Vulnerability Disclosure Archive

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Tvos",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-05-11-2026-9 tvOS 26.5\n\ntvOS 26.5 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/127118.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccelerate\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-28991: Seiji Sakurai (@HeapSmasher)\n\nAPFS\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28959: Dave G.\n\nApp Intents\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A logic issue was addressed with improved restrictions.\nCVE-2026-28995: Vamshi Paili, Tony Gorez (@tonygo_) for Reverse Society\n\nAppleJPEG\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted image may lead to a\ndenial-of-service\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-1837\n\nAppleJPEG\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted media file may lead to\nunexpected app termination or corrupt process memory\nDescription: A memory corruption issue was addressed with improved input\nvalidation.\nCVE-2026-28956: impost0r (ret2plt)\n\nAudio\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-39869: David Ige of Beryllium Security\n\nCoreSymbolication\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Parsing a maliciously crafted file may lead to an unexpected app\ntermination\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-28918: Niels Hofmans, Anonymous working with TrendAI Zero Day\nInitiative\n\nImageIO\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: A buffer overflow issue was addressed with improved memory\nhandling.\nCVE-2026-43661: an anonymous researcher\n\nImageIO\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-28977: Suresh Sundaram\n\nImageIO\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-28990: Jiri Ha, Arni Hardarson\n\nIOHIDFamily\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An attacker may be able to cause unexpected app termination\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nCVE-2026-28992: Johnny Franks (@zeroxjf)\n\nIOHIDFamily\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to determine kernel memory layout\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28943: Google Threat Analysis Group\n\nIOKit\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28969: Mihalis Haatainen, Ari Hawking, Ashish Kunwar\n\nIOSurfaceAccelerator\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination or\nread kernel memory\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43655: Somair Ansar and an anonymous researcher\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43654: Vaagn Vardanian, Nathaniel Oh (@calysteon)\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: A local user may be able to cause unexpected system termination\nor read kernel memory\nDescription: A buffer overflow was addressed with improved input\nvalidation.\nCVE-2026-28897: popku1337, Billy Jheng Bing Jhong and Pan Zhenpeng\n(@Peterpan0927) of STAR Labs SG Pte. Ltd., Robert Tran, Aswin kumar\nGokulakannan\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\ninput validation.\nCVE-2026-28972: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with additional validation.\nCVE-2026-28986: Chris Betz, Tristan Madani (@TristanInSec) from Talence\nSecurity, Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to leak sensitive kernel state\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28987: Dhiyanesh Selvaraj (@redroot97)\n\nLaunchServices\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: A remote attacker may be able to cause a denial of service\nDescription: A type confusion issue was addressed with improved checks.\nCVE-2026-28983: Ruslan Dautov\n\nmDNSResponder\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An attacker on the local network may be able to cause a\ndenial-of-service\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43653: Atul R V\n\nmDNSResponder\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An attacker on the local network may be able to cause a\ndenial-of-service\nDescription: A null pointer dereference was addressed with improved\ninput validation.\nCVE-2026-28985: Omar Cerrito\n\nmDNSResponder\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: A remote attacker may be able to cause unexpected system\ntermination or corrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43668: Anton Pakhunov, Ricardo Prado\n\nmDNSResponder\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An attacker on the local network may be able to cause a\ndenial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43666: Ian van der Wurff (ian.nl)\n\nModel I/O\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-28940: Michael DePlante (@izobashi) of TrendAI Zero Day\nInitiative\n\nSceneKit\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: A remote attacker may be able to cause unexpected app\ntermination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28846: Peter Malone\n\nSpotlight\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause a denial-of-service\nDescription: This issue was addressed with improved checks to prevent\nunauthorized actions.\nCVE-2026-28974: Andy Koo (@andykoo) of Hexens\n\nStorage\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with additional validation.\nCVE-2026-28996: Alex Radocea\n\nWebKit\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing maliciously crafted web content may prevent Content\nSecurity Policy from being enforced\nDescription: A validation issue was addressed with improved logic.\nWebKit Bugzilla: 308906\nCVE-2026-43660: Cantina\n\nWebKit\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing maliciously crafted web content may prevent Content\nSecurity Policy from being enforced\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 308675\nCVE-2026-28907: Cantina\n\nWebKit\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 307669\nCVE-2026-43658: Do Young Park\n\nWebKit\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 308545\nCVE-2026-28905: Yuhao Hu, Yuanming Lai, Chenggang Wu, and Zhe Wang\nWebKit Bugzilla: 308707\nCVE-2026-28847: DARKNAVY (@DarkNavyOrg), Anonymous working with TrendAI\nZero Day Initiative, Daniel Rhea\nWebKit Bugzilla: 309601\nCVE-2026-28904: Luka Ra\u010dki\nWebKit Bugzilla: 310880\nCVE-2026-28955: wac and Kookhwan Lee working with TrendAI Zero Day\nInitiative\nWebKit Bugzilla: 310303\nCVE-2026-28903: Mateusz Krzywicki (iVerify.io)\nWebKit Bugzilla: 309628\nCVE-2026-28953: Maher Azzouzi\nWebKit Bugzilla: 309861\nCVE-2026-28902: Tristan Madani (@TristanInSec) from Talence Security,\nNathaniel Oh (@calysteon)\nWebKit Bugzilla: 310207\nCVE-2026-28901: Aisle offensive security research team (Joshua Rogers,\nLuigino Camastra, Igor Morgenstern, and Guido Vranken), Maher Azzouzi,\nNgan Nguyen of Calif.io\nWebKit Bugzilla: 311631\nCVE-2026-28913: an anonymous researcher\n\nWebKit\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313939\nCVE-2026-28883: kwak kiyong / kakaogames\n\nWebKit\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 310527\nCVE-2026-28917: Vitaly Simonovich\n\nWebKit\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 310234\nCVE-2026-28947: dr3dd\nWebKit Bugzilla: 312180\nCVE-2026-28942: Milad Nasr and Nicholas Carlini with Claude, Anthropic\n\nWi-Fi\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An attacker in a privileged network position may be able to\nperform denial-of-service attack using crafted Wi-Fi packets\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28994: Alex Radocea\n\nzlib\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Visiting a maliciously crafted website may leak sensitive data\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-28920: Brendon Tiszka of Google Project Zero\n\nAdditional recognition\n\nApp Intents\nWe would like to acknowledge Mikael Kinnman for their assistance.\n\nApple Account\nWe would like to acknowledge Iv\u00e1n Savransky, YingQi Shi (@Mas0nShi) of\nDBAppSecurity\u0027s WeBin lab for their assistance.\n\nAuthKit\nWe would like to acknowledge Gongyu Ma (@Mezone0) for their assistance.\n\nCoreUI\nWe would like to acknowledge Mustafa Calap \u200b fo"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:28:28Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/13"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/13"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/en-us/127118"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/13"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-05-11-2026-9 tvOS 26.5",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-1837",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28846",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28847",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28883",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28897",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28901",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28902",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28903",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28904",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28905",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28907",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28913",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28917",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28918",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28920",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28940",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28942",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28943",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28947",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28953",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28955",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28956",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28959",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28969",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28972",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28974",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28977",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28983",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28985",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28986",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28987",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28990",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28991",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28992",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28994",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28995",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28996",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39869",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43653",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43654",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43655",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43658",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43660",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43661",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43666",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43668",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0336",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/13",
            "automated": true,
            "contentSha256": "d2601279c96ad136c02829f670d7529562d8d9e35fc443c95372b638a08471bb",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/13",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-11T22:34:23Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0336"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:56Z",
    "dateUpdated": "2026-09-11T11:28:28Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0336"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

