GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Organization

Vulnerability Disclosure Archive

GNA-1988
GNA identifier
GNA-1988 GCVE registry Recent publications
Registered on 2026-09-04, last updated on 2026-09-10.

Recent vulnerabilities

387 GCVE records assigned by this organization as GNA-1988

GCVE-1988-2026-0301

Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-11 11:48
VLAI
Title
APPLE-SA-08-06-2026-3 macOS Sonoma 14.8.9
Summary
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-06-2026-3 macOS Sonoma 14.8.9 macOS Sonoma 14.8.9 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/148172. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Screen Sharing Available for: macOS Sonoma Impact: An attacker on the network may be able to authenticate to Screen Sharing without valid credentials Description: An authentication issue was addressed with improved state management. CVE-2026-65400: Alfredo Pesoli (@__rev) via Bynario Atlas (bynar.io) macOS Sonoma 14.8.9 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmp0398ACgkQ4Ifiq8DH 7PWKMBAAvu5xxYJxYrHC6Oj94mG6HrnUKB65O7T36D022gyXCWYCyQW1zeMRPpNZ 6UlYiVQ4VJ211Ycgk8DWMqe3Z/slaoyF1sBk7kchBDu4Uu+cNB1YpvCskYFkVSJu CS0CekYlsAjedz69+Q9OfwtccVyfg1pECt8SiTN1aGJwqyD1WamJt+/cxWD3Vwby xnsjk8/7balvtsNihbGgrt63145pCBNd5h/51731cLv1c5AOA5Yj3uShbRcnDf/f WyKl2ADehEaRd0Fm/Curc5d2h2Ca6LNtpKcsvTPvCzudqW/UItJ+E+b4LJTDmY/P H5/Vgwv2O9cxZDE7hc4i8HomhPAgIMceqv/Of+qA49Nee6ksxvsaUPketxQ59XVS jm3ZNOasRohb4puIKKbS3kAyo0+3CTAPMWG8a/mwSo0vdBfue9wk3Mfr0tNiW2dP 8VeBueXF4aMfxXqy8TFruo3eO68XwsE7Qzt5TX8kKlHmq7j76CO6ewohzPES8AYS 5tjPWVHKBIzT7qhO7IqVqNl1WlDlxHs8sROxT9/s9GAZctxzI7oonmChXVTECwN1 TXHc5jd1QlwY7zKN5sBN84xMv43bzf19/h2IPJdmYGX5aBs8WyteGFvQQSxOCOlf pLlLXhaWg0eBom3v9H/+vhkmEBU1ax9gMhxbmqS68PK3r2swecE= =XrU0 -----END PGP SIGNATURE----- _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Apple Macos Sonoma Affected: unknown
Create a notification for this product.
Credits
Apple Product Security via Fulldisclosure
Relationships
reference GCVE-1988-2026-0301 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Macos Sonoma",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-08-06-2026-3 macOS Sonoma 14.8.9\n\nmacOS Sonoma 14.8.9 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/148172.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nScreen Sharing\nAvailable for: macOS Sonoma\nImpact: An attacker on the network may be able to authenticate to Screen\nSharing without valid credentials\nDescription: An authentication issue was addressed with improved state\nmanagement.\nCVE-2026-65400: Alfredo Pesoli (@__rev) via Bynario Atlas (bynar.io)\n\nmacOS Sonoma 14.8.9 may be obtained from the Mac App Store or Apple\u0027s\nSoftware Downloads web site: https://support.apple.com/downloads/\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmp0398ACgkQ4Ifiq8DH\n7PWKMBAAvu5xxYJxYrHC6Oj94mG6HrnUKB65O7T36D022gyXCWYCyQW1zeMRPpNZ\n6UlYiVQ4VJ211Ycgk8DWMqe3Z/slaoyF1sBk7kchBDu4Uu+cNB1YpvCskYFkVSJu\nCS0CekYlsAjedz69+Q9OfwtccVyfg1pECt8SiTN1aGJwqyD1WamJt+/cxWD3Vwby\nxnsjk8/7balvtsNihbGgrt63145pCBNd5h/51731cLv1c5AOA5Yj3uShbRcnDf/f\nWyKl2ADehEaRd0Fm/Curc5d2h2Ca6LNtpKcsvTPvCzudqW/UItJ+E+b4LJTDmY/P\nH5/Vgwv2O9cxZDE7hc4i8HomhPAgIMceqv/Of+qA49Nee6ksxvsaUPketxQ59XVS\njm3ZNOasRohb4puIKKbS3kAyo0+3CTAPMWG8a/mwSo0vdBfue9wk3Mfr0tNiW2dP\n8VeBueXF4aMfxXqy8TFruo3eO68XwsE7Qzt5TX8kKlHmq7j76CO6ewohzPES8AYS\n5tjPWVHKBIzT7qhO7IqVqNl1WlDlxHs8sROxT9/s9GAZctxzI7oonmChXVTECwN1\nTXHc5jd1QlwY7zKN5sBN84xMv43bzf19/h2IPJdmYGX5aBs8WyteGFvQQSxOCOlf\npLlLXhaWg0eBom3v9H/+vhkmEBU1ax9gMhxbmqS68PK3r2swecE=\n=XrU0\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:48:27Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/36"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/36"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/downloads/"
        },
        {
          "url": "https://support.apple.com/en-us/148172"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/36"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-08-06-2026-3 macOS Sonoma 14.8.9",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-65400",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0301",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/36",
            "automated": true,
            "contentSha256": "016461bdaf6fbe1eace4507eae57efa6bca93c0328b1afdd3bf1e17926f2361b",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/36",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-06T21:40:59Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0301"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:48Z",
    "dateUpdated": "2026-09-11T11:48:27Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0301"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0101

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:48
VLAI
Title
APPLE-SA-08-06-2026-3 macOS Sonoma 14.8.9
Summary
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-06-2026-3 macOS Sonoma 14.8.9 macOS Sonoma 14.8.9 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/148172. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Screen Sharing Available for: macOS Sonoma Impact: An attacker on the network may be able to authenticate to Screen Sharing without valid credentials Description: An authentication issue was addressed with improved state management. CVE-2026-65400: Alfredo Pesoli (@__rev) via Bynario Atlas (bynar.io) macOS Sonoma 14.8.9 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmp0398ACgkQ4Ifiq8DH 7PWKMBAAvu5xxYJxYrHC6Oj94mG6HrnUKB65O7T36D022gyXCWYCyQW1zeMRPpNZ 6UlYiVQ4VJ211Ycgk8DWMqe3Z/slaoyF1sBk7kchBDu4Uu+cNB1YpvCskYFkVSJu CS0CekYlsAjedz69+Q9OfwtccVyfg1pECt8SiTN1aGJwqyD1WamJt+/cxWD3Vwby xnsjk8/7balvtsNihbGgrt63145pCBNd5h/51731cLv1c5AOA5Yj3uShbRcnDf/f WyKl2ADehEaRd0Fm/Curc5d2h2Ca6LNtpKcsvTPvCzudqW/UItJ+E+b4LJTDmY/P H5/Vgwv2O9cxZDE7hc4i8HomhPAgIMceqv/Of+qA49Nee6ksxvsaUPketxQ59XVS jm3ZNOasRohb4puIKKbS3kAyo0+3CTAPMWG8a/mwSo0vdBfue9wk3Mfr0tNiW2dP 8VeBueXF4aMfxXqy8TFruo3eO68XwsE7Qzt5TX8kKlHmq7j76CO6ewohzPES8AYS 5tjPWVHKBIzT7qhO7IqVqNl1WlDlxHs8sROxT9/s9GAZctxzI7oonmChXVTECwN1 TXHc5jd1QlwY7zKN5sBN84xMv43bzf19/h2IPJdmYGX5aBs8WyteGFvQQSxOCOlf pLlLXhaWg0eBom3v9H/+vhkmEBU1ax9gMhxbmqS68PK3r2swecE= =XrU0 -----END PGP SIGNATURE----- _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Apple Macos Sonoma Affected: unknown
Create a notification for this product.
