACFo1T836WFyl09eg+rhCutXHB/\nQgcAuDG+hVl59tclNWBVQDHoLsENfpK9ujExnS1h8d3fLhAScxRM+2j/nNByNsat\nUfzl4d8RejGkpvrjp/+IVL5iyDg0XuDLZ45X3aa6jbN+HbwropA=\n=n5Vc\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:50:23Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/44"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/44"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/148281"
        },
        {
          "url": "https://support.apple.com/downloads/"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/44"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-08-17-2026-3 macOS Tahoe 26.6.2",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-43794",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43795",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64715",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64778",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64779",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64780",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64781",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64782",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64784",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64787",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64788",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65330",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65331",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65332",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65333",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65334",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65335",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65336",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65337",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65338",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65339",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65340",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65341",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65343",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65346",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65347",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65349",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65351",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0286",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/44",
            "automated": true,
            "contentSha256": "e3a4df71fa6333a412bb8c1d65c5707dbaebe35105df29945390db6bcf38320d",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/44",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-17T22:02:19Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0286"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:45Z",
    "dateUpdated": "2026-09-11T11:50:23Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0286"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0285

    Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-09 10:11
    VLAI
    Title
    APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10 iOS 18.7.10 and iPadOS 18.7.10 addresses the following issues. Information about the security content is also available at https://support.apple.com/148287. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accessibility Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An attacker with physical access may be able to access sensitive user data during iPhone Mirroring Description: This issue was addressed through improved state management. CVE-2026-64732: Jorge Welch (@jorgwelch) AirDrop Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An attacker in a privileged network position may be able to cause a denial-of-service Description: A reachable assertion was addressed with improved input validation. CVE-2026-43667: Arash Ale Ebrahim from SCy-Phy research group of CISPA Helmholtz Center for Information Security APFS Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64695: Narendra Singh (@_3P1C), Peter Malone App Store Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved checks. CVE-2026-43801: Rahul Raj AppleDouble Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-43776: Peter Malone, Nicolas Rabrenovic, Irvin Wang Audio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/) AVEVideoEncoder Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to execute arbitrary code with kernel privileges Description: A buffer overflow was addressed with improved size validation. CVE-2026-64747: Franco Belman at Blackwing Intelligence AVEVideoEncoder Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun BackgroundAssets Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to delete files for which it does not have permission Description: A permissions issue was addressed with improved validation. CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab Books Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to modify protected parts of the file system Description: A race condition was addressed with improved checks. CVE-2026-43811: Rodolphe Brunetti (@eisw0lf) of Lupus Nova Contacts Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to add contacts without user authorization Description: An authorization issue was addressed with improved validation. CVE-2026-64746: Rodolphe Brunetti (@eisw0lf) of Lupus Nova, Daniel Febrero Contacts Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted contact may leak sensitive data Description: The issue was addressed with improved checks. CVE-2026-64734: Daniel Williams Contacts Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to access information about a user's contacts Description: This issue was addressed with improved checks. CVE-2026-43797: Arni Hardarson (Neonix Security) CoreAudio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted audio file may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative CoreAudio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43744: ret2happy, Mathis Mansière, an anonymous researcher CoreAudio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A remote attacker may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43803: Rahul Raj CoreMedia Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: A memory corruption issue was addressed with improved memory handling. CVE-2026-43711: James Duffy (@0x4A616D657344) CoreUI Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted asset catalog may result in disclosure of process memory Description: The issue was addressed with improved memory handling. CVE-2026-43738: Peter Malone CoreVideo Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43802: an anonymous researcher curl Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Authentication credentials may be sent to a server on another origin Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2026-3784 CVE-2026-3783 Foundation Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A malicious app may be able to access protected user data Description: The issue was addressed with improved input sanitization. CVE-2026-43714: an anonymous researcher FrontBoard Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to access sensitive user data Description: This issue was addressed by using HTTPS when sending information over the network. CVE-2026-64742: Huỳnh Tấn Ngàn Game Center Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A malicious app may be able to break out of its sandbox Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-64740: Manuel Fernandez (Stackhopper Security) Game Center Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to read a persistent device identifier Description: This issue was addressed with improved data protection. CVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive Technologies Heimdal Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64692: Redon Gashi ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-64716: Peter Malone, Jonathan Alush-Aben, Arni Hardarson CVE-2026-28990: Jiri Ha, Arni Hardarson ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may corrupt process memory Description: A buffer overflow issue was addressed with improved memory handling. CVE-2026-43661: Gandalf4a of PKU-ICODE, Anton Pakhunov, an anonymous researcher ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An integer overflow was addressed with improved input validation. CVE-2026-43818: an anonymous researcher ImageIO Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: Processing a maliciously crafted image may lead to a denial-of-service Description: A type confusion issue was addressed with improved checks. CVE-2026-64693: Geonha Lee (@leegn4a) IOSkywalkFamily Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to disclose kernel memory Description: A memory corruption issue was addressed with improved memory handling. CVE-2026-39877: Richard Zana, Dhiyanesh Selvaraj (@redroot97) IOSurfaceAccelerator Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to leak sensitive kernel state Description: An information leakage was addressed with additional validation. CVE-2026-64760: Seiji Sakurai (@HeapSmasher), Franco Belman at Blackwing Intelligence, an anonymous researcher Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64749: hxr1, Hiroki Imai (LAC Co., Ltd.), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ashish Kunwar Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to disclose kernel memory Description: An information leakage was addressed with additional validation. CVE-2026-64744: Ryan Hileman via Xint Code (xint.io) Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2026-43778: Ashish Kunwar, f0r of MurphySec, Mahmoud Abdelmoniem, Feng Xue and XGPT of ThreatBook, Wang Yu, Nicolas Rabrenovic, Lyutoon, Hiroki Imai (LAC Co., Ltd.), Fábio Luís @scanpt, DARKNAVY (@DarkNavyOrg), an anonymous researcher Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: A remote attacker may be able to bypass network filters Description: An inconsistent user interface issue was addressed with improved state management. CVE-2026-64735: Gor Aleksanyan Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-43822: Michal Kosiorek, Eddy Tsalolikhin CVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. CVE-2026-64700: Asjid Kalam (@odinshell) Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination or write kernel memory Description: The issue was addressed with improved input sanitization. CVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel) Kernel Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation Impact: An app may be able to cause unexpected system termination Description: An integer overflow was addressed with improved input validation. CVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR L
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Credits
    Apple Product Security via Fulldisclosure
    Relationships
    reference GCVE-1988-2026-0285 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "APPLE-SA-08-17-2026-2 iOS",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10\n\niOS 18.7.10 and iPadOS 18.7.10 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/148287.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccessibility\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An attacker with physical access may be able to access sensitive\nuser data during iPhone Mirroring\nDescription: This issue was addressed through improved state management.\nCVE-2026-64732: Jorge Welch (@jorgwelch)\n\nAirDrop\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An attacker in a privileged network position may be able to\ncause a denial-of-service\nDescription: A reachable assertion was addressed with improved input\nvalidation.\nCVE-2026-43667: Arash Ale Ebrahim from SCy-Phy research group of CISPA\nHelmholtz Center for Information Security\n\nAPFS\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote user may be able to cause unexpected system termination\nor corrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64695: Narendra Singh (@_3P1C), Peter Malone\n\nApp Store\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved checks.\nCVE-2026-43801: Rahul Raj\n\nAppleDouble\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination or arbitrary code execution\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-43776: Peter Malone, Nicolas Rabrenovic, Irvin Wang\n\nAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\nAVEVideoEncoder\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges\nDescription: A buffer overflow was addressed with improved size\nvalidation.\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\nAVEVideoEncoder\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun\n\nBackgroundAssets\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to delete files for which it does not have\npermission\nDescription: A permissions issue was addressed with improved validation.\nCVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity\u0027s WeBin lab\n\nBooks\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to modify protected parts of the file system\nDescription: A race condition was addressed with improved checks.\nCVE-2026-43811: Rodolphe Brunetti (@eisw0lf) of Lupus Nova\n\nContacts\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to add contacts without user authorization\nDescription: An authorization issue was addressed with improved\nvalidation.\nCVE-2026-64746: Rodolphe Brunetti (@eisw0lf) of Lupus Nova, Daniel\nFebrero\n\nContacts\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted contact may leak sensitive data\nDescription: The issue was addressed with improved checks.\nCVE-2026-64734: Daniel Williams\n\nContacts\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access information about a user\u0027s contacts\nDescription: This issue was addressed with improved checks.\nCVE-2026-43797: Arni Hardarson (Neonix Security)\n\nCoreAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted audio file may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\nCoreAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43744: ret2happy, Mathis Mansi\u00e8re, an anonymous researcher\n\nCoreAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43803: Rahul Raj\n\nCoreMedia\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\nCoreUI\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted asset catalog may result in\ndisclosure of process memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43738: Peter Malone\n\nCoreVideo\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43802: an anonymous researcher\n\ncurl\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Authentication credentials may be sent to a server on another\norigin\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-3784\nCVE-2026-3783\n\nFoundation\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A malicious app may be able to access protected user data\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43714: an anonymous researcher\n\nFrontBoard\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed by using HTTPS when sending\ninformation over the network.\nCVE-2026-64742: Hu\u1ef3nh T\u1ea5n Ng\u00e0n\n\nGame Center\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\nGame Center\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to read a persistent device identifier\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive\nTechnologies\n\nHeimdal\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64692: Redon Gashi\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64716: Peter Malone, Jonathan Alush-Aben, Arni Hardarson\nCVE-2026-28990: Jiri Ha, Arni Hardarson\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: A buffer overflow issue was addressed with improved memory\nhandling.\nCVE-2026-43661: Gandalf4a of PKU-ICODE, Anton Pakhunov, an anonymous\nresearcher\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may lead to arbitrary\ncode execution\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43818: an anonymous researcher\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may lead to a\ndenial-of-service\nDescription: A type confusion issue was addressed with improved checks.\nCVE-2026-64693: Geonha Lee (@leegn4a)\n\nIOSkywalkFamily\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to disclose kernel memory\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-39877: Richard Zana, Dhiyanesh Selvaraj (@redroot97)\n\nIOSurfaceAccelerator\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to leak sensitive kernel state\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-64760: Seiji Sakurai (@HeapSmasher), Franco Belman at Blackwing\nIntelligence, an anonymous researcher\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64749: hxr1, Hiroki Imai (LAC Co., Ltd.), Billy Jheng Bing\nJhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ashish\nKunwar\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to disclose kernel memory\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-64744: Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43778: Ashish Kunwar, f0r of MurphySec, Mahmoud Abdelmoniem,\nFeng Xue and XGPT of ThreatBook, Wang Yu, Nicolas Rabrenovic, Lyutoon,\nHiroki Imai (LAC Co., Ltd.), F\u00e1bio Lu\u00eds @scanpt, DARKNAVY\n(@DarkNavyOrg), an anonymous researcher\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote attacker may be able to bypass network filters\nDescription: An inconsistent user interface issue was addressed with\nimproved state management.\nCVE-2026-64735: Gor Aleksanyan\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43822: Michal Kosiorek, Eddy Tsalolikhin\nCVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\nCVE-2026-64700: Asjid Kalam (@odinshell)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR L"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:11:41Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/42"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/42"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/148287"
        },
        {
          "url": "https://www.apple.com/itunes/"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/42"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-28947",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28958",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28973",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28979",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28984",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28990",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28996",
              "type": "related"
            },
            {
              "destId": "CVE-2026-3783",
              "type": "related"
            },
            {