URL	Tags
https://vuln.freearchive.org/archive/full-disclos…	technical-description
https://seclists.org/fulldisclosure/2026/May/2	technical-description
https://documentation.open-xchange.com/dovecot/se…
https://nmap.org/mailman/listinfo/fulldisclosure
https://seclists.org/fulldisclosure/

URL	Tags
https://vuln.freearchive.org/archive/full-disclos…	technical-description
https://seclists.org/fulldisclosure/2026/Apr/12	technical-description
https://karmainsecurity.com/KIS-2026-08
https://karmainsecurity.com/pocs/CVE-2026-41460.php
https://nmap.org/mailman/listinfo/fulldisclosure
https://seclists.org/fulldisclosure/
https://socialengine.com

URL	Tags
https://vuln.freearchive.org/archive/full-disclos…	technical-description
https://seclists.org/fulldisclosure/2026/Apr/11	technical-description
https://karmainsecurity.com/KIS-2026-07
https://nmap.org/mailman/listinfo/fulldisclosure
https://seclists.org/fulldisclosure/
https://socialengine.com

URL	Tags
https://vuln.freearchive.org/archive/full-disclos…	technical-description
https://seclists.org/fulldisclosure/2026/Apr/1	technical-description
https://karmainsecurity.com/KIS-2026-06
https://karmainsecurity.com/pocs/CVE-2026-29014.php
https://nmap.org/mailman/listinfo/fulldisclosure
https://seclists.org/fulldisclosure/
https://www.metinfo.cn

URL	Tags
https://vuln.freearchive.org/archive/full-disclos…	technical-description
https://seclists.org/fulldisclosure/2026/Apr/0	technical-description
https://github.com/coreruleset/coreruleset/securi…
https://nmap.org/mailman/listinfo/fulldisclosure
https://seclists.org/fulldisclosure/

Vulnerability Disclosure Archive

Recent vulnerabilities

GCVE-1988-2026-0336

GCVE-1988-2026-0335

GCVE-1988-2026-0334

GCVE-1988-2026-0333

GCVE-1988-2026-0330

GCVE-1988-2026-0253

GCVE-1988-2026-0245

GCVE-1988-2026-0244

GCVE-1988-2026-0274

GCVE-1988-2026-0239