Credits
Apple Product Security via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Macos Sonoma",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-08-06-2026-3 macOS Sonoma 14.8.9\n\nmacOS Sonoma 14.8.9 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/148172.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nScreen Sharing\nAvailable for: macOS Sonoma\nImpact: An attacker on the network may be able to authenticate to Screen\nSharing without valid credentials\nDescription: An authentication issue was addressed with improved state\nmanagement.\nCVE-2026-65400: Alfredo Pesoli (@__rev) via Bynario Atlas (bynar.io)\n\nmacOS Sonoma 14.8.9 may be obtained from the Mac App Store or Apple\u0027s\nSoftware Downloads web site: https://support.apple.com/downloads/\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmp0398ACgkQ4Ifiq8DH\n7PWKMBAAvu5xxYJxYrHC6Oj94mG6HrnUKB65O7T36D022gyXCWYCyQW1zeMRPpNZ\n6UlYiVQ4VJ211Ycgk8DWMqe3Z/slaoyF1sBk7kchBDu4Uu+cNB1YpvCskYFkVSJu\nCS0CekYlsAjedz69+Q9OfwtccVyfg1pECt8SiTN1aGJwqyD1WamJt+/cxWD3Vwby\nxnsjk8/7balvtsNihbGgrt63145pCBNd5h/51731cLv1c5AOA5Yj3uShbRcnDf/f\nWyKl2ADehEaRd0Fm/Curc5d2h2Ca6LNtpKcsvTPvCzudqW/UItJ+E+b4LJTDmY/P\nH5/Vgwv2O9cxZDE7hc4i8HomhPAgIMceqv/Of+qA49Nee6ksxvsaUPketxQ59XVS\njm3ZNOasRohb4puIKKbS3kAyo0+3CTAPMWG8a/mwSo0vdBfue9wk3Mfr0tNiW2dP\n8VeBueXF4aMfxXqy8TFruo3eO68XwsE7Qzt5TX8kKlHmq7j76CO6ewohzPES8AYS\n5tjPWVHKBIzT7qhO7IqVqNl1WlDlxHs8sROxT9/s9GAZctxzI7oonmChXVTECwN1\nTXHc5jd1QlwY7zKN5sBN84xMv43bzf19/h2IPJdmYGX5aBs8WyteGFvQQSxOCOlf\npLlLXhaWg0eBom3v9H/+vhkmEBU1ax9gMhxbmqS68PK3r2swecE=\n=XrU0\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:48:27Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/36"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/36"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/downloads/"
        },
        {
          "url": "https://support.apple.com/en-us/148172"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/36"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-08-06-2026-3 macOS Sonoma 14.8.9",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0101",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/36",
            "automated": true,
            "contentSha256": "016461bdaf6fbe1eace4507eae57efa6bca93c0328b1afdd3bf1e17926f2361b",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/36",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-06T21:40:59Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:48:27Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0101"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0287

Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-11 11:48
VLAI
Title
[KIS-2026-13] vBulletin <= 6.2.1 (runMaths) Remote Code Execution Vulnerability
Summary
----------------------------------------------------------------- vBulletin <= 6.2.1 (runMaths) Remote Code Execution Vulnerability ----------------------------------------------------------------- [-] Software Link: https://www.vbulletin.com [-] Affected Versions: Version 5.7.5 and prior 5.x versions. Version 6.2.1 and prior 6.x versions. [-] Vulnerability Description: The vulnerable code is located within the /includes/vb5/template/runtime.php script. Specifically, into the vB5_Template_Runtime::runMaths() method: the $str parameter is not sufficiently sanitized before being used in an eval() call. The regex used to validate the input parameter will filter the string only allowing for digits, parentheses, math and binary operators (the XOR, particularly). As such, this can be exploited to inject and execute (semi) arbitrary PHP code through "phpfuck" techniques. The vulnerability could be exploited by e.g. administrator users, by editing a template/style in the admin panel and adding a specially crafted {vb:math} tag (which is a sort of wrapper around the vB5_Template_Runtime::runMaths() method). However, this can also be exploited by unauthenticated attackers by abusing the ajax/render/[template] route, rendering a template which uses the {vb:math} tag with an user-tainted parameter. One of the possible templates that can be abused that way is the default "pagenav" template: here, user input passed through the "pagenav[pagenumber]" parameter will be assigned to the "pagenav.currentpage" template variable, which is later used within a {vb:math} tag, thus passed to the vB5_Template_Runtime::runMaths() method, which in turn will pass this string to eval(), eventually resulting in execution of (semi) arbitrary PHP code on the web server. [-] Proof of Concept: https://karmainsecurity.com/pocs/CVE-2026-61511.php [-] Solution: Apply the vendor patch or upgrade to version 6.2.2 or later. [-] Disclosure Timeline: [25/06/2026] - Vendor was notified by SSD Secure Disclosure [30/06/2026] - Vendor released security patch to address this issue: https://tinyurl.com/vb-patch [01/07/2026] - Vendor released version 6.2.2: https://tinyurl.com/vb-622 [13/07/2026] - CVE identifier requested [13/07/2026] - CVE identifier assigned [27/07/2026] - Public disclosure [-] CVE Reference: CVE-2026-61511 has been assigned to this vulnerability. [-] Credits: Vulnerability discovered by Egidio Romano. [-] Original Advisory: https://karmainsecurity.com/KIS-2026-13 [-] Other References: https://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/ _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
vBulletin vBulletin Affected: unknown
Create a notification for this product.
Credits
Egidio Romano
Relationships
reference GCVE-1988-2026-0287 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "vBulletin",
          "vendor": "vBulletin",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Egidio Romano"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----------------------------------------------------------------\nvBulletin \u003c= 6.2.1 (runMaths) Remote Code Execution Vulnerability\n-----------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.vbulletin.com\n\n\n[-] Affected Versions:\n\nVersion 5.7.5 and prior 5.x versions.\nVersion 6.2.1 and prior 6.x versions.\n\n\n[-] Vulnerability Description:\n\nThe vulnerable code is located within the\n/includes/vb5/template/runtime.php script. Specifically, into the\nvB5_Template_Runtime::runMaths() method: the $str parameter is not\nsufficiently sanitized before being used in an eval() call. The regex used\nto validate the input parameter will filter the string only allowing for\ndigits, parentheses, math and binary operators (the XOR, particularly). As\nsuch, this can be exploited to inject and execute (semi) arbitrary PHP code\nthrough \"phpfuck\" techniques. The vulnerability could be exploited by e.g.\nadministrator users, by editing a template/style in the admin panel and\nadding a specially crafted {vb:math} tag (which is a sort of wrapper around\nthe vB5_Template_Runtime::runMaths() method). However, this can also be\nexploited by unauthenticated attackers by abusing the\najax/render/[template] route, rendering a template which uses the {vb:math}\ntag with an user-tainted parameter. One of the possible templates that can\nbe abused that way is the default \"pagenav\" template: here, user input\npassed through the \"pagenav[pagenumber]\" parameter will be assigned to the\n\"pagenav.currentpage\" template variable, which is later used within a\n{vb:math} tag, thus passed to the vB5_Template_Runtime::runMaths() method,\nwhich in turn will pass this string to eval(), eventually resulting in\nexecution of (semi) arbitrary PHP code on the web server.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/CVE-2026-61511.php\n\n\n[-] Solution:\n\nApply the vendor patch or upgrade to version 6.2.2 or later.\n\n\n[-] Disclosure Timeline:\n\n[25/06/2026] - Vendor was notified by SSD Secure Disclosure\n[30/06/2026] - Vendor released security patch to address this issue:\nhttps://tinyurl.com/vb-patch\n[01/07/2026] - Vendor released version 6.2.2: https://tinyurl.com/vb-622\n[13/07/2026] - CVE identifier requested\n[13/07/2026] - CVE identifier assigned\n[27/07/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nCVE-2026-61511 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-13\n\n\n[-] Other References:\n\nhttps://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:48:05Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/29"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/29"
        },
        {
          "url": "https://karmainsecurity.com/KIS-2026-13"
        },
        {
          "url": "https://karmainsecurity.com/pocs/CVE-2026-61511.php"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/"
        },
        {
          "url": "https://tinyurl.com/vb-622"
        },
        {
          "url": "https://tinyurl.com/vb-patch"
        },
        {
          "url": "https://www.vbulletin.com"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/29"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[KIS-2026-13] vBulletin \u003c= 6.2.1 (runMaths) Remote Code Execution Vulnerability",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-61511",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0287",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/29",
            "automated": true,
            "contentSha256": "f552a77da0b58d8b73f63dd07d383c31adfeb589892e4c5dc3324e305eb50047",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/29",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-27T11:04:04Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0287"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:45Z",
    "dateUpdated": "2026-09-11T11:48:05Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0287"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0038

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:48
VLAI
Title
[KIS-2026-13] vBulletin <= 6.2.1 (runMaths) Remote Code Execution Vulnerability
Summary
----------------------------------------------------------------- vBulletin <= 6.2.1 (runMaths) Remote Code Execution Vulnerability ----------------------------------------------------------------- [-] Software Link: https://www.vbulletin.com [-] Affected Versions: Version 5.7.5 and prior 5.x versions. Version 6.2.1 and prior 6.x versions. [-] Vulnerability Description: The vulnerable code is located within the /includes/vb5/template/runtime.php script. Specifically, into the vB5_Template_Runtime::runMaths() method: the $str parameter is not sufficiently sanitized before being used in an eval() call. The regex used to validate the input parameter will filter the string only allowing for digits, parentheses, math and binary operators (the XOR, particularly). As such, this can be exploited to inject and execute (semi) arbitrary PHP code through "phpfuck" techniques. The vulnerability could be exploited by e.g. administrator users, by editing a template/style in the admin panel and adding a specially crafted {vb:math} tag (which is a sort of wrapper around the vB5_Template_Runtime::runMaths() method). However, this can also be exploited by unauthenticated attackers by abusing the ajax/render/[template] route, rendering a template which uses the {vb:math} tag with an user-tainted parameter. One of the possible templates that can be abused that way is the default "pagenav" template: here, user input passed through the "pagenav[pagenumber]" parameter will be assigned to the "pagenav.currentpage" template variable, which is later used within a {vb:math} tag, thus passed to the vB5_Template_Runtime::runMaths() method, which in turn will pass this string to eval(), eventually resulting in execution of (semi) arbitrary PHP code on the web server. [-] Proof of Concept: https://karmainsecurity.com/pocs/CVE-2026-61511.php [-] Solution: Apply the vendor patch or upgrade to version 6.2.2 or later. [-] Disclosure Timeline: [25/06/2026] - Vendor was notified by SSD Secure Disclosure [30/06/2026] - Vendor released security patch to address this issue: https://tinyurl.com/vb-patch [01/07/2026] - Vendor released version 6.2.2: https://tinyurl.com/vb-622 [13/07/2026] - CVE identifier requested [13/07/2026] - CVE identifier assigned [27/07/2026] - Public disclosure [-] CVE Reference: CVE-2026-61511 has been assigned to this vulnerability. [-] Credits: Vulnerability discovered by Egidio Romano. [-] Original Advisory: https://karmainsecurity.com/KIS-2026-13 [-] Other References: https://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/ _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
vBulletin vBulletin Affected: unknown
Create a notification for this product.