              "destId": "CVE-2026-3784",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39868",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39872",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39877",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43658",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43661",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43663",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43667",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43673",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43676",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43699",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43700",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43701",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43705",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43708",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43711",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43714",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43717",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43720",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43722",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43723",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43724",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43725",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43726",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43727",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43729",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43731",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43733",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43734",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43735",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43738",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43742",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43744",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43745",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43754",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43757",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43769",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43776",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43778",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43794",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43795",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43796",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43797",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43799",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43800",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43801",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43802",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43803",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43807",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43809",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43810",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43811",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43812",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43818",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43821",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43822",
              "type": "related"
            },
            {
              "destId": "CVE-2026-4424",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64692",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64693",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64695",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64700",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64707",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64709",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64715",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64716",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64719",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64721",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64722",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64723",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64724",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64725",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64726",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64732",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64734",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64735",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64738",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64739",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64740",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64742",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64743",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64744",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64746",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64747",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64749",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64755",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64757",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64760",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64762",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64763",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64764",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64765",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64766",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64768",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64769",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64770",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64771",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64772",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64774",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64778",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64779",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64780",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64781",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64782",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64784",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65331",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65332",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65333",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65334",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65335",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65336",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65337",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65338",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65340",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65341",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0285",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/42",
            "automated": true,
            "contentSha256": "e23ca2444eddcf9fe8571816e5f9871be844a3cf9989741df860b5a103b3a26b",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/42",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-17T22:01:56Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0285"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:45Z",
    "dateUpdated": "2026-09-09T10:11:41Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0285"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0283

    Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-09 10:11
    VLAI
    Title
    APPLE-SA-08-17-2026-1 iOS 26.6.1 and iPadOS 26.6.1
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-17-2026-1 iOS 26.6.1 and iPadOS 26.6.1 iOS 26.6.1 and iPadOS 26.6.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/148282. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Audio Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to leak sensitive user information Description: A logic issue was addressed with improved checks. CVE-2026-65339: Meta Red Team X - Nik Tsytsarkin ImageIO Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing an image may lead to a denial-of-service Description: The issue was addressed with improved checks. CVE-2026-65347: Geonha Lee (@leegn4a) ImageIO Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing an image may lead to arbitrary code execution Description: An integer overflow was addressed with improved input validation. CVE-2026-65346: Meta Red Team X - Nik Tsytsarkin IOGPUFamily Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to memory corruption Description: The issue was addressed with improved memory handling. CVE-2026-64788: f00l (@PPPF00L) and 3ndy1(@_3ndy1) and Minghao Lin@Y1nkoc and 云散花折, Arjanit Isufi Kernel Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: A remote attacker may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-65343: Drinor Selmanaj (Sentry), Surya Narayan Kushwaha Kernel Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2026-65349: an anonymous researcher Kernel Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-65330: Bhaswanth Chigurupati, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Telephony Available for: iPhone 11 and later Impact: An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic Description: An authentication issue was addressed with improved state management. CVE-2026-65329: Bedran Karakoc, Tobias Funke, Jacopo Clark, Katharina Kohls of Ruhr University Bochum WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: An out-of-bounds access issue was addressed with improved bounds checking. WebKit Bugzilla: 317632 CVE-2026-64784: Janggoon Lee of Out of Bounds, OpenAI Codex Security - Amy Burnett WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 313452 CVE-2026-43795: wwwlk WebKit Bugzilla: 318348 CVE-2026-65338: OpenAI Codex Security - Amy Burnett WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to memory corruption Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 318405 CVE-2026-65341: Henock Habte WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A memory corruption vulnerability was addressed with improved locking. WebKit Bugzilla: 321480 CVE-2026-64782: Seonwook Kim, Shubham Chaskar, lattice, Josef Korbel WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved input validation. WebKit Bugzilla: 321484 CVE-2026-64781: Thomas Guillem WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: This issue was addressed through improved state management. WebKit Bugzilla: 321517 CVE-2026-65351: Niels Hofmans WebKit Bugzilla: 316996 CVE-2026-65340: Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Josef Korbel (Citadelo) WebKit Bugzilla: 317142 CVE-2026-65337: OpenAI Codex Security - Amy Burnett WebKit Bugzilla: 317349 CVE-2026-65336: Josef Korbel WebKit Bugzilla: 316723 CVE-2026-65335: OpenAI Codex Security - Amy Burnett WebKit Bugzilla: 317603 CVE-2026-65333: OpenAI Codex Security - Amy Burnett WebKit Bugzilla: 317450 CVE-2026-65332: OpenAI Codex Security - Amy Burnett WebKit Bugzilla: 317611 CVE-2026-65331: OpenAI Codex Security - Amy Burnett WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 316347 CVE-2026-64715: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved checks. WebKit Bugzilla: 316918 CVE-2026-64780: OpenAI Codex Security - Amy Burnett WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A memory corruption issue was addressed with improved state management. WebKit Bugzilla: 316791 CVE-2026-65334: OpenAI Codex Security - Amy Burnett WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to memory corruption Description: A memory corruption issue was addressed with improved memory handling. WebKit Bugzilla: 317317 CVE-2026-43794: Dung Do (@_piers2) of Calif.io WebKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected process termination Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 313703 CVE-2026-64787: 杉山 壮太, Shubham Chaskar WebKit History Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Visiting a maliciously crafted website may leak sensitive data Description: The issue was addressed with improved checks. WebKit Bugzilla: 315528 CVE-2026-64778: Mohit Negi WebKit Storage Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A memory corruption vulnerability was addressed with improved locking. WebKit Bugzilla: 321485 CVE-2026-64779: Shubham Chaskar, Tommy DeVoss from Braze Security Team (@thedawgyg) Additional recognition Compression We would like to acknowledge Tommy DeVoss from Braze Security Team (@thedawgyg) for their assistance. libcryptex We would like to acknowledge Ashish Kunwar for their assistance. WebKit We would like to acknowledge Henock Habte for their assistance. This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated:
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Credits
    Apple Product Security via Fulldisclosure
    Relationships
    reference GCVE-1988-2026-0283 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "APPLE-SA-08-17-2026-1 iOS",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-08-17-2026-1 iOS 26.6.1 and iPadOS 26.6.1\n\niOS 26.6.1 and iPadOS 26.6.1 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/148282.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAudio\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to leak sensitive user information\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-65339: Meta Red Team X - Nik Tsytsarkin\n\nImageIO\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing an image may lead to a denial-of-service\nDescription: The issue was addressed with improved checks.\nCVE-2026-65347: Geonha Lee (@leegn4a)\n\nImageIO\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing an image may lead to arbitrary code execution\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-65346: Meta Red Team X - Nik Tsytsarkin\n\nIOGPUFamily\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64788: f00l (@PPPF00L) and 3ndy1(@_3ndy1) and Minghao\nLin@Y1nkoc and \u4e91\u6563\u82b1\u6298, Arjanit Isufi\n\nKernel\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-65343: Drinor Selmanaj (Sentry), Surya Narayan Kushwaha\n\nKernel\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to cause unexpected system termination or\nread kernel memory\nDescription: An out-of-bounds read was addressed with improved input\nvalidation.\nCVE-2026-65349: an anonymous researcher\n\nKernel\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-65330: Bhaswanth Chigurupati, Billy Jheng Bing Jhong and Pan\nZhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nTelephony\nAvailable for: iPhone 11 and later\nImpact: An attacker in a privileged network position may be able to\nbypass IPSec authentication and intercept network traffic\nDescription: An authentication issue was addressed with improved state\nmanagement.\nCVE-2026-65329: Bedran Karakoc, Tobias Funke, Jacopo Clark, Katharina\nKohls of Ruhr University Bochum\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nWebKit Bugzilla: 317632\nCVE-2026-64784: Janggoon Lee of Out of Bounds, OpenAI Codex Security -\nAmy Burnett\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 313452\nCVE-2026-43795: wwwlk\nWebKit Bugzilla: 318348\nCVE-2026-65338: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 318405\nCVE-2026-65341: Henock Habte\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nWebKit Bugzilla: 321480\nCVE-2026-64782: Seonwook Kim, Shubham Chaskar, lattice, Josef Korbel\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 321484\nCVE-2026-64781: Thomas Guillem\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: This issue was addressed through improved state management.\nWebKit Bugzilla: 321517\nCVE-2026-65351: Niels Hofmans\nWebKit Bugzilla: 316996\nCVE-2026-65340: Claudio Bozzato and Francesco Benvenuto of Cisco Talos,\nJosef Korbel (Citadelo)\nWebKit Bugzilla: 317142\nCVE-2026-65337: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317349\nCVE-2026-65336: Josef Korbel\nWebKit Bugzilla: 316723\nCVE-2026-65335: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317603\nCVE-2026-65333: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317450\nCVE-2026-65332: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317611\nCVE-2026-65331: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 316347\nCVE-2026-64715: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved checks.\nWebKit Bugzilla: 316918\nCVE-2026-64780: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption issue was addressed with improved state\nmanagement.\nWebKit Bugzilla: 316791\nCVE-2026-65334: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nWebKit Bugzilla: 317317\nCVE-2026-43794: Dung Do (@_piers2) of Calif.io\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process termination\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313703\nCVE-2026-64787: \u6749\u5c71 \u58ee\u592a, Shubham Chaskar\n\nWebKit History\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Visiting a maliciously crafted website may leak sensitive data\nDescription: The issue was addressed with improved checks.\nWebKit Bugzilla: 315528\nCVE-2026-64778: Mohit Negi\n\nWebKit Storage\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nWebKit Bugzilla: 321485\nCVE-2026-64779: Shubham Chaskar, Tommy DeVoss from Braze Security Team\n(@thedawgyg)\n\nAdditional recognition\n\nCompression\nWe would like to acknowledge Tommy DeVoss from Braze Security Team\n(@thedawgyg) for their assistance.\n\nlibcryptex\nWe would like to acknowledge Ashish Kunwar for their assistance.\n\nWebKit\nWe would like to acknowledge Henock Habte for their assistance.\n\nThis update is available through iTunes and Software Update on your iOS\ndevice, and will not appear in your computer\u0027s Software Update\napplication, or in the Apple Downloads site. Make sure you have an\nInternet connection and have installed the latest version of iTunes from\nhttps://www.apple.com/itunes/\n\niTunes and Software Update on the device will automatically check\nApple\u0027s update server on its weekly schedule. When an update is\ndetected, it is downloaded and the option to be installed is presented\nto the user when the iOS device is docked. We recommend applying the\nupdate immediately if possible. Selecting Don\u0027t Install will present the\noption the next time you connect your iOS device.\n\nThe automatic update process may take up to a week depending on the day\nthat iTunes or the device checks for updates. You may manually obtain\nthe update via the Check for Updates button within iTunes, or the\nSoftware Update on your device.\n\nTo check that the iPhone, iPod touch, or iPad has been updated:"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:11:43Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/41"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/41"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/148282"
        },
        {
          "url": "https://www.apple.com/itunes/"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/41"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-08-17-2026-1 iOS 26.6.1 and iPadOS 26.6.1",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-43794",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43795",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64715",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64778",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64779",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64780",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64781",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64782",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64784",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64787",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64788",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65329",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65330",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65331",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65332",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65333",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65334",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65335",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65336",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65337",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65338",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65339",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65340",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65341",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65343",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65346",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65347",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65349",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65351",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0283",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/41",
