{"vulnerability": "cve-2026-4366", "sightings": [{"uuid": "ebd20586-1ac7-48de-a4ce-caa66a756010", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-4366", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-4366", "content": "", "creation_timestamp": "2026-03-18T03:17:32.000000Z"}, {"uuid": "582874cb-4e6b-4da0-bccb-a89c74e113e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43668", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "1d8d6ab9-4278-4c87-8a40-a38431b41ddf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43661", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "231647c7-17f2-4f3d-b173-ff896214d39c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43666", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "a451bece-ca05-4cd1-90b9-77d9bac4266f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43660", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "ee1a5f25-cbef-4d90-9cad-889a43d65a13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43668", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116564076458296508", "content": "A lot of offensive activities were identified targeting Apple iOS and other products (CVE-2026-43668) https://vuldb.com/vuln/362861/cti", "creation_timestamp": "2026-05-12T22:57:40.123912Z"}, {"uuid": "f92c9333-aee1-413f-af56-57f2f52f8d1c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-43661", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "905bc8c3-d2c6-49b9-9bd3-147200344e6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-43666", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "470ba4b8-7b58-4ff4-aa27-22c4ebd5faff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-43668", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "d9b1ca61-4917-4a0d-8a55-f4eaa7b6d1c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-43660", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "ab605161-45ba-4c0f-aa9b-6b6e472ecc2f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-43660", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "0f8725c6-3437-4c90-9c06-6ff583aa99c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-43661", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "4111349d-b0cf-481b-989f-676c53da1b83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-43666", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "74f4f71e-aa21-46f6-8486-d198b71c00ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-43668", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "41e5d002-dbe8-483d-80c8-59364d08058a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-43666", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "e8352140-d6c5-4172-8306-c48f009158da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-43660", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "9144417c-1711-4ebf-b5f5-9ebff921757d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-43668", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "60648e17-379f-452e-81ca-d62da304916c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-43661", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "e451caee-9634-4cc9-987b-f1cb5fcd926e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43663", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mphnzlvy332q", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-43663: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/D7E9A055-0FD0-42C6-A816-BE44445CD978", "creation_timestamp": "2026-06-29T23:41:25.836577Z"}, {"uuid": "21954c79-9f90-4842-8a3f-cd726077d9d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43663", "type": "seen", "source": "https://bsky.app/profile/geeknik.bsky.social/post/3mpjwienisy2d", "content": "Sweet. Got I tagged in CVE-2026-43663 by Apple. \ud83e\udd77 \n\nsupport.apple.com/en... \nsupport.apple.com/en...", "creation_timestamp": "2026-06-30T21:18:11.251521Z"}, {"uuid": "1a7fc73f-f291-4e9f-b6bb-1a032a066afb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-43663", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0818", "content": "", "creation_timestamp": "2026-07-01T02:51:13.570543Z"}, {"uuid": "a5546d70-d679-4ca6-8689-f2eebc69b1a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43663", "type": "seen", "source": "https://www.thezdi.com/blog/2026/6/30/the-june-2026-apple-security-update-review", "content": "We\u2019re back with our look at the Apple macOS and iOS security updates. As this is a new feature for us, please let us know your feedback on the blog. \nFor Jun 2026, Apple released 37 unique CVEs across iOS 26.5.2 / iPadOS 26.5.2, macOS Tahoe 26.5.2, Safari 26.5.2. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. The overwhelming majority (31 of 37) are WebKit/WebRTC bugs reachable through malicious web content. Most of those are crash/DoS bugs rather than code execution, so the real risk lives in the small set of kernel bugs and the handful of WebKit sandbox escapes. However, there are a couple that stand out.\n-    CVE-2026-43724 (Kernel) \u2013 According to Apple, \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d A kernel memory write is the highest-value primitive here: it's the privilege-escalation half of a full exploit chain and leads to complete device control. The bug was credited to Hyunwoo Kim (@v4bel), who is known to be a serious kernel researcher. \n-    CVE-2026-39868 (Kernel) \u2013 Another kernel bug, this one could \u201ccause unexpected system termination or corrupt kernel memory.