Credits
Egidio Romano
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "vBulletin",
          "vendor": "vBulletin",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Egidio Romano"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----------------------------------------------------------------\nvBulletin \u003c= 6.2.1 (runMaths) Remote Code Execution Vulnerability\n-----------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.vbulletin.com\n\n\n[-] Affected Versions:\n\nVersion 5.7.5 and prior 5.x versions.\nVersion 6.2.1 and prior 6.x versions.\n\n\n[-] Vulnerability Description:\n\nThe vulnerable code is located within the\n/includes/vb5/template/runtime.php script. Specifically, into the\nvB5_Template_Runtime::runMaths() method: the $str parameter is not\nsufficiently sanitized before being used in an eval() call. The regex used\nto validate the input parameter will filter the string only allowing for\ndigits, parentheses, math and binary operators (the XOR, particularly). As\nsuch, this can be exploited to inject and execute (semi) arbitrary PHP code\nthrough \"phpfuck\" techniques. The vulnerability could be exploited by e.g.\nadministrator users, by editing a template/style in the admin panel and\nadding a specially crafted {vb:math} tag (which is a sort of wrapper around\nthe vB5_Template_Runtime::runMaths() method). However, this can also be\nexploited by unauthenticated attackers by abusing the\najax/render/[template] route, rendering a template which uses the {vb:math}\ntag with an user-tainted parameter. One of the possible templates that can\nbe abused that way is the default \"pagenav\" template: here, user input\npassed through the \"pagenav[pagenumber]\" parameter will be assigned to the\n\"pagenav.currentpage\" template variable, which is later used within a\n{vb:math} tag, thus passed to the vB5_Template_Runtime::runMaths() method,\nwhich in turn will pass this string to eval(), eventually resulting in\nexecution of (semi) arbitrary PHP code on the web server.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/CVE-2026-61511.php\n\n\n[-] Solution:\n\nApply the vendor patch or upgrade to version 6.2.2 or later.\n\n\n[-] Disclosure Timeline:\n\n[25/06/2026] - Vendor was notified by SSD Secure Disclosure\n[30/06/2026] - Vendor released security patch to address this issue:\nhttps://tinyurl.com/vb-patch\n[01/07/2026] - Vendor released version 6.2.2: https://tinyurl.com/vb-622\n[13/07/2026] - CVE identifier requested\n[13/07/2026] - CVE identifier assigned\n[27/07/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nCVE-2026-61511 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-13\n\n\n[-] Other References:\n\nhttps://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:48:05Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/29"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/29"
        },
        {
          "url": "https://karmainsecurity.com/KIS-2026-13"
        },
        {
          "url": "https://karmainsecurity.com/pocs/CVE-2026-61511.php"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/"
        },
        {
          "url": "https://tinyurl.com/vb-622"
        },
        {
          "url": "https://tinyurl.com/vb-patch"
        },
        {
          "url": "https://www.vbulletin.com"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/29"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[KIS-2026-13] vBulletin \u003c= 6.2.1 (runMaths) Remote Code Execution Vulnerability",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0038",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/29",
            "automated": true,
            "contentSha256": "f552a77da0b58d8b73f63dd07d383c31adfeb589892e4c5dc3324e305eb50047",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/29",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-27T11:04:04Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:48:05Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0038"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0294

Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-11 11:47
VLAI
Title
APPLE-SA-07-27-2026-8 Safari 26.6
Summary
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-07-27-2026-8 Safari 26.6 Safari 26.6 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/128073. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Safari Available for: macOS Sonoma and macOS Sequoia Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-43792: Ilya Andr (andrd3v) WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may result in the disclosure of process memory Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 308046 CVE-2026-43740: Arni Hardarson, Nathaniel Oh (@calysteon) WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Websites may know if the user has visited a given link Description: This issue was addressed with improved checks. WebKit Bugzilla: 316827 CVE-2026-64713: Kwak Kiyong, Song Nuri WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Visiting a website that frames malicious content may lead to UI spoofing Description: The issue was addressed with improved UI. WebKit Bugzilla: 311660 CVE-2026-64730: Kagami Rosylight of Mozilla WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Maliciously crafted web content may violate iframe sandboxing policy Description: A permissions issue was addressed with improved validation. WebKit Bugzilla: 313220 CVE-2026-64728: an anonymous researcher WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 313521 CVE-2026-64783: 杉山 壮太, lattice, Behzad Najjarpour Jabbari (@_G4ru_), Junyeong Lee, Mooth.ai, OGINOME Tomohito, Using GLM From Z.AI, Gia Bui (@yabeow) from Calif.io WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A memory corruption issue was addressed with improved state management. WebKit Bugzilla: 315082 CVE-2026-64757: Milad Nasr and Nicholas Carlini with Claude, Anthropic WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Visiting a website may lead to an app denial-of-service Description: This issue was addressed through improved state management. WebKit Bugzilla: 316816 CVE-2026-43804: Heiko Kiesel of SEEMOO, TU Darmstadt WebKit Available for: macOS Sonoma and macOS Sequoia Impact: An app may be able to read files outside of its sandbox Description: An access issue was addressed with improved access restrictions. WebKit Bugzilla: 314867 CVE-2026-43821: Brian Carpenter WebKit Canvas Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 313935 CVE-2026-64718: OGINOME Tomohito, an anonymous researcher WebRTC Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: An out-of-bounds access issue was addressed with improved bounds checking. WebKit Bugzilla: 319404 CVE-2026-64719: Shaheen Fazim Additional recognition Safari Downloads We would like to acknowledge Alfaz Hossain for their assistance. WebKit We would like to acknowledge Jaya Surya Kommireddy, Jaya surya Kommireddy, Lukas Knittel (@kunte_ctf) of Ruhr-University Bochum, Nikos Fanourakis of Technical University of Crete, Sotiris Ioannidis of Technical University of Crete, Panagiotis Ilia of Cyprus University of Technology, and Kostas Drakonakis of Technical University of Crete, Tony Gorez (@tonygo_) for Reverse Society, Vitaly Simonovich, Youngjoon Kim of Team-Atlanta & sslab at Georgia Tech, s3zer0 for their assistance. WebKit Canvas We would like to acknowledge Codex Security - Khai Tran, Daisuke Hatakeyama and Ryohei Ueki (@SYZD Research), David Bors at Snyk Security Labs, Giovanni Vignone and Robert van Eijk of Octane Security (octane.security), Kwak Kiyong, Song nuri, Luat Nguyen (CyberJutsu Academy), Tom Van Goethem, an anonymous researcher, dr3dd for their assistance. WebKit Storage We would like to acknowledge Gurpreet Shergill, Luke Francis, Milad Nasr and Nicholas Carlini with Claude, Anthropic, Oleh Konko of 1seal (1seal.org), Vitaly Simonovich for their assistance. Safari 26.6 may be obtained from the Mac App Store. All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmpn4iMACgkQ4Ifiq8DH 7PUTig//dN43HRyvQWDfL6xMYj1NvUVLsWy8KXyMy33uJ4A3K+7H0lsFPpVusN5R TAPd6SOjmrMAH04dveKIy6isyZUxG6P6Ez7nLZXkalw8UCRt0QDzFZJQT2dgPzrY n57bQLrkw5HXAStWcviCbQCU9OjZVg44kWOHkI18AngBnpgF6Xcdn2KsO8A1UVj6 MLtFMg9AArwT+FMC1mqJv5IYGQZaDmcCNjz9+dm4ryHeOBpHm5t3stPr8fiOLgM8 nYuzKQc0ABsS+ne8/Ivter+iLDYM2ZH/EhswBDeIWuS7RTwAAsOwwMi6HGJAkpJU WNrPz+yMY+oO1M/+6KRDP+3L6H1P4hSxgCRcreokE1JnjuvGgDEiq2s1r7GGJL2L +RCnKAnL0c+B0EEedYH6Yi3jcLzaqKXnlfJBdVu7IKW7VjRcr07IwmemeIMfFF+O ctCTvHUGT723b63D131qqCcnUgiprijhJ02Sw/IaHQckxUeNt/USY0eYuQbhfC+y X1olXowGzDRXznuCze2L33jCjYy9MFJp/8K2s2ap4yTAR9jlohdP1GrxQcDj1NUu XaDKOq3VUF2Z+S1OpEOVn8pgax4evoHyu8Nh7AsuwiTw07VKq3qfg/0SZbuOcnLq aKYx+4St5AyBVKlzR489dL3V9fRkov1dwA3iPVLR35vCan8E83w= =3nQh -----END PGP SIGNATURE----- _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Apple Safari Affected: unknown
Create a notification for this product.