            "automated": true,
            "contentSha256": "fef4f0e04fa1c7ef7f6c35f80d6fc92b29be4043d82b8b213f6395f3569485cf",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/41",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-17T22:00:29Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0283"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:44Z",
    "dateUpdated": "2026-09-09T10:11:43Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0283"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0281

    Vulnerability from gna-1988 – Published: 2026-09-08 11:24 – Updated: 2026-09-09 10:11
    VLAI
    Title
    APPLE-SA-07-27-2026-1 iOS 26.6 and iPadOS 26.6
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-07-27-2026-1 iOS 26.6 and iPadOS 26.6 iOS 26.6 and iPadOS 26.6 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/128066. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accessibility Available for: iPhone 11 and later Impact: An attacker with physical access may be able to access sensitive user data during iPhone Mirroring Description: This issue was addressed through improved state management. CVE-2026-64732: Jorge Welch (@jorgwelch) Accounts Framework Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to fingerprint the user Description: This issue was addressed with improved data protection. CVE-2026-64733: Rosyna Keller of Totally Not Malicious Software (paradisefacade.com) App Store Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved checks. CVE-2026-43801: Rahul Raj Apple Neural Engine Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-28928: Dun AppleDouble Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-43776: Irvin Wang, Peter Malone, Nicolas Rabrenovic Audio Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/) AuthKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to fingerprint the user Description: A permissions issue was addressed with additional restrictions. CVE-2026-43730: David Strnadel AVEVideoEncoder Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to execute arbitrary code with kernel privileges Description: A buffer overflow was addressed with improved size validation. CVE-2026-64747: Franco Belman at Blackwing Intelligence BackgroundAssets Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to delete files for which it does not have permission Description: A permissions issue was addressed with improved validation. CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab Books Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to modify protected parts of the file system Description: A race condition was addressed with improved checks. CVE-2026-43811: Rodolphe Brunetti (@eisw0lf) of Lupus Nova CloudAttestation Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: A maliciously crafted app may be able to bypass code signing enforcement Description: A validation issue was addressed with improved input sanitization. CVE-2026-43813: Anton Pakhunov Contacts Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to add contacts without user authorization Description: An authorization issue was addressed with improved validation. CVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel Febrero Contacts Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing a maliciously crafted contact may leak sensitive data Description: The issue was addressed with improved checks. CVE-2026-64734: Daniel Williams Contacts Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to access information about a user's contacts Description: This issue was addressed with improved checks. CVE-2026-43797: Arni Hardarson (Neonix Security) CoreAudio Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing a maliciously crafted audio file may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative CoreAudio Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43744: Mathis Mansière, an anonymous researcher CoreAudio Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: A remote attacker may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43803: Rahul Raj CoreMedia Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: A memory corruption issue was addressed with improved memory handling. CVE-2026-43711: James Duffy (@0x4A616D657344) curl Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Authentication credentials may be sent to a server on another origin Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2026-3784 CVE-2026-3783 DriverKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An attacker with physical access to a locked device may be able to view sensitive user information Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-43753: Niels Hofmans Foundation Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: A malicious app may be able to access protected user data Description: The issue was addressed with improved input sanitization. CVE-2026-43714: an anonymous researcher FrontBoard Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to access sensitive user data Description: This issue was addressed by using HTTPS when sending information over the network. CVE-2026-64742: Huỳnh Tấn Ngàn Game Center Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: A malicious app may be able to break out of its sandbox Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-64740: Manuel Fernandez (Stackhopper Security) Game Center Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved data protection. CVE-2026-43796: Ilya Andr (andrd3v) of Positive Technologies, Stanislav Jelezoglo Heimdal Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64692: Redon Gashi ImageIO Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing a maliciously crafted texture may lead to unexpected app termination Description: An integer overflow was addressed with improved input validation. CVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative ImageIO Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Credits
    Apple Product Security via Fulldisclosure
    Relationships
    reference GCVE-1988-2026-0281 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "APPLE-SA-07-27-2026-1 iOS",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-07-27-2026-1 iOS 26.6 and iPadOS 26.6\n\niOS 26.6 and iPadOS 26.6 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/128066.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccessibility\nAvailable for: iPhone 11 and later\nImpact: An attacker with physical access may be able to access sensitive\nuser data during iPhone Mirroring\nDescription: This issue was addressed through improved state management.\nCVE-2026-64732: Jorge Welch (@jorgwelch)\n\nAccounts Framework\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to fingerprint the user\nDescription: This issue was addressed with improved data protection.\nCVE-2026-64733: Rosyna Keller of Totally Not Malicious Software\n(paradisefacade.com)\n\nApp Store\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved checks.\nCVE-2026-43801: Rahul Raj\n\nApple Neural Engine\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28928: Dun\n\nAppleDouble\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination or arbitrary code execution\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-43776: Irvin Wang, Peter Malone, Nicolas Rabrenovic\n\nAudio\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\nAuthKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to fingerprint the user\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-43730: David Strnadel\n\nAVEVideoEncoder\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges\nDescription: A buffer overflow was addressed with improved size\nvalidation.\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\nBackgroundAssets\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to delete files for which it does not have\npermission\nDescription: A permissions issue was addressed with improved validation.\nCVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity\u0027s WeBin lab\n\nBooks\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to modify protected parts of the file system\nDescription: A race condition was addressed with improved checks.\nCVE-2026-43811: Rodolphe Brunetti (@eisw0lf) of Lupus Nova\n\nCloudAttestation\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A maliciously crafted app may be able to bypass code signing\nenforcement\nDescription: A validation issue was addressed with improved input\nsanitization.\nCVE-2026-43813: Anton Pakhunov\n\nContacts\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to add contacts without user authorization\nDescription: An authorization issue was addressed with improved\nvalidation.\nCVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel\nFebrero\n\nContacts\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing a maliciously crafted contact may leak sensitive data\nDescription: The issue was addressed with improved checks.\nCVE-2026-64734: Daniel Williams\n\nContacts\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to access information about a user\u0027s contacts\nDescription: This issue was addressed with improved checks.\nCVE-2026-43797: Arni Hardarson (Neonix Security)\n\nCoreAudio\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing a maliciously crafted audio file may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\nCoreAudio\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43744: Mathis Mansi\u00e8re, an anonymous researcher\n\nCoreAudio\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43803: Rahul Raj\n\nCoreMedia\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\ncurl\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Authentication credentials may be sent to a server on another\norigin\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-3784\nCVE-2026-3783\n\nDriverKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An attacker with physical access to a locked device may be able\nto view sensitive user information\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43753: Niels Hofmans\n\nFoundation\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A malicious app may be able to access protected user data\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43714: an anonymous researcher\n\nFrontBoard\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed by using HTTPS when sending\ninformation over the network.\nCVE-2026-64742: Hu\u1ef3nh T\u1ea5n Ng\u00e0n\n\nGame Center\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\nGame Center\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43796: Ilya Andr (andrd3v) of Positive Technologies, Stanislav\nJelezoglo\n\nHeimdal\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64692: Redon Gashi\n\nImageIO\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing a maliciously crafted texture may lead to unexpected\napp termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day\nInitiative\n\nImageIO\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:11:26Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/16"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/16"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/en-us/128066"
        },
        {
          "url": "https://www.apple.com/itunes/"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/16"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-07-27-2026-1 iOS 26.6 and iPadOS 26.6",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-28928",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28931",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28973",
              "type": "related"
            },
            {
              "destId": "CVE-2026-3783",
              "type": "related"
            },
            {
              "destId": "CVE-2026-3784",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43673",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43711",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43714",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43723",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43729",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43730",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43733",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43739",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43740",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43744",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43753",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43769",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43776",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43778",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43780",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43796",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43797",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43799",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43800",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43801",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43803",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43804",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43805",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43810",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43811",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43812",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43813",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43814",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43816",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43817",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43818",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43821",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43822",
              "type": "related"
            },
            {
              "destId": "CVE-2026-4424",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64692",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64693",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64700",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64707",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64709",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64711",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64713",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64716",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64718",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64719",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64720",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64721",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64722",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64724",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64725",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64726",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64728",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64729",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64730",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64732",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64733",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64734",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64735",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64739",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64740",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64741",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64742",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64743",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64746",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64747",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64749",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64751",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64754",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64755",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64757",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64758",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64763",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64764",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64765",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64766",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64768",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64769",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64770",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64771",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64772",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64774",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64775",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64783",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0281",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/16",
            "automated": true,
            "contentSha256": "14583bf0d28100cd329b90429d3b3cdb637337829fbe0cf0ee93b5a23b8d39f9",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/16",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-28T00:19:40Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0281"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:24:56Z",
    "dateUpdated": "2026-09-09T10:11:26Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0281"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0270

    Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-11 11:21
    VLAI
    Title
    APPLE-SA-03-24-2026-10 Xcode 26.4
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-03-24-2026-10 Xcode 26.4 Xcode 26.4 addresses the following issues. Information about the security content is also available at https://support.apple.com/126801. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. otool Available for: macOS Tahoe 26.2 and later Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-28890: Nathaniel Oh (@calysteon) Simulator Available for: macOS Tahoe 26.2 and later Impact: An app may be able to read arbitrary files as root Description: A permissions issue was addressed with additional restrictions. CVE-2026-28889: Mihai Marin Additional recognition Dev Tools We would like to acknowledge Nathaniel Oh (@calysteon) for their assistance. otool We would like to acknowledge Eddy T for their assistance. Swift We would like to acknowledge Banavath Aravind for their assistance. Xcode 26.4 may be obtained from: https://developer.apple.com/xcode/downloads/ To check that the Xcode has been updated: * Select Xcode in the menu bar * Select About Xcode * The version after applying this update will be "Xcode 26.4". All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmnDI48ACgkQ4Ifiq8DH 7PUtRg/+K3DU37tAHl9h/wfU7fO6J/I8YhzMGU6tcLK4b/9UG/16/qOwIUVLd9ML mCrEQY3hevwMyA+ki0HRmE0aiNTtGiFlpxNxhsyo3p6QDMXR4xyPjyFFdOcjUfKI kDHTg0NoCZWi63+hpGHhP3emCAr9/rDnOwtbUDrl57UaCc05HPydZ40ggNxz9S2/ wh6ZrXPKlQHDBYQcmRV1TkqcdpyCJqNNIG2N+SBH489easlDXfQf5AS1Go3otDbU MwviuKhN4DDPbcV+SXVJjJR/NQzmWFO5RuFvjkFTh/Z7Xi9HQY1Ytkekwl/LfNDw OdC1aMu7CxKe4ZmC3fcOEOoriVDXVqORm3fmu1h5e9q/aJgJJy/0Rsu6hvec0yqJ SJOv+oVAlQalZF23XYDm71vM0GdFS6jXkjAcDyeUIgK4a1xSNCln0fH/TEW4V+2f plLWU8xirJ2vB+DO8+E6+Kg9WYDr63a8Tr0sNV0J42SwSbk3FLvsStEIgFIcm6HI 9SOyFWp3Jc8bFBmuOjiXFn9IBtkX6FT6TSWdDCIisdeilIcXHLRNa6Iljzn2kGqP LmdGIbsSlggvy9thXIQ/t0ri2CL22aV6vV1Qjl1UW/i/vTtBA75ydroiyUhvo+If dbSuto6QwxoTbULDd+lyHgRmJ4irQcOsJerFDI0k7Ju03n0hvdQ= =YITA -----END PGP SIGNATURE----- _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Apple Xcode Affected: unknown
    		Create a notification for this product.