\u201d This is kernel memory corruption, and notably credited to a roster of elite offensive researchers (STAR Labs, Positive Technologies, Baidu Security). This kind of attribution usually signals a weaponizable, possibly Pwn2Own-grade bug rather than a theoretical crash.\n-    CVE-2026-43725 / CVE-2026-43701 (WebKit) \u2013 Apple states these bugs could allow a website to process restricted web content outside the sandbox. I'm flagging this sandbox-escape pair over the many WebKit crash bugs because a sandbox escape is the bridge that turns a web-content bug into a path toward the kernel issues above. It's the most dangerous remotely-triggered class in the release.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Update – June 29, 2026\n\n\n\n  \n    \n      37Total CVEs\n      22Denial of Service\n      7Information Disclosure\n      3Memory Corruption\n      2Elevation of Privilege\n      2Sandbox Escape\n      1Spoofing\n    \n\n    \n\n      Apple security release — June 29, 2026. \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS 26.5.2 / iPadOS 26.5.2\n          macOS Tahoe 26.5.2\n          Safari 26.5.2\n        \n      \n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        Yes\n        Yes\n        No\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        Yes\n        Yes\n        No\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        Yes\n        Yes\n        No\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        Yes\n        Yes\n        No\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        No\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        No\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43716\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43746\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        Yes\n        Yes\n        Yes\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-01T16:00:59.174408Z"}, {"uuid": "ba5592c7-3b93-4902-b7cc-f6051e4c04be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43663", "type": "seen", "source": "https://www.thezdi.com/blog/2026/6/30/the-june-2026-apple-security-update-review", "content": "We\u2019re back with our look at the Apple macOS and iOS security updates. As this is a new feature for us, please let us know your feedback on the blog. \nFor Jun 2026, Apple released 37 unique CVEs across iOS 26.5.2 / iPadOS 26.5.2, macOS Tahoe 26.5.2, Safari 26.5.2. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. The overwhelming majority (31 of 37) are WebKit/WebRTC bugs reachable through malicious web content. Most of those are crash/DoS bugs rather than code execution, so the real risk lives in the small set of kernel bugs and the handful of WebKit sandbox escapes. However, there are a couple that stand out.\n-    CVE-2026-43724 (Kernel) \u2013 According to Apple, \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d A kernel memory write is the highest-value primitive here: it's the privilege-escalation half of a full exploit chain and leads to complete device control. The bug was credited to Hyunwoo Kim (@v4bel), who is known to be a serious kernel researcher. \n-    CVE-2026-39868 (Kernel) \u2013 Another kernel bug, this one could \u201ccause unexpected system termination or corrupt kernel memory.\u201d This is kernel memory corruption, and notably credited to a roster of elite offensive researchers (STAR Labs, Positive Technologies, Baidu Security). This kind of attribution usually signals a weaponizable, possibly Pwn2Own-grade bug rather than a theoretical crash.\n-    CVE-2026-43725 / CVE-2026-43701 (WebKit) \u2013 Apple states these bugs could allow a website to process restricted web content outside the sandbox. I'm flagging this sandbox-escape pair over the many WebKit crash bugs because a sandbox escape is the bridge that turns a web-content bug into a path toward the kernel issues above. It's the most dangerous remotely-triggered class in the release.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Update – June 29, 2026\n\n\n\n  \n    \n      37Total CVEs\n      22Denial of Service\n      7Information Disclosure\n      3Memory Corruption\n      2Elevation of Privilege\n      2Sandbox Escape\n      1Spoofing\n    \n\n    \n\n      Apple security release — June 29, 2026. \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS 26.5.2 / iPadOS 26.5.2\n          macOS Tahoe 26.5.2\n          Safari 26.5.2\n        \n      \n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        Yes\n        Yes\n        No\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        Yes\n        Yes\n        No\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        Yes\n        Yes\n        No\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        Yes\n        Yes\n        No\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        No\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        No\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43716\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43746\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        Yes\n        Yes\n        Yes\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-02T01:00:42.996506Z"}]}