Credits
Apple Product Security via Fulldisclosure
Relationships
reference GCVE-1988-2026-0294 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-07-27-2026-8 Safari 26.6\n\nSafari 26.6 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/128073.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nSafari\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-43792: Ilya Andr (andrd3v)\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may result in the\ndisclosure of process memory\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 308046\nCVE-2026-43740: Arni Hardarson, Nathaniel Oh (@calysteon)\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Websites may know if the user has visited a given link\nDescription: This issue was addressed with improved checks.\nWebKit Bugzilla: 316827\nCVE-2026-64713: Kwak Kiyong, Song Nuri\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Visiting a website that frames malicious content may lead to UI\nspoofing\nDescription: The issue was addressed with improved UI.\nWebKit Bugzilla: 311660\nCVE-2026-64730: Kagami Rosylight of Mozilla\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Maliciously crafted web content may violate iframe sandboxing\npolicy\nDescription: A permissions issue was addressed with improved validation.\nWebKit Bugzilla: 313220\nCVE-2026-64728: an anonymous researcher\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313521\nCVE-2026-64783: \u6749\u5c71 \u58ee\u592a, lattice, Behzad Najjarpour Jabbari (@_G4ru_),\nJunyeong Lee, Mooth.ai, OGINOME Tomohito, Using GLM From Z.AI, Gia Bui\n(@yabeow) from Calif.io\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption issue was addressed with improved state\nmanagement.\nWebKit Bugzilla: 315082\nCVE-2026-64757: Milad Nasr and Nicholas Carlini with Claude, Anthropic\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Visiting a website may lead to an app denial-of-service\nDescription: This issue was addressed through improved state management.\nWebKit Bugzilla: 316816\nCVE-2026-43804: Heiko Kiesel of SEEMOO, TU Darmstadt\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: An app may be able to read files outside of its sandbox\nDescription: An access issue was addressed with improved access\nrestrictions.\nWebKit Bugzilla: 314867\nCVE-2026-43821: Brian Carpenter\n\nWebKit Canvas\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313935\nCVE-2026-64718: OGINOME Tomohito, an anonymous researcher\n\nWebRTC\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nWebKit Bugzilla: 319404\nCVE-2026-64719: Shaheen Fazim\n\nAdditional recognition\n\nSafari Downloads\nWe would like to acknowledge Alfaz Hossain for their assistance.\n\nWebKit\nWe would like to acknowledge Jaya Surya Kommireddy, Jaya surya\nKommireddy, Lukas Knittel (@kunte_ctf) of Ruhr-University Bochum, Nikos\nFanourakis of Technical University of Crete, Sotiris Ioannidis of\nTechnical University of Crete, Panagiotis Ilia of Cyprus University of\nTechnology, and Kostas Drakonakis of Technical University of Crete, Tony\nGorez (@tonygo_) for Reverse Society, Vitaly Simonovich, Youngjoon Kim\nof Team-Atlanta \u0026 sslab at Georgia Tech, s3zer0 for their assistance.\n\nWebKit Canvas\nWe would like to acknowledge Codex Security - Khai Tran, Daisuke\nHatakeyama and Ryohei Ueki (@SYZD Research), David Bors at Snyk Security\nLabs, Giovanni Vignone and Robert van Eijk of Octane Security\n(octane.security), Kwak Kiyong, Song nuri, Luat Nguyen (CyberJutsu\nAcademy), Tom Van Goethem, an anonymous researcher, dr3dd for their\nassistance.\n\nWebKit Storage\nWe would like to acknowledge Gurpreet Shergill, Luke Francis, Milad Nasr\nand Nicholas Carlini with Claude, Anthropic, Oleh Konko of 1seal\n(1seal.org), Vitaly Simonovich for their assistance.\n\nSafari 26.6 may be obtained from the Mac App Store.\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmpn4iMACgkQ4Ifiq8DH\n7PUTig//dN43HRyvQWDfL6xMYj1NvUVLsWy8KXyMy33uJ4A3K+7H0lsFPpVusN5R\nTAPd6SOjmrMAH04dveKIy6isyZUxG6P6Ez7nLZXkalw8UCRt0QDzFZJQT2dgPzrY\nn57bQLrkw5HXAStWcviCbQCU9OjZVg44kWOHkI18AngBnpgF6Xcdn2KsO8A1UVj6\nMLtFMg9AArwT+FMC1mqJv5IYGQZaDmcCNjz9+dm4ryHeOBpHm5t3stPr8fiOLgM8\nnYuzKQc0ABsS+ne8/Ivter+iLDYM2ZH/EhswBDeIWuS7RTwAAsOwwMi6HGJAkpJU\nWNrPz+yMY+oO1M/+6KRDP+3L6H1P4hSxgCRcreokE1JnjuvGgDEiq2s1r7GGJL2L\n+RCnKAnL0c+B0EEedYH6Yi3jcLzaqKXnlfJBdVu7IKW7VjRcr07IwmemeIMfFF+O\nctCTvHUGT723b63D131qqCcnUgiprijhJ02Sw/IaHQckxUeNt/USY0eYuQbhfC+y\nX1olXowGzDRXznuCze2L33jCjYy9MFJp/8K2s2ap4yTAR9jlohdP1GrxQcDj1NUu\nXaDKOq3VUF2Z+S1OpEOVn8pgax4evoHyu8Nh7AsuwiTw07VKq3qfg/0SZbuOcnLq\naKYx+4St5AyBVKlzR489dL3V9fRkov1dwA3iPVLR35vCan8E83w=\n=3nQh\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:47:50Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/23"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/23"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/en-us/128073"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/23"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-07-27-2026-8 Safari 26.6",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-43740",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43792",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43804",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43821",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64713",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64718",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64719",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64728",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64730",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64757",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64783",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0294",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/23",
            "automated": true,
            "contentSha256": "38f987ac49c6174abe8e7fb441f3c17c5e00305bda36174c90f11839c358c339",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/23",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-28T00:27:54Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0294"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:48Z",
    "dateUpdated": "2026-09-11T11:47:50Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0294"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0046

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:47
VLAI
Title
APPLE-SA-07-27-2026-8 Safari 26.6
Summary
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-07-27-2026-8 Safari 26.6 Safari 26.6 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/128073. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Safari Available for: macOS Sonoma and macOS Sequoia Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-43792: Ilya Andr (andrd3v) WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may result in the disclosure of process memory Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 308046 CVE-2026-43740: Arni Hardarson, Nathaniel Oh (@calysteon) WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Websites may know if the user has visited a given link Description: This issue was addressed with improved checks. WebKit Bugzilla: 316827 CVE-2026-64713: Kwak Kiyong, Song Nuri WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Visiting a website that frames malicious content may lead to UI spoofing Description: The issue was addressed with improved UI. WebKit Bugzilla: 311660 CVE-2026-64730: Kagami Rosylight of Mozilla WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Maliciously crafted web content may violate iframe sandboxing policy Description: A permissions issue was addressed with improved validation. WebKit Bugzilla: 313220 CVE-2026-64728: an anonymous researcher WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 313521 CVE-2026-64783: 杉山 壮太, lattice, Behzad Najjarpour Jabbari (@_G4ru_), Junyeong Lee, Mooth.ai, OGINOME Tomohito, Using GLM From Z.AI, Gia Bui (@yabeow) from Calif.io WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A memory corruption issue was addressed with improved state management. WebKit Bugzilla: 315082 CVE-2026-64757: Milad Nasr and Nicholas Carlini with Claude, Anthropic WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Visiting a website may lead to an app denial-of-service Description: This issue was addressed through improved state management. WebKit Bugzilla: 316816 CVE-2026-43804: Heiko Kiesel of SEEMOO, TU Darmstadt WebKit Available for: macOS Sonoma and macOS Sequoia Impact: An app may be able to read files outside of its sandbox Description: An access issue was addressed with improved access restrictions. WebKit Bugzilla: 314867 CVE-2026-43821: Brian Carpenter WebKit Canvas Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 313935 CVE-2026-64718: OGINOME Tomohito, an anonymous researcher WebRTC Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: An out-of-bounds access issue was addressed with improved bounds checking. WebKit Bugzilla: 319404 CVE-2026-64719: Shaheen Fazim Additional recognition Safari Downloads We would like to acknowledge Alfaz Hossain for their assistance. WebKit We would like to acknowledge Jaya Surya Kommireddy, Jaya surya Kommireddy, Lukas Knittel (@kunte_ctf) of Ruhr-University Bochum, Nikos Fanourakis of Technical University of Crete, Sotiris Ioannidis of Technical University of Crete, Panagiotis Ilia of Cyprus University of Technology, and Kostas Drakonakis of Technical University of Crete, Tony Gorez (@tonygo_) for Reverse Society, Vitaly Simonovich, Youngjoon Kim of Team-Atlanta & sslab at Georgia Tech, s3zer0 for their assistance. WebKit Canvas We would like to acknowledge Codex Security - Khai Tran, Daisuke Hatakeyama and Ryohei Ueki (@SYZD Research), David Bors at Snyk Security Labs, Giovanni Vignone and Robert van Eijk of Octane Security (octane.security), Kwak Kiyong, Song nuri, Luat Nguyen (CyberJutsu Academy), Tom Van Goethem, an anonymous researcher, dr3dd for their assistance. WebKit Storage We would like to acknowledge Gurpreet Shergill, Luke Francis, Milad Nasr and Nicholas Carlini with Claude, Anthropic, Oleh Konko of 1seal (1seal.org), Vitaly Simonovich for their assistance. Safari 26.6 may be obtained from the Mac App Store. All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmpn4iMACgkQ4Ifiq8DH 7PUTig//dN43HRyvQWDfL6xMYj1NvUVLsWy8KXyMy33uJ4A3K+7H0lsFPpVusN5R TAPd6SOjmrMAH04dveKIy6isyZUxG6P6Ez7nLZXkalw8UCRt0QDzFZJQT2dgPzrY n57bQLrkw5HXAStWcviCbQCU9OjZVg44kWOHkI18AngBnpgF6Xcdn2KsO8A1UVj6 MLtFMg9AArwT+FMC1mqJv5IYGQZaDmcCNjz9+dm4ryHeOBpHm5t3stPr8fiOLgM8 nYuzKQc0ABsS+ne8/Ivter+iLDYM2ZH/EhswBDeIWuS7RTwAAsOwwMi6HGJAkpJU WNrPz+yMY+oO1M/+6KRDP+3L6H1P4hSxgCRcreokE1JnjuvGgDEiq2s1r7GGJL2L +RCnKAnL0c+B0EEedYH6Yi3jcLzaqKXnlfJBdVu7IKW7VjRcr07IwmemeIMfFF+O ctCTvHUGT723b63D131qqCcnUgiprijhJ02Sw/IaHQckxUeNt/USY0eYuQbhfC+y X1olXowGzDRXznuCze2L33jCjYy9MFJp/8K2s2ap4yTAR9jlohdP1GrxQcDj1NUu XaDKOq3VUF2Z+S1OpEOVn8pgax4evoHyu8Nh7AsuwiTw07VKq3qfg/0SZbuOcnLq aKYx+4St5AyBVKlzR489dL3V9fRkov1dwA3iPVLR35vCan8E83w= =3nQh -----END PGP SIGNATURE----- _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Apple Safari Affected: unknown
Create a notification for this product.