    Credits
    Apple Product Security via Fulldisclosure
    Relationships
    reference GCVE-1988-2026-0270 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Xcode",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-03-24-2026-10 Xcode 26.4\n\nXcode 26.4 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/126801.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\notool\nAvailable for: macOS Tahoe 26.2 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-28890: Nathaniel Oh (@calysteon)\n\nSimulator\nAvailable for: macOS Tahoe 26.2 and later\nImpact: An app may be able to read arbitrary files as root\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28889: Mihai Marin\n\nAdditional recognition\n\nDev Tools\nWe would like to acknowledge Nathaniel Oh (@calysteon) for their\nassistance.\n\notool\nWe would like to acknowledge Eddy T for their assistance.\n\nSwift\nWe would like to acknowledge Banavath Aravind for their assistance.\n\nXcode 26.4 may be obtained from:\n\nhttps://developer.apple.com/xcode/downloads/\n\nTo check that the Xcode has been updated:\n\n* Select Xcode in the menu bar\n* Select About Xcode\n* The version after applying this update will be \"Xcode 26.4\".\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmnDI48ACgkQ4Ifiq8DH\n7PUtRg/+K3DU37tAHl9h/wfU7fO6J/I8YhzMGU6tcLK4b/9UG/16/qOwIUVLd9ML\nmCrEQY3hevwMyA+ki0HRmE0aiNTtGiFlpxNxhsyo3p6QDMXR4xyPjyFFdOcjUfKI\nkDHTg0NoCZWi63+hpGHhP3emCAr9/rDnOwtbUDrl57UaCc05HPydZ40ggNxz9S2/\nwh6ZrXPKlQHDBYQcmRV1TkqcdpyCJqNNIG2N+SBH489easlDXfQf5AS1Go3otDbU\nMwviuKhN4DDPbcV+SXVJjJR/NQzmWFO5RuFvjkFTh/Z7Xi9HQY1Ytkekwl/LfNDw\nOdC1aMu7CxKe4ZmC3fcOEOoriVDXVqORm3fmu1h5e9q/aJgJJy/0Rsu6hvec0yqJ\nSJOv+oVAlQalZF23XYDm71vM0GdFS6jXkjAcDyeUIgK4a1xSNCln0fH/TEW4V+2f\nplLWU8xirJ2vB+DO8+E6+Kg9WYDr63a8Tr0sNV0J42SwSbk3FLvsStEIgFIcm6HI\n9SOyFWp3Jc8bFBmuOjiXFn9IBtkX6FT6TSWdDCIisdeilIcXHLRNa6Iljzn2kGqP\nLmdGIbsSlggvy9thXIQ/t0ri2CL22aV6vV1Qjl1UW/i/vTtBA75ydroiyUhvo+If\ndbSuto6QwxoTbULDd+lyHgRmJ4irQcOsJerFDI0k7Ju03n0hvdQ=\n=YITA\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:21:58Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/25"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Mar/25"
        },
        {
          "url": "https://developer.apple.com/xcode/downloads/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/126801"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Mar/25"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-03-24-2026-10 Xcode 26.4",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-28889",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28890",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0270",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/25",
            "automated": true,
            "contentSha256": "21d0f7f48fa4cc7406405781627c0cb071ada2d9732289b5217227cb7b51bacf",
            "evidenceScore": 6,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/25",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-03-25T00:06:07Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0270"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:43Z",
    "dateUpdated": "2026-09-11T11:21:58Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0270"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0264

    Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-11 11:21
    VLAI
    Title
    APPLE-SA-03-24-2026-4 macOS Sequoia 15.7.5
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-03-24-2026-4 macOS Sequoia 15.7.5 macOS Sequoia 15.7.5 addresses the following issues. Information about the security content is also available at https://support.apple.com/126795. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. 802.1X Available for: macOS Sequoia Impact: An attacker in a privileged network position may be able to intercept network traffic Description: An authentication issue was addressed with improved state management. CVE-2026-28865: Héloïse Gollier and Mathy Vanhoef (KU Leuven) Accounts Available for: macOS Sequoia Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-28877: Rosyna Keller of Totally Not Malicious Software apache Available for: macOS Sequoia Impact: Multiple issues in Apache Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2025-55753 CVE-2025-58098 CVE-2025-59775 CVE-2025-65082 CVE-2025-66200 AppleKeyStore Available for: macOS Sequoia Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-20637: Johnny Franks (zeroxjf), an anonymous researcher AppleMobileFileIntegrity Available for: macOS Sequoia Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-28824: Mickey Jin (@patch1t) AppleMobileFileIntegrity Available for: macOS Sequoia Impact: An app may be able to access user-sensitive data Description: A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. CVE-2026-20699: Mickey Jin (@patch1t) Audio Available for: macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: A use-after-free issue was addressed with improved memory management. CVE-2026-28879: Justin Cohen of Google Audio Available for: macOS Sequoia Impact: An attacker may be able to cause unexpected app termination Description: A type confusion issue was addressed with improved memory handling. CVE-2026-28822: Jex Amro Calling Framework Available for: macOS Sequoia Impact: A remote attacker may be able to cause a denial-of-service Description: A denial-of-service issue was addressed with improved input validation. CVE-2026-28894: an anonymous researcher CFNetwork Available for: macOS Sequoia Impact: A remote user may be able to write arbitrary files Description: A path handling issue was addressed with improved logic. CVE-2026-20660: Amy (amys.website) Clipboard Available for: macOS Sequoia Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved validation of symlinks. CVE-2026-28866: Cristian Dinca (icmd.tech) configd Available for: macOS Sequoia Impact: Processing a maliciously crafted string may lead to heap corruption Description: An integer overflow was addressed with improved input validation. CVE-2026-20639: @cloudlldb of @pixiepointsec CoreMedia Available for: macOS Sequoia Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: An out-of-bounds access issue was addressed with improved bounds checking. CVE-2026-20690: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative CoreServices Available for: macOS Sequoia Impact: An app may be able to gain elevated privileges Description: A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement. CVE-2026-28821: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab CoreServices Available for: macOS Sequoia Impact: An app may be able to break out of its sandbox Description: A permissions issue was addressed with additional sandbox restrictions. CVE-2026-28838: an anonymous researcher CoreUtils Available for: macOS Sequoia Impact: A user in a privileged network position may be able to cause a denial-of-service Description: A null pointer dereference was addressed with improved input validation. CVE-2026-28886: Etienne Charron (Renault) and Victoria Martini (Renault) CUPS Available for: macOS Sequoia Impact: An app may be able to gain root privileges Description: A race condition was addressed with improved state handling. CVE-2026-28888: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs curl Available for: macOS Sequoia Impact: An issue existed in curl which may result in unintentionally sending sensitive information via an incorrect connection Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2025-14524 DesktopServices Available for: macOS Sequoia Impact: An app may be able to access user-sensitive data Description: This issue was addressed with improved handling of symlinks. CVE-2026-20633: Mickey Jin (@patch1t) DeviceLink Available for: macOS Sequoia Impact: An app may be able to access sensitive user data Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-28876: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs Diagnostics Available for: macOS Sequoia Impact: An app may be able to modify protected parts of the file system Description: A permissions issue was addressed by removing the vulnerable code. CVE-2026-28892: 风沐云烟 (@binary_fmyy) and Minghao Lin (@Y1nKoc) File System Available for: macOS Sequoia Impact: An app may be able to disclose kernel memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-28832: DARKNAVY (@DarkNavyOrg) Focus Available for: macOS Sequoia Impact: An app may be able to access sensitive user data Description: A logging issue was addressed with improved data redaction. CVE-2026-20668: Kirin (@Pwnrin) GPU Drivers Available for: macOS Sequoia Impact: An app may be able to cause unexpected system termination Description: A race condition was addressed with improved state handling. CVE-2026-28834: an anonymous researcher iCloud Available for: macOS Sequoia Impact: An app may be able to enumerate a user's installed apps Description: A permissions issue was addressed with additional restrictions. CVE-2026-28880: Zhongcheng Li from IES Red Team ImageIO Available for: macOS Sequoia Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2025-64505 Kernel Available for: macOS Sequoia Impact: An app may be able to disclose kernel memory Description: A logging issue was addressed with improved data redaction. CVE-2026-28868: 이동하 (Lee Dong Ha of BoB 0xB6) Kernel Available for: macOS Sequoia Impact: An app may be able to leak sensitive kernel state Description: This issue was addressed with improved authentication. CVE-2026-28867: Jian Lee (@speedyfriend433) Kernel Available for: macOS Sequoia Impact: An app may be able to determine kernel memory layout Description: An information disclosure issue was addressed with improved memory management. CVE-2026-20695: 이동하 (Lee Dong Ha of BoB 0xB6) working with TrendAI Zero Day Initiative, hari shanmugam Kernel Available for: macOS Sequoia Impact: An app may be able to cause unexpected system termination or write kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2026-20687: Johnny Franks (@zeroxjf) Kernel Available for: macOS Sequoia Impact: An app may be able to modify protected parts of the file system Description: A permissions issue was addressed with additional restrictions. CVE-2026-28829: Sreejith Krishnan R libxpc Available for: macOS Sequoia Impact: An app may be able to access protected user data Description: A permissions issue was addressed with additional restrictions. CVE-2026-20607: an anonymous researcher Mail Available for: macOS Sequoia Impact: "Hide IP Address" and "Block All Remote Content" may not apply to all mail content Description: A privacy issue was addressed with improved handling of user preferences. CVE-2026-20692: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs mDNSResponder Available for: macOS Sequoia Impact: An app may be able to leak sensitive kernel state Description: This issue was addressed with improved authentication. CVE-2026-28867: Jian Lee (@speedyfriend433) Messages Available for: macOS Sequoia Impact: An app may be able to access sensitive user data Description: A privacy issue was addressed with improved handling of temporary files. CVE-2026-20651: Chunyu Song of NorthSea MigrationKit Available for: macOS Sequoia Impact: An app may be able to access user-sensitive data Description: This issue was addressed with improved handling of symlinks. CVE-2026-20694: Rodolphe Brunetti (@eisw0lf) of Lupus Nova NetAuth Available for: macOS Sequoia Impact: An app may be able to break out of its sandbox Description: A race condition was addressed with additional validation. CVE-2026-28891: an anonymous researcher NetAuth Available for: macOS Sequoia Impact: An app may be able to connect to a network share without user consent Description: An access issue was addressed with additional sandbox restrictions. CVE-2026-20701: Matej Moravec (@MacejkoMoravec) NetAuth Available for: macOS Sequoia Impact: An app may be able to access sensitive user data Description: The issue was addressed with improved checks. CVE-2026-28839: Mickey Jin (@patch1t) NetFSFramework Available for: macOS Sequoia Impact: An app may be able to break out of its sandbox Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-28827: Csaba Fitzl (@theevilbit) of Iru, an anonymous researcher Notes Available for: macOS Sequoia Impact: An app may be able to delete files for which it does not have permission Description: A path handling issue was addressed with improved validation. CVE-2026-28816: Dawuge of Shuffle Team and Hunan University PackageKit Available for: macOS Sequoia Impact: An attacker with root privileges may be able to delete protected system files Description: This issue was addressed through improved state management. CVE-2026-20693: Mickey Jin (@patch1t) Phone Available for: macOS Sequoia Impact: An app may be able to access user-sensitive data Description: A privacy issue was addressed with improved private data redaction for log entries. CVE-2026-28862: Kun Peeks (@SwayZGl1tZyyy) Printing Available for: macOS Sequoia Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-28831: an anonymous researcher Printing Available for: macOS Sequoia Impact: A sandboxed process may be able to circumvent sandbox restrictions Description: A race condition was addressed with improved state handling. CVE-2026-28817: Gyujeong Jin (@G1uN4sh) at Team.0xb6 Printing Available for: macOS Sequoia Impact: An app may be able to break out of its sandbox Description: A path handling issue was addressed with improved validation. CVE-2026-20688: wdszzml and Atuin Automated Vulnerability Discovery Engine Security Available for: macOS Sequoia Impact: A local attacker may gain access to user's Keychain items Description: This issue was addressed with improved permissions checking. CVE-2026-28864: Alex Radocea SMB Available for: macOS Sequoia Impact:
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Apple Macos Sequoia Affected: unknown
    		Create a notification for this product.