Credits
Apple Product Security via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-07-27-2026-8 Safari 26.6\n\nSafari 26.6 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/128073.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nSafari\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-43792: Ilya Andr (andrd3v)\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may result in the\ndisclosure of process memory\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 308046\nCVE-2026-43740: Arni Hardarson, Nathaniel Oh (@calysteon)\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Websites may know if the user has visited a given link\nDescription: This issue was addressed with improved checks.\nWebKit Bugzilla: 316827\nCVE-2026-64713: Kwak Kiyong, Song Nuri\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Visiting a website that frames malicious content may lead to UI\nspoofing\nDescription: The issue was addressed with improved UI.\nWebKit Bugzilla: 311660\nCVE-2026-64730: Kagami Rosylight of Mozilla\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Maliciously crafted web content may violate iframe sandboxing\npolicy\nDescription: A permissions issue was addressed with improved validation.\nWebKit Bugzilla: 313220\nCVE-2026-64728: an anonymous researcher\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313521\nCVE-2026-64783: \u6749\u5c71 \u58ee\u592a, lattice, Behzad Najjarpour Jabbari (@_G4ru_),\nJunyeong Lee, Mooth.ai, OGINOME Tomohito, Using GLM From Z.AI, Gia Bui\n(@yabeow) from Calif.io\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption issue was addressed with improved state\nmanagement.\nWebKit Bugzilla: 315082\nCVE-2026-64757: Milad Nasr and Nicholas Carlini with Claude, Anthropic\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Visiting a website may lead to an app denial-of-service\nDescription: This issue was addressed through improved state management.\nWebKit Bugzilla: 316816\nCVE-2026-43804: Heiko Kiesel of SEEMOO, TU Darmstadt\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: An app may be able to read files outside of its sandbox\nDescription: An access issue was addressed with improved access\nrestrictions.\nWebKit Bugzilla: 314867\nCVE-2026-43821: Brian Carpenter\n\nWebKit Canvas\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313935\nCVE-2026-64718: OGINOME Tomohito, an anonymous researcher\n\nWebRTC\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nWebKit Bugzilla: 319404\nCVE-2026-64719: Shaheen Fazim\n\nAdditional recognition\n\nSafari Downloads\nWe would like to acknowledge Alfaz Hossain for their assistance.\n\nWebKit\nWe would like to acknowledge Jaya Surya Kommireddy, Jaya surya\nKommireddy, Lukas Knittel (@kunte_ctf) of Ruhr-University Bochum, Nikos\nFanourakis of Technical University of Crete, Sotiris Ioannidis of\nTechnical University of Crete, Panagiotis Ilia of Cyprus University of\nTechnology, and Kostas Drakonakis of Technical University of Crete, Tony\nGorez (@tonygo_) for Reverse Society, Vitaly Simonovich, Youngjoon Kim\nof Team-Atlanta \u0026 sslab at Georgia Tech, s3zer0 for their assistance.\n\nWebKit Canvas\nWe would like to acknowledge Codex Security - Khai Tran, Daisuke\nHatakeyama and Ryohei Ueki (@SYZD Research), David Bors at Snyk Security\nLabs, Giovanni Vignone and Robert van Eijk of Octane Security\n(octane.security), Kwak Kiyong, Song nuri, Luat Nguyen (CyberJutsu\nAcademy), Tom Van Goethem, an anonymous researcher, dr3dd for their\nassistance.\n\nWebKit Storage\nWe would like to acknowledge Gurpreet Shergill, Luke Francis, Milad Nasr\nand Nicholas Carlini with Claude, Anthropic, Oleh Konko of 1seal\n(1seal.org), Vitaly Simonovich for their assistance.\n\nSafari 26.6 may be obtained from the Mac App Store.\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmpn4iMACgkQ4Ifiq8DH\n7PUTig//dN43HRyvQWDfL6xMYj1NvUVLsWy8KXyMy33uJ4A3K+7H0lsFPpVusN5R\nTAPd6SOjmrMAH04dveKIy6isyZUxG6P6Ez7nLZXkalw8UCRt0QDzFZJQT2dgPzrY\nn57bQLrkw5HXAStWcviCbQCU9OjZVg44kWOHkI18AngBnpgF6Xcdn2KsO8A1UVj6\nMLtFMg9AArwT+FMC1mqJv5IYGQZaDmcCNjz9+dm4ryHeOBpHm5t3stPr8fiOLgM8\nnYuzKQc0ABsS+ne8/Ivter+iLDYM2ZH/EhswBDeIWuS7RTwAAsOwwMi6HGJAkpJU\nWNrPz+yMY+oO1M/+6KRDP+3L6H1P4hSxgCRcreokE1JnjuvGgDEiq2s1r7GGJL2L\n+RCnKAnL0c+B0EEedYH6Yi3jcLzaqKXnlfJBdVu7IKW7VjRcr07IwmemeIMfFF+O\nctCTvHUGT723b63D131qqCcnUgiprijhJ02Sw/IaHQckxUeNt/USY0eYuQbhfC+y\nX1olXowGzDRXznuCze2L33jCjYy9MFJp/8K2s2ap4yTAR9jlohdP1GrxQcDj1NUu\nXaDKOq3VUF2Z+S1OpEOVn8pgax4evoHyu8Nh7AsuwiTw07VKq3qfg/0SZbuOcnLq\naKYx+4St5AyBVKlzR489dL3V9fRkov1dwA3iPVLR35vCan8E83w=\n=3nQh\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:47:50Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/23"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/23"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/en-us/128073"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/23"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-07-27-2026-8 Safari 26.6",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0046",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/23",
            "automated": true,
            "contentSha256": "38f987ac49c6174abe8e7fb441f3c17c5e00305bda36174c90f11839c358c339",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/23",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-28T00:27:54Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:47:50Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0046"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0293

Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-11 11:47
VLAI
Title
APPLE-SA-07-27-2026-7 visionOS 26.6
Summary
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-07-27-2026-7 visionOS 26.6 visionOS 26.6 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/128070. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accounts Framework Available for: Apple Vision Pro (all models) Impact: An app may be able to fingerprint the user Description: This issue was addressed with improved data protection. CVE-2026-64733: Rosyna Keller of Totally Not Malicious Software (paradisefacade.com) App Store Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved checks. CVE-2026-43801: Rahul Raj Audio Available for: Apple Vision Pro (all models) Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/) AuthKit Available for: Apple Vision Pro (all models) Impact: An app may be able to fingerprint the user Description: A permissions issue was addressed with additional restrictions. CVE-2026-43730: David Strnadel AVEVideoEncoder Available for: Apple Vision Pro (all models) Impact: An app may be able to execute arbitrary code with kernel privileges Description: A buffer overflow was addressed with improved size validation. CVE-2026-64747: Franco Belman at Blackwing Intelligence BackgroundAssets Available for: Apple Vision Pro (all models) Impact: An app may be able to delete files for which it does not have permission Description: A permissions issue was addressed with improved validation. CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab CloudAttestation Available for: Apple Vision Pro (all models) Impact: A maliciously crafted app may be able to bypass code signing enforcement Description: A validation issue was addressed with improved input sanitization. CVE-2026-43813: Anton Pakhunov Contacts Available for: Apple Vision Pro (all models) Impact: An app may be able to add contacts without user authorization Description: An authorization issue was addressed with improved validation. CVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel Febrero Contacts Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted contact may leak sensitive data Description: The issue was addressed with improved checks. CVE-2026-64734: Daniel Williams CoreAudio Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted audio file may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative CoreAudio Available for: Apple Vision Pro (all models) Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43744: Mathis Mansière, an anonymous researcher CoreAudio Available for: Apple Vision Pro (all models) Impact: A remote attacker may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43803: Rahul Raj CoreMedia Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: A memory corruption issue was addressed with improved memory handling. CVE-2026-43711: James Duffy (@0x4A616D657344) Foundation Available for: Apple Vision Pro (all models) Impact: A malicious app may be able to access protected user data Description: The issue was addressed with improved input sanitization. CVE-2026-43714: an anonymous researcher FrontBoard Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: This issue was addressed by using HTTPS when sending information over the network. CVE-2026-64742: Huỳnh Tấn Ngàn Game Center Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved data protection. CVE-2026-43796: Ilya Andr (andrd3v) of Positive Technologies, Stanislav Jelezoglo Heimdal Available for: Apple Vision Pro (all models) Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64692: Redon Gashi ImageIO Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted texture may lead to unexpected app termination Description: An integer overflow was addressed with improved input validation. CVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative ImageIO Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted image may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-64716: Arni Hardarson, Jonathan Alush-Aben, Peter Malone ImageIO Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: The issue was addressed with improved bounds checks. CVE-2026-64758: 진규정 (Gyujeong Jin, @G1uN4sh) ImageIO Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted file may lead to a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64754: PETOWORKS의 Bugeun Choi (@Bugeun), Rahul Raj ImageIO Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted image may lead to a denial-of-service Description: A type confusion issue was addressed with improved checks. CVE-2026-64693: Geonha Lee (@leegn4a) Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64749: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ashish Kunwar, Hiroki Imai (LAC Co., Ltd.), hxr1 Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2026-43778: f0r of MurphySec, Feng Xue and XGPT of ThreatBook, Mahmoud Abdelmoniem, an anonymous researcher, Wang Yu, Lyutoon, Hiroki Imai (LAC Co., Ltd.), DARKNAVY (@DarkNavyOrg), Fábio Luís @scanpt, Nicolas Rabrenovic Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to disclose kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64709: Pasquale Scola, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple Vision Pro (all models) Impact: A remote attacker may be able to bypass network filters Description: An inconsistent user interface issue was addressed with improved state management. CVE-2026-64735: Gor Aleksanyan Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43739: impost0r (ret2plt), Ruslan Dautov, Aleksandr Tarasikov, jay, Dhiyanesh Selvaraj (@redroot97), Vinay Kumar Rasala (Xplo8E) from Appknox, Lyutoon, DongJun Kim (smlijun) with UIUC, Hwiwon Lee (hwiwonl) with UIUC, Jongseong Kim (nevul37) with UIUC, Younggi Park (grill66) with UIUC, Peter Malone, an anonymous researcher, Hari Shanmugam (The Hxr1), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Marco Grassi, Dun, Daniele Castronovo, Michal Kosiorek CVE-2026-43816: Josh Maine of Calif.io, Ruslan Dautov, 재영 정, @rootxran (Rao Ali Nawaz), Chanwit Muenprakoddee (ChemIndy), an anonymous researcher, Ye Zhang (@VAR10CK) of Baidu Security, Franco Belman at Blackwing Intelligence, Christian Figueroa, Johnny Franks (@zeroxjf), Ashmit Sharma & Atul RV, Peter Malone, Muhamad Syaiful, Muneeb Amin Bhat, Dhiyanesh Selvaraj (@redroot97), Ali Marzouq, Bountyy Oy - Mihalis Haatainen, Huy Nguyen (@34306) of Calif.io Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-43822: Eddy Tsalolikhin, Michal Kosiorek CVE-2026-64729: Josh Maine of Calif.io, beist, Adam Doupé of ASU SEFCOM, Dun, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Johnny Franks (@zeroxjf) CVE-2026-64700: Asjid Kalam (@odinshell) CVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-43817: Huy Nguyen (@34306) of Calif.io Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination or write kernel memory Description: The issue was addressed with improved input sanitization. CVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel) Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination Description: An integer overflow was addressed with improved input validation. CVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple Vision Pro (all models) Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-43810: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination Description: A memory initialization issue was addressed with improved memory handling. CVE-2026-64775: Ryan Hileman via Xint Code (xint.io) Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: This issue was addressed with improved input validation. CVE-2026-39868: Vladislav Shevchenko (Positive Technologies), Ye Zhang (@VAR10CK) of Baidu Security, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination or write kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2026-64751: N.M.Praveen Nawarathne (@zblockrat) Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: This issue was addressed through improved state management. CVE-2026-64721: Lukas Gerlach libarchive Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted file may result in disclosure of process memory Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2026-4424 Libnotify Available for: Apple Vision Pro (all models) Impact: An attacker may be able to cause unexpected app termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64739: Feng Xue and XGPT of ThreatBook, Dun libxslt Available for: Apple Vis
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Apple Visionos Affected: unknown
Create a notification for this product.
Credits
Apple Product Security via Fulldisclosure
Relationships
reference GCVE-1988-2026-0293 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Visionos",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-07-27-2026-7 visionOS 26.6\n\nvisionOS 26.6 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/128070.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccounts Framework\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to fingerprint the user\nDescription: This issue was addressed with improved data protection.\nCVE-2026-64733: Rosyna Keller of Totally Not Malicious Software\n(paradisefacade.com)\n\nApp Store\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved checks.\nCVE-2026-43801: Rahul Raj\n\nAudio\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\nAuthKit\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to fingerprint the user\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-43730: David Strnadel\n\nAVEVideoEncoder\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges\nDescription: A buffer overflow was addressed with improved size\nvalidation.\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\nBackgroundAssets\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to delete files for which it does not have\npermission\nDescription: A permissions issue was addressed with improved validation.\nCVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity\u0027s WeBin lab\n\nCloudAttestation\nAvailable for: Apple Vision Pro (all models)\nImpact: A maliciously crafted app may be able to bypass code signing\nenforcement\nDescription: A validation issue was addressed with improved input\nsanitization.\nCVE-2026-43813: Anton Pakhunov\n\nContacts\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to add contacts without user authorization\nDescription: An authorization issue was addressed with improved\nvalidation.\nCVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel\nFebrero\n\nContacts\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted contact may leak sensitive data\nDescription: The issue was addressed with improved checks.\nCVE-2026-64734: Daniel Williams\n\nCoreAudio\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted audio file may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\nCoreAudio\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43744: Mathis Mansi\u00e8re, an anonymous researcher\n\nCoreAudio\nAvailable for: Apple Vision Pro (all models)\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43803: Rahul Raj\n\nCoreMedia\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\nFoundation\nAvailable for: Apple Vision Pro (all models)\nImpact: A malicious app may be able to access protected user data\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43714: an anonymous researcher\n\nFrontBoard\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed by using HTTPS when sending\ninformation over the network.\nCVE-2026-64742: Hu\u1ef3nh T\u1ea5n Ng\u00e0n\n\nGame Center\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43796: Ilya Andr (andrd3v) of Positive Technologies, Stanislav\nJelezoglo\n\nHeimdal\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64692: Redon Gashi\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted texture may lead to unexpected\napp termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day\nInitiative\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64716: Arni Hardarson, Jonathan Alush-Aben, Peter Malone\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-64758: \uc9c4\uaddc\uc815 (Gyujeong Jin, @G1uN4sh)\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted file may lead to a\ndenial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64754: PETOWORKS\uc758 Bugeun Choi (@Bugeun), Rahul Raj\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may lead to a\ndenial-of-service\nDescription: A type confusion issue was addressed with improved checks.\nCVE-2026-64693: Geonha Lee (@leegn4a)\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64749: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd., Ashish Kunwar, Hiroki Imai (LAC Co., Ltd.),\nhxr1\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43778: f0r of MurphySec, Feng Xue and XGPT of ThreatBook,\nMahmoud Abdelmoniem, an anonymous researcher, Wang Yu, Lyutoon, Hiroki\nImai (LAC Co., Ltd.), DARKNAVY (@DarkNavyOrg), F\u00e1bio Lu\u00eds @scanpt,\nNicolas Rabrenovic\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64709: Pasquale Scola, Billy Jheng Bing Jhong and Pan Zhenpeng\n(@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: A remote attacker may be able to bypass network filters\nDescription: An inconsistent user interface issue was addressed with\nimproved state management.\nCVE-2026-64735: Gor Aleksanyan\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43739: impost0r (ret2plt), Ruslan Dautov, Aleksandr Tarasikov,\njay, Dhiyanesh Selvaraj (@redroot97), Vinay Kumar Rasala (Xplo8E) from\nAppknox, Lyutoon, DongJun Kim (smlijun) with UIUC, Hwiwon Lee (hwiwonl)\nwith UIUC, Jongseong Kim (nevul37) with UIUC, Younggi Park (grill66)\nwith UIUC, Peter Malone, an anonymous researcher, Hari Shanmugam (The\nHxr1), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR\nLabs SG Pte. Ltd., Marco Grassi, Dun, Daniele Castronovo, Michal\nKosiorek\nCVE-2026-43816: Josh Maine of Calif.io, Ruslan Dautov, \uc7ac\uc601 \uc815, @rootxran\n(Rao Ali Nawaz), Chanwit Muenprakoddee (ChemIndy), an anonymous\nresearcher, Ye Zhang (@VAR10CK) of Baidu Security, Franco Belman at\nBlackwing Intelligence, Christian Figueroa, Johnny Franks (@zeroxjf),\nAshmit Sharma \u0026 Atul RV, Peter Malone, Muhamad Syaiful, Muneeb Amin\nBhat, Dhiyanesh Selvaraj (@redroot97), Ali Marzouq, Bountyy Oy - Mihalis\nHaatainen, Huy Nguyen (@34306) of Calif.io\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43822: Eddy Tsalolikhin, Michal Kosiorek\nCVE-2026-64729: Josh Maine of Calif.io, beist, Adam Doup\u00e9 of ASU SEFCOM,\nDun, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR\nLabs SG Pte. Ltd., Johnny Franks (@zeroxjf)\nCVE-2026-64700: Asjid Kalam (@odinshell)\nCVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43817: Huy Nguyen (@34306) of Calif.io\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel)\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: A remote user may be able to cause unexpected system termination\nor corrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43810: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A memory initialization issue was addressed with improved\nmemory handling.\nCVE-2026-64775: Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: This issue was addressed with improved input validation.\nCVE-2026-39868: Vladislav Shevchenko (Positive Technologies), Ye Zhang\n(@VAR10CK) of Baidu Security, Billy Jheng Bing Jhong and Pan Zhenpeng\n(@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-64751: N.M.Praveen Nawarathne (@zblockrat)\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed through improved state management.\nCVE-2026-64721: Lukas Gerlach\n\nlibarchive\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted file may result in disclosure\nof process memory\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-4424\n\nLibnotify\nAvailable for: Apple Vision Pro (all models)\nImpact: An attacker may be able to cause unexpected app termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64739: Feng Xue and XGPT of ThreatBook, Dun\n\nlibxslt\nAvailable for: Apple Vis"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:47:48Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/22"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/22"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/en-us/128070"
        },
        {
          "url": "https://support.apple.com/kb/HT214009"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/22"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-07-27-2026-7 visionOS 26.6",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-28979",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39868",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39872",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43663",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43673",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43676",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43699",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43700",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43701",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43703",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43704",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43705",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43706",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43707",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43708",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43709",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43711",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43712",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43713",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43714",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43715",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43718",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43720",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43721",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43723",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43724",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43725",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43726",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43727",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43729",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43730",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43731",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43732",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43734",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43735",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43739",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43740",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43742",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43744",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43745",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43769",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43778",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43780",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43796",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43799",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43801",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43803",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43804",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43807",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43810",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43812",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43813",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43816",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43817",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43821",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43822",
              "type": "related"
            },
            {
              "destId": "CVE-2026-4424",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64692",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64693",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64700",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64707",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64709",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64713",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64716",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64718",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64719",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64721",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64724",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64725",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64726",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64728",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64729",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64730",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64733",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64734",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64735",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64739",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64741",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64742",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64743",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64746",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64747",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64749",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64751",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64754",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64757",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64758",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64763",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64764",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64765",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64766",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64768",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64769",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64770",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64771",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64772",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64774",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64775",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64783",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0293",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/22",