    Credits
    Apple Product Security via Fulldisclosure
    Relationships
    reference GCVE-1988-2026-0264 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Macos Sequoia",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-03-24-2026-4 macOS Sequoia 15.7.5\n\nmacOS Sequoia 15.7.5 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/126795.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\n802.1X\nAvailable for: macOS Sequoia\nImpact: An attacker in a privileged network position may be able to\nintercept network traffic\nDescription: An authentication issue was addressed with improved state\nmanagement.\nCVE-2026-28865: H\u00e9lo\u00efse Gollier and Mathy Vanhoef (KU Leuven)\n\nAccounts\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-28877: Rosyna Keller of Totally Not Malicious Software\n\napache\nAvailable for: macOS Sequoia\nImpact: Multiple issues in Apache\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2025-55753\nCVE-2025-58098\nCVE-2025-59775\nCVE-2025-65082\nCVE-2025-66200\n\nAppleKeyStore\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-20637: Johnny Franks (zeroxjf), an anonymous researcher\n\nAppleMobileFileIntegrity\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-28824: Mickey Jin (@patch1t)\n\nAppleMobileFileIntegrity\nAvailable for: macOS Sequoia\nImpact: An app may be able to access user-sensitive data\nDescription: A downgrade issue affecting Intel-based Mac computers was\naddressed with additional code-signing restrictions.\nCVE-2026-20699: Mickey Jin (@patch1t)\n\nAudio\nAvailable for: macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nCVE-2026-28879: Justin Cohen of Google\n\nAudio\nAvailable for: macOS Sequoia\nImpact: An attacker may be able to cause unexpected app termination\nDescription: A type confusion issue was addressed with improved memory\nhandling.\nCVE-2026-28822: Jex Amro\n\nCalling Framework\nAvailable for: macOS Sequoia\nImpact: A remote attacker may be able to cause a denial-of-service\nDescription: A denial-of-service issue was addressed with improved input\nvalidation.\nCVE-2026-28894: an anonymous researcher\n\nCFNetwork\nAvailable for: macOS Sequoia\nImpact: A remote user may be able to write arbitrary files\nDescription: A path handling issue was addressed with improved logic.\nCVE-2026-20660: Amy (amys.website)\n\nClipboard\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved validation of\nsymlinks.\nCVE-2026-28866: Cristian Dinca (icmd.tech)\n\nconfigd\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted string may lead to heap\ncorruption\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-20639: @cloudlldb of @pixiepointsec\n\nCoreMedia\nAvailable for: macOS Sequoia\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-20690: Hossein Lotfi (@hosselot) of Trend Micro Zero Day\nInitiative\n\nCoreServices\nAvailable for: macOS Sequoia\nImpact: An app may be able to gain elevated privileges\nDescription: A validation issue existed in the entitlement verification.\nThis issue was addressed with improved validation of the process\nentitlement.\nCVE-2026-28821: YingQi Shi (@Mas0nShi) of DBAppSecurity\u0027s WeBin lab\n\nCoreServices\nAvailable for: macOS Sequoia\nImpact: An app may be able to break out of its sandbox\nDescription: A permissions issue was addressed with additional sandbox\nrestrictions.\nCVE-2026-28838: an anonymous researcher\n\nCoreUtils\nAvailable for: macOS Sequoia\nImpact: A user in a privileged network position may be able to cause a\ndenial-of-service\nDescription: A null pointer dereference was addressed with improved\ninput validation.\nCVE-2026-28886: Etienne Charron (Renault) and Victoria Martini (Renault)\n\nCUPS\nAvailable for: macOS Sequoia\nImpact: An app may be able to gain root privileges\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-28888: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\ncurl\nAvailable for: macOS Sequoia\nImpact: An issue existed in curl which may result in unintentionally\nsending sensitive information via an incorrect connection\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2025-14524\n\nDesktopServices\nAvailable for: macOS Sequoia\nImpact: An app may be able to access user-sensitive data\nDescription: This issue was addressed with improved handling of\nsymlinks.\nCVE-2026-20633: Mickey Jin (@patch1t)\n\nDeviceLink\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-28876: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nDiagnostics\nAvailable for: macOS Sequoia\nImpact: An app may be able to modify protected parts of the file system\nDescription: A permissions issue was addressed by removing the\nvulnerable code.\nCVE-2026-28892: \u98ce\u6c90\u4e91\u70df (@binary_fmyy) and Minghao Lin (@Y1nKoc)\n\nFile System\nAvailable for: macOS Sequoia\nImpact: An app may be able to disclose kernel memory\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-28832: DARKNAVY (@DarkNavyOrg)\n\nFocus\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-20668: Kirin (@Pwnrin)\n\nGPU Drivers\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-28834: an anonymous researcher\n\niCloud\nAvailable for: macOS Sequoia\nImpact: An app may be able to enumerate a user\u0027s installed apps\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28880: Zhongcheng Li from IES Red Team\n\nImageIO\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2025-64505\n\nKernel\nAvailable for: macOS Sequoia\nImpact: An app may be able to disclose kernel memory\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28868: \uc774\ub3d9\ud558 (Lee Dong Ha of BoB 0xB6)\n\nKernel\nAvailable for: macOS Sequoia\nImpact: An app may be able to leak sensitive kernel state\nDescription: This issue was addressed with improved authentication.\nCVE-2026-28867: Jian Lee (@speedyfriend433)\n\nKernel\nAvailable for: macOS Sequoia\nImpact: An app may be able to determine kernel memory layout\nDescription: An information disclosure issue was addressed with improved\nmemory management.\nCVE-2026-20695: \uc774\ub3d9\ud558 (Lee Dong Ha of BoB 0xB6) working with TrendAI Zero\nDay Initiative, hari shanmugam\n\nKernel\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-20687: Johnny Franks (@zeroxjf)\n\nKernel\nAvailable for: macOS Sequoia\nImpact: An app may be able to modify protected parts of the file system\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28829: Sreejith Krishnan R\n\nlibxpc\nAvailable for: macOS Sequoia\nImpact: An app may be able to access protected user data\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-20607: an anonymous researcher\n\nMail\nAvailable for: macOS Sequoia\nImpact: \"Hide IP Address\" and \"Block All Remote Content\" may not apply\nto all mail content\nDescription: A privacy issue was addressed with improved handling of\nuser preferences.\nCVE-2026-20692: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nmDNSResponder\nAvailable for: macOS Sequoia\nImpact: An app may be able to leak sensitive kernel state\nDescription: This issue was addressed with improved authentication.\nCVE-2026-28867: Jian Lee (@speedyfriend433)\n\nMessages\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: A privacy issue was addressed with improved handling of\ntemporary files.\nCVE-2026-20651: Chunyu Song of NorthSea\n\nMigrationKit\nAvailable for: macOS Sequoia\nImpact: An app may be able to access user-sensitive data\nDescription: This issue was addressed with improved handling of\nsymlinks.\nCVE-2026-20694: Rodolphe Brunetti (@eisw0lf) of Lupus Nova\n\nNetAuth\nAvailable for: macOS Sequoia\nImpact: An app may be able to break out of its sandbox\nDescription: A race condition was addressed with additional validation.\nCVE-2026-28891: an anonymous researcher\n\nNetAuth\nAvailable for: macOS Sequoia\nImpact: An app may be able to connect to a network share without user\nconsent\nDescription: An access issue was addressed with additional sandbox\nrestrictions.\nCVE-2026-20701: Matej Moravec (@MacejkoMoravec)\n\nNetAuth\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: The issue was addressed with improved checks.\nCVE-2026-28839: Mickey Jin (@patch1t)\n\nNetFSFramework\nAvailable for: macOS Sequoia\nImpact: An app may be able to break out of its sandbox\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-28827: Csaba Fitzl (@theevilbit) of Iru, an anonymous\nresearcher\n\nNotes\nAvailable for: macOS Sequoia\nImpact: An app may be able to delete files for which it does not have\npermission\nDescription: A path handling issue was addressed with improved\nvalidation.\nCVE-2026-28816: Dawuge of Shuffle Team and Hunan University\n\nPackageKit\nAvailable for: macOS Sequoia\nImpact: An attacker with root privileges may be able to delete protected\nsystem files\nDescription: This issue was addressed through improved state management.\nCVE-2026-20693: Mickey Jin (@patch1t)\n\nPhone\nAvailable for: macOS Sequoia\nImpact: An app may be able to access user-sensitive data\nDescription: A privacy issue was addressed with improved private data\nredaction for log entries.\nCVE-2026-28862: Kun Peeks (@SwayZGl1tZyyy)\n\nPrinting\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-28831: an anonymous researcher\n\nPrinting\nAvailable for: macOS Sequoia\nImpact: A sandboxed process may be able to circumvent sandbox\nrestrictions\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-28817: Gyujeong Jin (@G1uN4sh) at Team.0xb6\n\nPrinting\nAvailable for: macOS Sequoia\nImpact: An app may be able to break out of its sandbox\nDescription: A path handling issue was addressed with improved\nvalidation.\nCVE-2026-20688: wdszzml and Atuin Automated Vulnerability Discovery\nEngine\n\nSecurity\nAvailable for: macOS Sequoia\nImpact: A local attacker may gain access to user\u0027s Keychain items\nDescription: This issue was addressed with improved permissions\nchecking.\nCVE-2026-28864: Alex Radocea\n\nSMB\nAvailable for: macOS Sequoia\nImpact: "
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:21:40Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/19"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Mar/19"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/126795"
        },
        {
          "url": "https://support.apple.com/downloads/"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Mar/19"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-03-24-2026-4 macOS Sequoia 15.7.5",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-14524",
              "type": "related"
            },
            {
              "destId": "CVE-2025-55753",
              "type": "related"
            },
            {
              "destId": "CVE-2025-58098",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59775",
              "type": "related"
            },
            {
              "destId": "CVE-2025-64505",
              "type": "related"
            },
            {
              "destId": "CVE-2025-65082",
              "type": "related"
            },
            {
              "destId": "CVE-2025-66200",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20607",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20633",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20637",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20639",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20651",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20657",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20660",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20668",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20687",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20688",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20690",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20692",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20693",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20694",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20695",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20697",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20699",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20701",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28816",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28817",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28818",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28821",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28822",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28824",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28825",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28827",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28828",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28829",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28831",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28832",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28834",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28835",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28838",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28839",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28852",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28862",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28864",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28865",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28866",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28867",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28868",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28876",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28877",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28879",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28880",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28886",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28888",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28891",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28892",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28894",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0264",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/19",
            "automated": true,
            "contentSha256": "a972b2597cbec43d3689c8b5f0b84c13edaf7bd2d69b56230f776f49ec2ed16c",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/19",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-03-25T00:02:26Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0264"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:43Z",
    "dateUpdated": "2026-09-11T11:21:40Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0264"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0268

    Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-11 11:21
    VLAI
    Title
    APPLE-SA-03-24-2026-8 visionOS 26.4
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-03-24-2026-8 visionOS 26.4 visionOS 26.4 addresses the following issues. Information about the security content is also available at https://support.apple.com/126799. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. 802.1X Available for: Apple Vision Pro (all models) Impact: An attacker in a privileged network position may be able to intercept network traffic Description: An authentication issue was addressed with improved state management. CVE-2026-28865: Héloïse Gollier and Mathy Vanhoef (KU Leuven) Accounts Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-28877: Rosyna Keller of Totally Not Malicious Software Audio Available for: Apple Vision Pro (all models) Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: A use-after-free issue was addressed with improved memory management. CVE-2026-28879: Justin Cohen of Google Audio Available for: Apple Vision Pro (all models) Impact: An attacker may be able to cause unexpected app termination Description: A type confusion issue was addressed with improved memory handling. CVE-2026-28822: Jex Amro CoreMedia Available for: Apple Vision Pro (all models) Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: An out-of-bounds access issue was addressed with improved bounds checking. CVE-2026-20690: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative CoreUtils Available for: Apple Vision Pro (all models) Impact: A user in a privileged network position may be able to cause a denial-of-service Description: A null pointer dereference was addressed with improved input validation. CVE-2026-28886: Etienne Charron (Renault) and Victoria Martini (Renault) Crash Reporter Available for: Apple Vision Pro (all models) Impact: An app may be able to enumerate a user's installed apps Description: A privacy issue was addressed by removing sensitive data. CVE-2026-28878: Zhongcheng Li from IES Red Team curl Available for: Apple Vision Pro (all models) Impact: An issue existed in curl which may result in unintentionally sending sensitive information via an incorrect connection Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2025-14524 DeviceLink Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-28876: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs GeoServices Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: An information leakage was addressed with additional validation. CVE-2026-28870: XiguaSec iCloud Available for: Apple Vision Pro (all models) Impact: An app may be able to enumerate a user's installed apps Description: A permissions issue was addressed with additional restrictions. CVE-2026-28880: Zhongcheng Li from IES Red Team CVE-2026-28833: Zhongcheng Li from IES Red Team ImageIO Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2025-64505 Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to disclose kernel memory Description: A logging issue was addressed with improved data redaction. CVE-2026-28868: 이동하 (Lee Dong Ha of BoB 0xB6) Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to leak sensitive kernel state Description: This issue was addressed with improved authentication. CVE-2026-28867: Jian Lee (@speedyfriend433) Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-20698: DARKNAVY (@DarkNavyOrg) libxpc Available for: Apple Vision Pro (all models) Impact: An app may be able to enumerate a user's installed apps Description: This issue was addressed with improved checks. CVE-2026-28882: Ilias Morad (A2nkF) of Voynich Group, Duy Trần (@khanhduytran0), @hugeBlack Printing Available for: Apple Vision Pro (all models) Impact: An app may be able to break out of its sandbox Description: A path handling issue was addressed with improved validation. CVE-2026-20688: wdszzml and Atuin Automated Vulnerability Discovery Engine Sandbox Profiles Available for: Apple Vision Pro (all models) Impact: An app may be able to fingerprint the user Description: A permissions issue was addressed with additional restrictions. CVE-2026-28863: Gongyu Ma (@Mezone0) Security Available for: Apple Vision Pro (all models) Impact: A local attacker may gain access to user's Keychain items Description: This issue was addressed with improved permissions checking. CVE-2026-28864: Alex Radocea Siri Available for: Apple Vision Pro (all models) Impact: An attacker with physical access to a locked device may be able to view sensitive user information Description: The issue was addressed with improved authentication. CVE-2026-28856: an anonymous researcher UIFoundation Available for: Apple Vision Pro (all models) Impact: An app may be able to cause a denial-of-service Description: A stack overflow was addressed with improved input validation. CVE-2026-28852: Caspian Tarafdar WebKit Available for: Apple Vision Pro (all models) Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced Description: This issue was addressed through improved state management. WebKit Bugzilla: 304951 CVE-2026-20665: webb WebKit Available for: Apple Vision Pro (all models) Impact: Processing maliciously crafted web content may bypass Same Origin Policy Description: A cross-origin issue in the Navigation API was addressed with improved input validation. WebKit Bugzilla: 306050 CVE-2026-20643: Thomas Espach WebKit Available for: Apple Vision Pro (all models) Impact: A malicious website may be able to access script message handlers intended for other origins Description: A logic issue was addressed with improved state management. WebKit Bugzilla: 307014 CVE-2026-28861: Hongze Wu and Shuaike Dong from Ant Group Infrastructure Security Team WebKit Available for: Apple Vision Pro (all models) Impact: A malicious website may be able to process restricted web content outside the sandbox Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 308248 CVE-2026-28859: greenbynox, Arni Hardarson WebKit Available for: Apple Vision Pro (all models) Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 306136 CVE-2026-20664: Daniel Rhea, Söhnke Benedikt Fischedick (Tripton), Emrovsky & Switch, Yevhen Pervushyn WebKit Bugzilla: 307723 CVE-2026-28857: Narcis Oliveras Fontàs, Söhnke Benedikt Fischedick (Tripton), Daniel Rhea, Nathaniel Oh (@calysteon) WebKit Sandboxing Available for: Apple Vision Pro (all models) Impact: A maliciously crafted webpage may be able to fingerprint the user Description: An authorization issue was addressed with improved state management. WebKit Bugzilla: 306827 CVE-2026-20691: Gongyu Ma (@Mezone0) Additional recognition AirPort We would like to acknowledge Yashar Shahinzadeh, Saman Ebrahimnezhad, Amir Safari, Omid Rezaii for their assistance. Bluetooth We would like to acknowledge Hamid Mahmoud for their assistance. Captive Network We would like to acknowledge Kun Peeks (@SwayZGl1tZyyy) for their assistance. CipherML We would like to acknowledge Nils Hanff (@nils1729@chaos.social) of Hasso Plattner Institute for their assistance. CloudAttestation We would like to acknowledge Suresh Sundaram, Willard Jansen for their assistance. CoreUI We would like to acknowledge Peter Malone for their assistance. Find My We would like to acknowledge Salemdomain for their assistance. GPU Drivers We would like to acknowledge Jian Lee (@speedyfriend433) for their assistance. ICU We would like to acknowledge Jian Lee (@speedyfriend433) for their assistance. Kernel We would like to acknowledge DARKNAVY (@DarkNavyOrg), Kylian Boulard De Pouqueville From Fuzzinglabs, Patrick Ventuzelo From Fuzzinglabs, Robert Tran, Suresh Sundaram for their assistance. libarchive We would like to acknowledge Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs, Arni Hardarson for their assistance. libc We would like to acknowledge Vitaly Simonovich for their assistance. Libnotify We would like to acknowledge Ilias Morad (@A2nkF_) for their assistance. LLVM We would like to acknowledge Nathaniel Oh (@calysteon) for their assistance. Messages We would like to acknowledge JZ for their assistance. MobileInstallation We would like to acknowledge Gongyu Ma (@Mezone0) for their assistance. Music We would like to acknowledge Mohammad Kaif (@_mkahmad | kaif0x01) for their assistance. Notes We would like to acknowledge Dawuge of Shuffle Team and Hunan University for their assistance. ppp We would like to acknowledge Dave G. for their assistance. Quick Look We would like to acknowledge Wojciech Regula of SecuRing (wojciechregula.blog), an anonymous researcher for their assistance. Safari We would like to acknowledge @RenwaX23, Farras Givari, Syarif Muhammad Sajjad, Yair for their assistance. Shortcuts We would like to acknowledge Waleed Barakat (@WilDN00B) and Paul Montgomery (@nullevent) for their assistance. Siri We would like to acknowledge Anand Mallaya, Tech consultant, Anand Mallaya and Co., Harsh Kirdolia, Hrishikesh Parmar of Self-Employed for their assistance. Time Zone We would like to acknowledge Abhay Kailasia (@abhay_kailasia) from Safran Mumbai India for their assistance. UIKit We would like to acknowledge AEC, Abhay Kailasia (@abhay_kailasia) from Safran Mumbai India, Bishal Kafle (@whoisbishal.k), Carlos Luna (U.S. Department of the Navy), Dalibor Milanovic, Daren Goodchild, JS De Mattei, Maxwell Garn, Zack Tickman, fuyuu12, incredincomp for their assistance. Wallet We would like to acknowledge Zhongcheng Li from IES Red Team of ByteDance for their assistance. Web Extensions We would like to acknowledge Carlos Jeurissen, Rob Wu (robwu.nl) for their assistance. WebKit We would like to acknowledge Vamshi Paili for their assistance. WebKit Process Model We would like to acknowledge Joseph Semaan for their assistance. Wi-Fi We would like to acknowledge Kun Peeks (@SwayZGl1tZyyy), an anonymous researcher for their assistance. Wi-Fi Connectivity We would like to acknowledge Alex Radocea of Supernetworks, Inc for their assistance. Widgets We would like to acknowledge Marcel Voß, Mitul Pranjay, Serok Çelik for their assistance. Instructions on how to update visionOS are available at https://support.apple.com/kb/HT214009 To check the software version on your Apple Vision Pro, open the Settings app and choose General > About. All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmnDI2MACgkQ4Ifiq8DH 7PWuKA//atH169ExbPVZu20
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Apple Visionos Affected: unknown
    		Create a notification for this product.
    Credits
    Apple Product Security via Fulldisclosure
    Relationships