            "automated": true,
            "contentSha256": "da2c350129029fa4308f6df35ea2d022edc32b98e588d4408fd70659909849a8",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/22",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-28T00:27:26Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0293"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:48Z",
    "dateUpdated": "2026-09-11T11:47:48Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0293"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0045

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:47
VLAI
Title
APPLE-SA-07-27-2026-7 visionOS 26.6
Summary
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-07-27-2026-7 visionOS 26.6 visionOS 26.6 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/128070. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accounts Framework Available for: Apple Vision Pro (all models) Impact: An app may be able to fingerprint the user Description: This issue was addressed with improved data protection. CVE-2026-64733: Rosyna Keller of Totally Not Malicious Software (paradisefacade.com) App Store Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved checks. CVE-2026-43801: Rahul Raj Audio Available for: Apple Vision Pro (all models) Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/) AuthKit Available for: Apple Vision Pro (all models) Impact: An app may be able to fingerprint the user Description: A permissions issue was addressed with additional restrictions. CVE-2026-43730: David Strnadel AVEVideoEncoder Available for: Apple Vision Pro (all models) Impact: An app may be able to execute arbitrary code with kernel privileges Description: A buffer overflow was addressed with improved size validation. CVE-2026-64747: Franco Belman at Blackwing Intelligence BackgroundAssets Available for: Apple Vision Pro (all models) Impact: An app may be able to delete files for which it does not have permission Description: A permissions issue was addressed with improved validation. CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab CloudAttestation Available for: Apple Vision Pro (all models) Impact: A maliciously crafted app may be able to bypass code signing enforcement Description: A validation issue was addressed with improved input sanitization. CVE-2026-43813: Anton Pakhunov Contacts Available for: Apple Vision Pro (all models) Impact: An app may be able to add contacts without user authorization Description: An authorization issue was addressed with improved validation. CVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel Febrero Contacts Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted contact may leak sensitive data Description: The issue was addressed with improved checks. CVE-2026-64734: Daniel Williams CoreAudio Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted audio file may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative CoreAudio Available for: Apple Vision Pro (all models) Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43744: Mathis Mansière, an anonymous researcher CoreAudio Available for: Apple Vision Pro (all models) Impact: A remote attacker may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43803: Rahul Raj CoreMedia Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: A memory corruption issue was addressed with improved memory handling. CVE-2026-43711: James Duffy (@0x4A616D657344) Foundation Available for: Apple Vision Pro (all models) Impact: A malicious app may be able to access protected user data Description: The issue was addressed with improved input sanitization. CVE-2026-43714: an anonymous researcher FrontBoard Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: This issue was addressed by using HTTPS when sending information over the network. CVE-2026-64742: Huỳnh Tấn Ngàn Game Center Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved data protection. CVE-2026-43796: Ilya Andr (andrd3v) of Positive Technologies, Stanislav Jelezoglo Heimdal Available for: Apple Vision Pro (all models) Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64692: Redon Gashi ImageIO Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted texture may lead to unexpected app termination Description: An integer overflow was addressed with improved input validation. CVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative ImageIO Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted image may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-64716: Arni Hardarson, Jonathan Alush-Aben, Peter Malone ImageIO Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: The issue was addressed with improved bounds checks. CVE-2026-64758: 진규정 (Gyujeong Jin, @G1uN4sh) ImageIO Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted file may lead to a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64754: PETOWORKS의 Bugeun Choi (@Bugeun), Rahul Raj ImageIO Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted image may lead to a denial-of-service Description: A type confusion issue was addressed with improved checks. CVE-2026-64693: Geonha Lee (@leegn4a) Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64749: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ashish Kunwar, Hiroki Imai (LAC Co., Ltd.), hxr1 Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2026-43778: f0r of MurphySec, Feng Xue and XGPT of ThreatBook, Mahmoud Abdelmoniem, an anonymous researcher, Wang Yu, Lyutoon, Hiroki Imai (LAC Co., Ltd.), DARKNAVY (@DarkNavyOrg), Fábio Luís @scanpt, Nicolas Rabrenovic Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to disclose kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64709: Pasquale Scola, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple Vision Pro (all models) Impact: A remote attacker may be able to bypass network filters Description: An inconsistent user interface issue was addressed with improved state management. CVE-2026-64735: Gor Aleksanyan Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43739: impost0r (ret2plt), Ruslan Dautov, Aleksandr Tarasikov, jay, Dhiyanesh Selvaraj (@redroot97), Vinay Kumar Rasala (Xplo8E) from Appknox, Lyutoon, DongJun Kim (smlijun) with UIUC, Hwiwon Lee (hwiwonl) with UIUC, Jongseong Kim (nevul37) with UIUC, Younggi Park (grill66) with UIUC, Peter Malone, an anonymous researcher, Hari Shanmugam (The Hxr1), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Marco Grassi, Dun, Daniele Castronovo, Michal Kosiorek CVE-2026-43816: Josh Maine of Calif.io, Ruslan Dautov, 재영 정, @rootxran (Rao Ali Nawaz), Chanwit Muenprakoddee (ChemIndy), an anonymous researcher, Ye Zhang (@VAR10CK) of Baidu Security, Franco Belman at Blackwing Intelligence, Christian Figueroa, Johnny Franks (@zeroxjf), Ashmit Sharma & Atul RV, Peter Malone, Muhamad Syaiful, Muneeb Amin Bhat, Dhiyanesh Selvaraj (@redroot97), Ali Marzouq, Bountyy Oy - Mihalis Haatainen, Huy Nguyen (@34306) of Calif.io Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-43822: Eddy Tsalolikhin, Michal Kosiorek CVE-2026-64729: Josh Maine of Calif.io, beist, Adam Doupé of ASU SEFCOM, Dun, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Johnny Franks (@zeroxjf) CVE-2026-64700: Asjid Kalam (@odinshell) CVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-43817: Huy Nguyen (@34306) of Calif.io Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination or write kernel memory Description: The issue was addressed with improved input sanitization. CVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel) Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination Description: An integer overflow was addressed with improved input validation. CVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple Vision Pro (all models) Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-43810: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination Description: A memory initialization issue was addressed with improved memory handling. CVE-2026-64775: Ryan Hileman via Xint Code (xint.io) Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: This issue was addressed with improved input validation. CVE-2026-39868: Vladislav Shevchenko (Positive Technologies), Ye Zhang (@VAR10CK) of Baidu Security, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination or write kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2026-64751: N.M.Praveen Nawarathne (@zblockrat) Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: This issue was addressed through improved state management. CVE-2026-64721: Lukas Gerlach libarchive Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted file may result in disclosure of process memory Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2026-4424 Libnotify Available for: Apple Vision Pro (all models) Impact: An attacker may be able to cause unexpected app termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64739: Feng Xue and XGPT of ThreatBook, Dun libxslt Available for: Apple Vis
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Apple Visionos Affected: unknown
Create a notification for this product.
Credits
Apple Product Security via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Visionos",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-07-27-2026-7 visionOS 26.6\n\nvisionOS 26.6 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/128070.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccounts Framework\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to fingerprint the user\nDescription: This issue was addressed with improved data protection.\nCVE-2026-64733: Rosyna Keller of Totally Not Malicious Software\n(paradisefacade.com)\n\nApp Store\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved checks.\nCVE-2026-43801: Rahul Raj\n\nAudio\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\nAuthKit\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to fingerprint the user\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-43730: David Strnadel\n\nAVEVideoEncoder\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges\nDescription: A buffer overflow was addressed with improved size\nvalidation.\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\nBackgroundAssets\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to delete files for which it does not have\npermission\nDescription: A permissions issue was addressed with improved validation.\nCVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity\u0027s WeBin lab\n\nCloudAttestation\nAvailable for: Apple Vision Pro (all models)\nImpact: A maliciously crafted app may be able to bypass code signing\nenforcement\nDescription: A validation issue was addressed with improved input\nsanitization.\nCVE-2026-43813: Anton Pakhunov\n\nContacts\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to add contacts without user authorization\nDescription: An authorization issue was addressed with improved\nvalidation.\nCVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel\nFebrero\n\nContacts\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted contact may leak sensitive data\nDescription: The issue was addressed with improved checks.\nCVE-2026-64734: Daniel Williams\n\nCoreAudio\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted audio file may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\nCoreAudio\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43744: Mathis Mansi\u00e8re, an anonymous researcher\n\nCoreAudio\nAvailable for: Apple Vision Pro (all models)\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43803: Rahul Raj\n\nCoreMedia\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\nFoundation\nAvailable for: Apple Vision Pro (all models)\nImpact: A malicious app may be able to access protected user data\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43714: an anonymous researcher\n\nFrontBoard\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed by using HTTPS when sending\ninformation over the network.