    reference GCVE-1988-2026-0268 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Visionos",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-03-24-2026-8 visionOS 26.4\n\nvisionOS 26.4 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/126799.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\n802.1X\nAvailable for: Apple Vision Pro (all models)\nImpact: An attacker in a privileged network position may be able to\nintercept network traffic\nDescription: An authentication issue was addressed with improved state\nmanagement.\nCVE-2026-28865: H\u00e9lo\u00efse Gollier and Mathy Vanhoef (KU Leuven)\n\nAccounts\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-28877: Rosyna Keller of Totally Not Malicious Software\n\nAudio\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nCVE-2026-28879: Justin Cohen of Google\n\nAudio\nAvailable for: Apple Vision Pro (all models)\nImpact: An attacker may be able to cause unexpected app termination\nDescription: A type confusion issue was addressed with improved memory\nhandling.\nCVE-2026-28822: Jex Amro\n\nCoreMedia\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-20690: Hossein Lotfi (@hosselot) of Trend Micro Zero Day\nInitiative\n\nCoreUtils\nAvailable for: Apple Vision Pro (all models)\nImpact: A user in a privileged network position may be able to cause a\ndenial-of-service\nDescription: A null pointer dereference was addressed with improved\ninput validation.\nCVE-2026-28886: Etienne Charron (Renault) and Victoria Martini (Renault)\n\nCrash Reporter\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to enumerate a user\u0027s installed apps\nDescription: A privacy issue was addressed by removing sensitive data.\nCVE-2026-28878: Zhongcheng Li from IES Red Team\n\ncurl\nAvailable for: Apple Vision Pro (all models)\nImpact: An issue existed in curl which may result in unintentionally\nsending sensitive information via an incorrect connection\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2025-14524\n\nDeviceLink\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-28876: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nGeoServices\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-28870: XiguaSec\n\niCloud\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to enumerate a user\u0027s installed apps\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28880: Zhongcheng Li from IES Red Team\nCVE-2026-28833: Zhongcheng Li from IES Red Team\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2025-64505\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to disclose kernel memory\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28868: \uc774\ub3d9\ud558 (Lee Dong Ha of BoB 0xB6)\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to leak sensitive kernel state\nDescription: This issue was addressed with improved authentication.\nCVE-2026-28867: Jian Lee (@speedyfriend433)\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-20698: DARKNAVY (@DarkNavyOrg)\n\nlibxpc\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to enumerate a user\u0027s installed apps\nDescription: This issue was addressed with improved checks.\nCVE-2026-28882: Ilias Morad (A2nkF) of Voynich Group, Duy Tr\u1ea7n\n(@khanhduytran0), @hugeBlack\n\nPrinting\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to break out of its sandbox\nDescription: A path handling issue was addressed with improved\nvalidation.\nCVE-2026-20688: wdszzml and Atuin Automated Vulnerability Discovery\nEngine\n\nSandbox Profiles\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to fingerprint the user\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28863: Gongyu Ma (@Mezone0)\n\nSecurity\nAvailable for: Apple Vision Pro (all models)\nImpact: A local attacker may gain access to user\u0027s Keychain items\nDescription: This issue was addressed with improved permissions\nchecking.\nCVE-2026-28864: Alex Radocea\n\nSiri\nAvailable for: Apple Vision Pro (all models)\nImpact: An attacker with physical access to a locked device may be able\nto view sensitive user information\nDescription: The issue was addressed with improved authentication.\nCVE-2026-28856: an anonymous researcher\n\nUIFoundation\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause a denial-of-service\nDescription: A stack overflow was addressed with improved input\nvalidation.\nCVE-2026-28852: Caspian Tarafdar\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may prevent Content\nSecurity Policy from being enforced\nDescription: This issue was addressed through improved state management.\nWebKit Bugzilla: 304951\nCVE-2026-20665: webb\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may bypass Same\nOrigin Policy\nDescription: A cross-origin issue in the Navigation API was addressed\nwith improved input validation.\nWebKit Bugzilla: 306050\nCVE-2026-20643: Thomas Espach\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: A malicious website may be able to access script message\nhandlers intended for other origins\nDescription: A logic issue was addressed with improved state management.\nWebKit Bugzilla: 307014\nCVE-2026-28861: Hongze Wu and Shuaike Dong from Ant Group Infrastructure\nSecurity Team\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: A malicious website may be able to process restricted web\ncontent outside the sandbox\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 308248\nCVE-2026-28859: greenbynox, Arni Hardarson\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 306136\nCVE-2026-20664: Daniel Rhea, S\u00f6hnke Benedikt Fischedick (Tripton),\nEmrovsky \u0026 Switch, Yevhen Pervushyn\nWebKit Bugzilla: 307723\nCVE-2026-28857: Narcis Oliveras Font\u00e0s, S\u00f6hnke Benedikt Fischedick\n(Tripton), Daniel Rhea, Nathaniel Oh (@calysteon)\n\nWebKit Sandboxing\nAvailable for: Apple Vision Pro (all models)\nImpact: A maliciously crafted webpage may be able to fingerprint the\nuser\nDescription: An authorization issue was addressed with improved state\nmanagement.\nWebKit Bugzilla: 306827\nCVE-2026-20691: Gongyu Ma (@Mezone0)\n\nAdditional recognition\n\nAirPort\nWe would like to acknowledge Yashar Shahinzadeh, Saman Ebrahimnezhad,\nAmir Safari, Omid Rezaii for their assistance.\n\nBluetooth\nWe would like to acknowledge Hamid Mahmoud for their assistance.\n\nCaptive Network\nWe would like to acknowledge Kun Peeks (@SwayZGl1tZyyy) for their\nassistance.\n\nCipherML\nWe would like to acknowledge Nils Hanff (@nils1729@chaos.social) of\nHasso Plattner Institute for their assistance.\n\nCloudAttestation\nWe would like to acknowledge Suresh Sundaram, Willard Jansen for their\nassistance.\n\nCoreUI\nWe would like to acknowledge Peter Malone for their assistance.\n\nFind My\nWe would like to acknowledge Salemdomain for their assistance.\n\nGPU Drivers\nWe would like to acknowledge Jian Lee (@speedyfriend433) for their\nassistance.\n\nICU\nWe would like to acknowledge Jian Lee (@speedyfriend433) for their\nassistance.\n\nKernel\nWe would like to acknowledge DARKNAVY (@DarkNavyOrg), Kylian Boulard De\nPouqueville From Fuzzinglabs, Patrick Ventuzelo From Fuzzinglabs, Robert\nTran, Suresh Sundaram for their assistance.\n\nlibarchive\nWe would like to acknowledge Andreas Jaegersberger \u0026 Ro Achterberg of\nNosebeard Labs, Arni Hardarson for their assistance.\n\nlibc\nWe would like to acknowledge Vitaly Simonovich for their assistance.\n\nLibnotify\nWe would like to acknowledge Ilias Morad (@A2nkF_) for their assistance.\n\nLLVM\nWe would like to acknowledge Nathaniel Oh (@calysteon) for their\nassistance.\n\nMessages\nWe would like to acknowledge JZ for their assistance.\n\nMobileInstallation\nWe would like to acknowledge Gongyu Ma (@Mezone0) for their assistance.\n\nMusic\nWe would like to acknowledge Mohammad Kaif (@_mkahmad | kaif0x01) for\ntheir assistance.\n\nNotes\nWe would like to acknowledge Dawuge of Shuffle Team and Hunan University\nfor their assistance.\n\nppp\nWe would like to acknowledge Dave G. for their assistance.\n\nQuick Look\nWe would like to acknowledge Wojciech Regula of SecuRing\n(wojciechregula.blog), an anonymous researcher for their assistance.\n\nSafari\nWe would like to acknowledge @RenwaX23, Farras Givari, Syarif Muhammad\nSajjad, Yair for their assistance.\n\nShortcuts\nWe would like to acknowledge Waleed Barakat (@WilDN00B) and Paul\nMontgomery (@nullevent) for their assistance.\n\nSiri\nWe would like to acknowledge Anand Mallaya, Tech consultant, Anand\nMallaya and Co., Harsh Kirdolia, Hrishikesh Parmar of Self-Employed for\ntheir assistance.\n\nTime Zone\nWe would like to acknowledge Abhay Kailasia (@abhay_kailasia) from\nSafran Mumbai India for their assistance.\n\nUIKit\nWe would like to acknowledge AEC, Abhay Kailasia (@abhay_kailasia) from\nSafran Mumbai India, Bishal Kafle (@whoisbishal.k), Carlos Luna (U.S.\nDepartment of the Navy), Dalibor Milanovic, Daren Goodchild, JS De\nMattei, Maxwell Garn, Zack Tickman, fuyuu12, incredincomp for their\nassistance.\n\nWallet\nWe would like to acknowledge Zhongcheng Li from IES Red Team of\nByteDance for their assistance.\n\nWeb Extensions\nWe would like to acknowledge Carlos Jeurissen, Rob Wu (robwu.nl) for\ntheir assistance.\n\nWebKit\nWe would like to acknowledge Vamshi Paili for their assistance.\n\nWebKit Process Model\nWe would like to acknowledge Joseph Semaan for their assistance.\n\nWi-Fi\nWe would like to acknowledge Kun Peeks (@SwayZGl1tZyyy), an anonymous\nresearcher for their assistance.\n\nWi-Fi Connectivity\nWe would like to acknowledge Alex Radocea of Supernetworks, Inc for\ntheir assistance.\n\nWidgets\nWe would like to acknowledge Marcel Vo\u00df, Mitul Pranjay, Serok \u00c7elik for\ntheir assistance.\n\nInstructions on how to update visionOS are available\nat https://support.apple.com/kb/HT214009\n\nTo check the software version on your Apple Vision Pro,\nopen the Settings app and choose General \u003e About.\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmnDI2MACgkQ4Ifiq8DH\n7PWuKA//atH169ExbPVZu20"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:21:46Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/23"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Mar/23"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/126799"
        },
        {
          "url": "https://support.apple.com/kb/HT214009"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Mar/23"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-03-24-2026-8 visionOS 26.4",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-14524",
              "type": "related"
            },
            {
              "destId": "CVE-2025-64505",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20643",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20664",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20665",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20688",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20690",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20691",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20698",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28822",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28833",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28852",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28856",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28857",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28859",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28861",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28863",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28864",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28865",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28867",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28868",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28870",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28876",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28877",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28878",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28879",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28880",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28882",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28886",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0268",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/23",
            "automated": true,
            "contentSha256": "20e9b912111f3b35a48244cdf64fc36f210cee907383c22939324bb25a70f544",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/23",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-03-25T00:04:31Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0268"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:43Z",
    "dateUpdated": "2026-09-11T11:21:46Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0268"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0278

    Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-09 10:07
    VLAI
    Title
    APPLE-SA-04-22-2026-2 iOS 18.7.8 and iPadOS 18.7.8
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-04-22-2026-2 iOS 18.7.8 and iPadOS 18.7.8 iOS 18.7.8 and iPadOS 18.7.8 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/127003. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Notification Services Available for: iPhone XR, iPhone XS, iPhone XS Max, iPhone 11 (all models), iPhone SE (2nd generation), iPhone 12 (all models), iPhone 13 (all models), iPhone SE (3rd generation), iPhone 14 (all models), iPhone 15 (all models), iPhone 16 (all models), iPhone 16e, iPad mini (5th generation - A17 Pro), iPad (7th generation - A16), iPad Air (3rd - 5th generation), iPad Air 11-inch (M2 - M3), iPad Air 13-inch (M2 - M3), iPad Pro 11-inch (1st generation - M4), iPad Pro 12.9-inch (3rd - 6th generation), and iPad Pro 13-inch (M4) Impact: Notifications marked for deletion could be unexpectedly retained on the device Description: A logging issue was addressed with improved data redaction. CVE-2026-28950 This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 18.7.8 and iPadOS 18.7.8". All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmnpFugACgkQ4Ifiq8DH 7PViuQ/6A7fJLlPcOq4KCj9px9/OoFv6mVVDd1JIyll7ybiekv1JJ89aHY85mPCV aSChn/cEC3g/HS9d6dtYUINqQ1CWTLsQ6Ic7qW94+e0H2wlw/MzQpp+0BzqR1v7L H4loAeBJjcWfLTs1GMi4TonLPmDFJRvqPlPeowaStqOnhYRF5EygILSMQug0vfAt l8QJE3+ul1cssWuxUDO4RGmEeHcGZXyqg+adR5FG/K7r3FKIfE7xql5wxqjdYCO3 kfyg9phS1n0o9Wei6RUe5TzP7t0sBH68zcqrpHfr5WY4KtuMSil3qlqaok+KlA5k bst7vN643+ilEqp2hnkc0mKpj7QdEUn/F30xl6NUoW45s1oK9qZRrQpaQnDzrYt+ 3cCEnjpY9RTiobvE6U1PmriObIQwKxDTxQcRNeus/6hN8qHsowvW0AGrFm8HyhRC R6bdyXZPpyAtPa5NZmml9T3cj3ZAa1qhceamgBfGwpB96kebCShoErpa+e56Uy6z Rjbdz8J9Y+n3ogfNegiV8IFCo/x08x63xAqIMh+hKn786i04VCuGchfSI7PS8zMf t33BElZ4LeSWzjYvwWFzK2jyMJKaARA6gNP1QXcka3tdnMBw4O28iW4E3vZ2r6B8 AJdh0BSUP0APnwhVLmTYO7k/XUuQ3R6Xq2MpjU0yJ/XSWei62hU= =ETWt -----END PGP SIGNATURE----- _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Credits
    Apple Product Security via Fulldisclosure
    Relationships
    reference GCVE-1988-2026-0278 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "APPLE-SA-04-22-2026-2 iOS",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-04-22-2026-2 iOS 18.7.8 and iPadOS 18.7.8\n\niOS 18.7.8 and iPadOS 18.7.8 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/127003.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nNotification Services\nAvailable for: iPhone XR, iPhone XS, iPhone XS Max, iPhone 11 (all\nmodels), iPhone SE (2nd generation), iPhone 12 (all models), iPhone 13\n(all models), iPhone SE (3rd generation), iPhone 14 (all models), iPhone\n15 (all models), iPhone 16 (all models), iPhone 16e, iPad mini (5th\ngeneration - A17 Pro), iPad (7th generation - A16), iPad Air (3rd - 5th\ngeneration), iPad Air 11-inch (M2 - M3), iPad Air 13-inch (M2 - M3),\niPad Pro 11-inch (1st generation - M4), iPad Pro 12.9-inch (3rd - 6th\ngeneration), and iPad Pro 13-inch (M4)\nImpact: Notifications marked for deletion could be unexpectedly retained\non the device\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28950\n\nThis update is available through iTunes and Software Update on your iOS\ndevice, and will not appear in your computer\u0027s Software Update\napplication, or in the Apple Downloads site. Make sure you have an\nInternet connection and have installed the latest version of iTunes from\nhttps://www.apple.com/itunes/\n\niTunes and Software Update on the device will automatically check\nApple\u0027s update server on its weekly schedule. When an update is\ndetected, it is downloaded and the option to be installed is presented\nto the user when the iOS device is docked. We recommend applying the\nupdate immediately if possible. Selecting Don\u0027t Install will present the\noption the next time you connect your iOS device.\n\nThe automatic update process may take up to a week depending on the day\nthat iTunes or the device checks for updates. You may manually obtain\nthe update via the Check for Updates button within iTunes, or the\nSoftware Update on your device.\n\nTo check that the iPhone, iPod touch, or iPad has been updated:\n\n* Navigate to Settings\n* Select General\n* Select About. The version after applying this update\nwill be \"iOS 18.7.8 and iPadOS 18.7.8\".\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmnpFugACgkQ4Ifiq8DH\n7PViuQ/6A7fJLlPcOq4KCj9px9/OoFv6mVVDd1JIyll7ybiekv1JJ89aHY85mPCV\naSChn/cEC3g/HS9d6dtYUINqQ1CWTLsQ6Ic7qW94+e0H2wlw/MzQpp+0BzqR1v7L\nH4loAeBJjcWfLTs1GMi4TonLPmDFJRvqPlPeowaStqOnhYRF5EygILSMQug0vfAt\nl8QJE3+ul1cssWuxUDO4RGmEeHcGZXyqg+adR5FG/K7r3FKIfE7xql5wxqjdYCO3\nkfyg9phS1n0o9Wei6RUe5TzP7t0sBH68zcqrpHfr5WY4KtuMSil3qlqaok+KlA5k\nbst7vN643+ilEqp2hnkc0mKpj7QdEUn/F30xl6NUoW45s1oK9qZRrQpaQnDzrYt+\n3cCEnjpY9RTiobvE6U1PmriObIQwKxDTxQcRNeus/6hN8qHsowvW0AGrFm8HyhRC\nR6bdyXZPpyAtPa5NZmml9T3cj3ZAa1qhceamgBfGwpB96kebCShoErpa+e56Uy6z\nRjbdz8J9Y+n3ogfNegiV8IFCo/x08x63xAqIMh+hKn786i04VCuGchfSI7PS8zMf\nt33BElZ4LeSWzjYvwWFzK2jyMJKaARA6gNP1QXcka3tdnMBw4O28iW4E3vZ2r6B8\nAJdh0BSUP0APnwhVLmTYO7k/XUuQ3R6Xq2MpjU0yJ/XSWei62hU=\n=ETWt\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:07:12Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/15"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/15"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/en-us/127003"
        },
        {
          "url": "https://www.apple.com/itunes/"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/15"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-04-22-2026-2 iOS 18.7.8 and iPadOS 18.7.8",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-28950",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0278",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/15",
            "automated": true,
            "contentSha256": "4bfaf40b5e6c02c7b415569b9c9609e5a7421b9417248b2fe11cff6436a59dc0",
            "evidenceScore": 6,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/15",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-22T19:13:49Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0278"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:43Z",
    "dateUpdated": "2026-09-09T10:07:12Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0278"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0269

    Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-11 11:21
    VLAI
    Title
    APPLE-SA-03-24-2026-9 Safari 26.4
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-03-24-2026-9 Safari 26.4 Safari 26.4 addresses the following issues. Information about the security content is also available at https://support.apple.com/126800. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced Description: This issue was addressed through improved state management. WebKit Bugzilla: 304951 CVE-2026-20665: webb WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may bypass Same Origin Policy Description: A cross-origin issue in the Navigation API was addressed with improved input validation. WebKit Bugzilla: 306050 CVE-2026-20643: Thomas Espach WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Visiting a maliciously crafted website may lead to a cross-site scripting attack Description: A logic issue was addressed with improved checks. WebKit Bugzilla: 305859 CVE-2026-28871: @hamayanhamayan WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 306136 CVE-2026-20664: Daniel Rhea, Söhnke Benedikt Fischedick (Tripton), Emrovsky & Switch, Yevhen Pervushyn WebKit Bugzilla: 307723 CVE-2026-28857: Narcis Oliveras Fontàs, Söhnke Benedikt Fischedick (Tripton), Daniel Rhea, Nathaniel Oh (@calysteon) WebKit Available for: macOS Sonoma and macOS Sequoia Impact: A malicious website may be able to access script message handlers intended for other origins Description: A logic issue was addressed with improved state management. WebKit Bugzilla: 307014 CVE-2026-28861: Hongze Wu and Shuaike Dong from Ant Group Infrastructure Security Team WebKit Available for: macOS Sonoma and macOS Sequoia Impact: A malicious website may be able to process restricted web content outside the sandbox Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 308248 CVE-2026-28859: greenbynox, Arni Hardarson WebKit Sandboxing Available for: macOS Sonoma and macOS Sequoia Impact: A maliciously crafted webpage may be able to fingerprint the user Description: An authorization issue was addressed with improved state management. WebKit Bugzilla: 306827 CVE-2026-20691: Gongyu Ma (@Mezone0) Additional recognition Safari We would like to acknowledge @RenwaX23, Bikesh Parajuli, Farras Givari, Syarif Muhammad Sajjad, Yair for their assistance. Web Extensions We would like to acknowledge Carlos Jeurissen, Rob Wu (robwu.nl) for their assistance. WebKit We would like to acknowledge Vamshi Paili for their assistance. WebKit Process Model We would like to acknowledge Joseph Semaan for their assistance. Safari 26.4 may be obtained from the Mac App Store. All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmnDI3cACgkQ4Ifiq8DH 7PVxbhAAjKhMueqDcKyrInphYGj1a8Sop8rkiE/udJoWVtHMqalM9dRZ4xFdwgyC smpY8Zo3oGJpU52GAaXETErpRlreGc+SOjnEYiZBUphEgbYSDFsVS+n5+MJZPUq1 yNrpTl+UWrtQtAM8brKmhGGsalZpB23MgkhnpXe44iKEqfBui3KAOXBLcS/QX7Le hjQAJ7tTVuMQQR5FzQpEV0l3IOUfXtqTIc7MuNpBvZS39B3LOoECmyQ+Z3FXIFxR 1w+TKXURjPTF9Z5jGjONdTHMT2UCMfnE2ddXN5s+/sIfy9U0LZBx46YeX+OSbkkt +cSBKY/YIR+qmd/gQUy0taP5D1IPmhHpG35krvkG0/BCLoNeErXFoJ7xHrmRy+G2 FNpj1IevWYCx5oMw/3Nqd9iZ4fnORbPFvQhNwNYB2EUPsmVha6GZfN42YKir82SH jJi/OexQqcgTbiVdRj8IIYTGFeZWp+5ZBJTlRzq/nSJfOn92Y2mqEBPMkJRog0Qj 0HF5AyBBd2jDHxbHAn9C1xWnzDVQxtl4Hc/V8RFDrpBsRXLbonhtW3oPb6smY0de bqkch7wqyz9rSB1bcuHYlD8j2xUB8ssFT9A6+r0cpia+E2ZHyBXuw1NlBUgqTw3Z Ev3BI+dfPIL/EmJp2N9At0MEt4wIGUefuFlgAnINHj9DRroFktk= =5McV -----END PGP SIGNATURE----- _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Apple Safari Affected: unknown
    		Create a notification for this product.
    Credits
    Apple Product Security via Fulldisclosure
    Relationships
    reference GCVE-1988-2026-0269 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-03-24-2026-9 Safari 26.4\n\nSafari 26.4 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/126800.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may prevent Content\nSecurity Policy from being enforced\nDescription: This issue was addressed through improved state management.\nWebKit Bugzilla: 304951\nCVE-2026-20665: webb\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may bypass Same\nOrigin Policy\nDescription: A cross-origin issue in the Navigation API was addressed\nwith improved input validation.\nWebKit Bugzilla: 306050\nCVE-2026-20643: Thomas Espach\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Visiting a maliciously crafted website may lead to a cross-site\nscripting attack\nDescription: A logic issue was addressed with improved checks.\nWebKit Bugzilla: 305859\nCVE-2026-28871: @hamayanhamayan\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 306136\nCVE-2026-20664: Daniel Rhea, S\u00f6hnke Benedikt Fischedick (Tripton),\nEmrovsky \u0026 Switch, Yevhen Pervushyn\nWebKit Bugzilla: 307723\nCVE-2026-28857: Narcis Oliveras Font\u00e0s, S\u00f6hnke Benedikt Fischedick\n(Tripton), Daniel Rhea, Nathaniel Oh (@calysteon)\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: A malicious website may be able to access script message\nhandlers intended for other origins\nDescription: A logic issue was addressed with improved state management.\nWebKit Bugzilla: 307014\nCVE-2026-28861: Hongze Wu and Shuaike Dong from Ant Group Infrastructure\nSecurity Team\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: A malicious website may be able to process restricted web\ncontent outside the sandbox\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 308248\nCVE-2026-28859: greenbynox, Arni Hardarson\n\nWebKit Sandboxing\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: A maliciously crafted webpage may be able to fingerprint the\nuser\nDescription: An authorization issue was addressed with improved state\nmanagement.\nWebKit Bugzilla: 306827\nCVE-2026-20691: Gongyu Ma (@Mezone0)\n\nAdditional recognition\n\nSafari\nWe would like to acknowledge @RenwaX23, Bikesh Parajuli, Farras Givari,\nSyarif Muhammad Sajjad, Yair for their assistance.\n\nWeb Extensions\nWe would like to acknowledge Carlos Jeurissen, Rob Wu (robwu.nl) for\ntheir assistance.\n\nWebKit\nWe would like to acknowledge Vamshi Paili for their assistance.\n\nWebKit Process Model\nWe would like to acknowledge Joseph Semaan for their assistance.\n\nSafari 26.4 may be obtained from the Mac App Store.\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmnDI3cACgkQ4Ifiq8DH\n7PVxbhAAjKhMueqDcKyrInphYGj1a8Sop8rkiE/udJoWVtHMqalM9dRZ4xFdwgyC\nsmpY8Zo3oGJpU52GAaXETErpRlreGc+SOjnEYiZBUphEgbYSDFsVS+n5+MJZPUq1\nyNrpTl+UWrtQtAM8brKmhGGsalZpB23MgkhnpXe44iKEqfBui3KAOXBLcS/QX7Le\nhjQAJ7tTVuMQQR5FzQpEV0l3IOUfXtqTIc7MuNpBvZS39B3LOoECmyQ+Z3FXIFxR\n1w+TKXURjPTF9Z5jGjONdTHMT2UCMfnE2ddXN5s+/sIfy9U0LZBx46YeX+OSbkkt\n+cSBKY/YIR+qmd/gQUy0taP5D1IPmhHpG35krvkG0/BCLoNeErXFoJ7xHrmRy+G2\nFNpj1IevWYCx5oMw/3Nqd9iZ4fnORbPFvQhNwNYB2EUPsmVha6GZfN42YKir82SH\njJi/OexQqcgTbiVdRj8IIYTGFeZWp+5ZBJTlRzq/nSJfOn92Y2mqEBPMkJRog0Qj\n0HF5AyBBd2jDHxbHAn9C1xWnzDVQxtl4Hc/V8RFDrpBsRXLbonhtW3oPb6smY0de\nbqkch7wqyz9rSB1bcuHYlD8j2xUB8ssFT9A6+r0cpia+E2ZHyBXuw1NlBUgqTw3Z\nEv3BI+dfPIL/EmJp2N9At0MEt4wIGUefuFlgAnINHj9DRroFktk=\n=5McV\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:21:48Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/24"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Mar/24"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/126800"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Mar/24"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-03-24-2026-9 Safari 26.4",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-20643",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20664",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20665",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20691",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28857",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28859",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28861",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28871",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0269",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/24",
            "automated": true,
            "contentSha256": "3cb7d7738605c9097be4ae8881d21805fe4bdabbfdfc7ad5b531d3c35274c32d",
            "evidenceScore": 6,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/24",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-03-25T00:04:55Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0269"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:43Z",
    "dateUpdated": "2026-09-11T11:21:48Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0269"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}