\nCVE-2026-64742: Hu\u1ef3nh T\u1ea5n Ng\u00e0n\n\nGame Center\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43796: Ilya Andr (andrd3v) of Positive Technologies, Stanislav\nJelezoglo\n\nHeimdal\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64692: Redon Gashi\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted texture may lead to unexpected\napp termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day\nInitiative\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64716: Arni Hardarson, Jonathan Alush-Aben, Peter Malone\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-64758: \uc9c4\uaddc\uc815 (Gyujeong Jin, @G1uN4sh)\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted file may lead to a\ndenial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64754: PETOWORKS\uc758 Bugeun Choi (@Bugeun), Rahul Raj\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may lead to a\ndenial-of-service\nDescription: A type confusion issue was addressed with improved checks.\nCVE-2026-64693: Geonha Lee (@leegn4a)\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64749: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd., Ashish Kunwar, Hiroki Imai (LAC Co., Ltd.),\nhxr1\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43778: f0r of MurphySec, Feng Xue and XGPT of ThreatBook,\nMahmoud Abdelmoniem, an anonymous researcher, Wang Yu, Lyutoon, Hiroki\nImai (LAC Co., Ltd.), DARKNAVY (@DarkNavyOrg), F\u00e1bio Lu\u00eds @scanpt,\nNicolas Rabrenovic\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64709: Pasquale Scola, Billy Jheng Bing Jhong and Pan Zhenpeng\n(@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: A remote attacker may be able to bypass network filters\nDescription: An inconsistent user interface issue was addressed with\nimproved state management.\nCVE-2026-64735: Gor Aleksanyan\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43739: impost0r (ret2plt), Ruslan Dautov, Aleksandr Tarasikov,\njay, Dhiyanesh Selvaraj (@redroot97), Vinay Kumar Rasala (Xplo8E) from\nAppknox, Lyutoon, DongJun Kim (smlijun) with UIUC, Hwiwon Lee (hwiwonl)\nwith UIUC, Jongseong Kim (nevul37) with UIUC, Younggi Park (grill66)\nwith UIUC, Peter Malone, an anonymous researcher, Hari Shanmugam (The\nHxr1), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR\nLabs SG Pte. Ltd., Marco Grassi, Dun, Daniele Castronovo, Michal\nKosiorek\nCVE-2026-43816: Josh Maine of Calif.io, Ruslan Dautov, \uc7ac\uc601 \uc815, @rootxran\n(Rao Ali Nawaz), Chanwit Muenprakoddee (ChemIndy), an anonymous\nresearcher, Ye Zhang (@VAR10CK) of Baidu Security, Franco Belman at\nBlackwing Intelligence, Christian Figueroa, Johnny Franks (@zeroxjf),\nAshmit Sharma \u0026 Atul RV, Peter Malone, Muhamad Syaiful, Muneeb Amin\nBhat, Dhiyanesh Selvaraj (@redroot97), Ali Marzouq, Bountyy Oy - Mihalis\nHaatainen, Huy Nguyen (@34306) of Calif.io\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43822: Eddy Tsalolikhin, Michal Kosiorek\nCVE-2026-64729: Josh Maine of Calif.io, beist, Adam Doup\u00e9 of ASU SEFCOM,\nDun, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR\nLabs SG Pte. Ltd., Johnny Franks (@zeroxjf)\nCVE-2026-64700: Asjid Kalam (@odinshell)\nCVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43817: Huy Nguyen (@34306) of Calif.io\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel)\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: A remote user may be able to cause unexpected system termination\nor corrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43810: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A memory initialization issue was addressed with improved\nmemory handling.\nCVE-2026-64775: Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: This issue was addressed with improved input validation.\nCVE-2026-39868: Vladislav Shevchenko (Positive Technologies), Ye Zhang\n(@VAR10CK) of Baidu Security, Billy Jheng Bing Jhong and Pan Zhenpeng\n(@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-64751: N.M.Praveen Nawarathne (@zblockrat)\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed through improved state management.\nCVE-2026-64721: Lukas Gerlach\n\nlibarchive\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted file may result in disclosure\nof process memory\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-4424\n\nLibnotify\nAvailable for: Apple Vision Pro (all models)\nImpact: An attacker may be able to cause unexpected app termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64739: Feng Xue and XGPT of ThreatBook, Dun\n\nlibxslt\nAvailable for: Apple Vis"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:47:48Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/22"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/22"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/en-us/128070"
        },
        {
          "url": "https://support.apple.com/kb/HT214009"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/22"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-07-27-2026-7 visionOS 26.6",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0045",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/22",
            "automated": true,
            "contentSha256": "da2c350129029fa4308f6df35ea2d022edc32b98e588d4408fd70659909849a8",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/22",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-28T00:27:26Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:47:48Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0045"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0292

Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-11 11:47
VLAI
Title
APPLE-SA-07-27-2026-6 watchOS 26.6
Summary
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-07-27-2026-6 watchOS 26.6 watchOS 26.6 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/128068. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accounts Framework Available for: Apple Watch Series 6 and later Impact: An app may be able to fingerprint the user Description: This issue was addressed with improved data protection. CVE-2026-64733: Rosyna Keller of Totally Not Malicious Software (paradisefacade.com) App Store Available for: Apple Watch Series 6 and later Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved checks. CVE-2026-43801: Rahul Raj Apple Neural Engine Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-28928: Dun Audio Available for: Apple Watch Series 6 and later Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/) AuthKit Available for: Apple Watch Series 6 and later Impact: An app may be able to fingerprint the user Description: A permissions issue was addressed with additional restrictions. CVE-2026-43730: David Strnadel AVEVideoEncoder Available for: Apple Watch Series 6 and later Impact: An app may be able to execute arbitrary code with kernel privileges Description: A buffer overflow was addressed with improved size validation. CVE-2026-64747: Franco Belman at Blackwing Intelligence CloudAttestation Available for: Apple Watch Series 6 and later Impact: A maliciously crafted app may be able to bypass code signing enforcement Description: A validation issue was addressed with improved input sanitization. CVE-2026-43813: Anton Pakhunov Contacts Available for: Apple Watch Series 6 and later Impact: An app may be able to add contacts without user authorization Description: An authorization issue was addressed with improved validation. CVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel Febrero Contacts Available for: Apple Watch Series 6 and later Impact: Processing a maliciously crafted contact may leak sensitive data Description: The issue was addressed with improved checks. CVE-2026-64734: Daniel Williams CoreAudio Available for: Apple Watch Series 6 and later Impact: Processing a maliciously crafted audio file may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative CoreAudio Available for: Apple Watch Series 6 and later Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43744: Mathis Mansière, an anonymous researcher CoreAudio Available for: Apple Watch Series 6 and later Impact: A remote attacker may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43803: Rahul Raj CoreMedia Available for: Apple Watch Series 6 and later Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: A memory corruption issue was addressed with improved memory handling. CVE-2026-43711: James Duffy (@0x4A616D657344) CoreMedia Available for: Apple Watch Series 6 and later Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-43759: 이재영, Rajdip Dey Sarkar, Arni Hardarson (Neonix Security) curl Available for: Apple Watch Series 6 and later Impact: Authentication credentials may be sent to a server on another origin Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2026-3784 CVE-2026-3783 Data Detectors UI Available for: Apple Watch Series 6 and later Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-43758: HvxyZLF Foundation Available for: Apple Watch Series 6 and later Impact: A malicious app may be able to access protected user data Description: The issue was addressed with improved input sanitization. CVE-2026-43714: an anonymous researcher FrontBoard Available for: Apple Watch Series 6 and later Impact: An app may be able to access sensitive user data Description: This issue was addressed by using HTTPS when sending information over the network. CVE-2026-64742: Huỳnh Tấn Ngàn Game Center Available for: Apple Watch Series 6 and later Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved data protection. CVE-2026-43796: Ilya Andr (andrd3v) of Positive Technologies, Stanislav Jelezoglo Heimdal Available for: Apple Watch Series 6 and later Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64692: Redon Gashi ImageIO Available for: Apple Watch Series 6 and later Impact: Processing a maliciously crafted texture may lead to unexpected app termination Description: An integer overflow was addressed with improved input validation. CVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative ImageIO Available for: Apple Watch Series 6 and later Impact: Processing a maliciously crafted image may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-64716: Arni Hardarson, Jonathan Alush-Aben, Peter Malone ImageIO Available for: Apple Watch Series 6 and later Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: The issue was addressed with improved bounds checks. CVE-2026-64758: 진규정 (Gyujeong Jin, @G1uN4sh) ImageIO Available for: Apple Watch Series 6 and later Impact: Processing a maliciously crafted file may lead to a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64754: PETOWORKS의 Bugeun Choi (@Bugeun), Rahul Raj ImageIO Available for: Apple Watch Series 6 and later Impact: Processing a maliciously crafted image may lead to a denial-of-service Description: A type confusion issue was addressed with improved checks. CVE-2026-64693: Geonha Lee (@leegn4a) IOGPUFamily Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination Description: A race condition was addressed with improved state handling. CVE-2026-43743: Lyutoon, Dun IOKit Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination or write kernel memory Description: A race condition was addressed with improved state handling. CVE-2026-43805: 이재영 Kernel Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2026-43778: f0r of MurphySec, Feng Xue and XGPT of ThreatBook, Mahmoud Abdelmoniem, an anonymous researcher, Wang Yu, Lyutoon, Hiroki Imai (LAC Co., Ltd.), DARKNAVY (@DarkNavyOrg), Fábio Luís @scanpt, Nicolas Rabrenovic Kernel Available for: Apple Watch Series 6 and later Impact: An app may be able to disclose kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64709: Pasquale Scola, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple Watch Series 6 and later Impact: A remote attacker may be able to bypass network filters Description: An inconsistent user interface issue was addressed with improved state management. CVE-2026-64735: Gor Aleksanyan Kernel Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43739: impost0r (ret2plt), Ruslan Dautov, Aleksandr Tarasikov, jay, Dhiyanesh Selvaraj (@redroot97), Vinay Kumar Rasala (Xplo8E) from Appknox, Lyutoon, DongJun Kim (smlijun) with UIUC, Hwiwon Lee (hwiwonl) with UIUC, Jongseong Kim (nevul37) with UIUC, Younggi Park (grill66) with UIUC, Peter Malone, an anonymous researcher, Hari Shanmugam (The Hxr1), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Marco Grassi, Dun, Daniele Castronovo, Michal Kosiorek CVE-2026-43816: Josh Maine of Calif.io, Ruslan Dautov, 재영 정, @rootxran (Rao Ali Nawaz), Chanwit Muenprakoddee (ChemIndy), an anonymous researcher, Ye Zhang (@VAR10CK) of Baidu Security, Franco Belman at Blackwing Intelligence, Christian Figueroa, Johnny Franks (@zeroxjf), Ashmit Sharma & Atul RV, Peter Malone, Muhamad Syaiful, Muneeb Amin Bhat, Dhiyanesh Selvaraj (@redroot97), Ali Marzouq, Bountyy Oy - Mihalis Haatainen, Huy Nguyen (@34306) of Calif.io Kernel Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-43822: Eddy Tsalolikhin, Michal Kosiorek CVE-2026-64729: Josh Maine of Calif.io, beist, Adam Doupé of ASU SEFCOM, Dun, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Johnny Franks (@zeroxjf) CVE-2026-43814: Somair Ansar, Huy Nguyen (@34306) of Calif.io CVE-2026-64700: Asjid Kalam (@odinshell) CVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple Watch Series 6 and later Impact: Connecting to a malicious NFS server may lead to kernel memory corruption Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-28931: Redon Gashi, Abhijeet Singh (linkedin.com/in/abhiunix/), Peter Malone, Omar Cerrito Kernel Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-43817: Huy Nguyen (@34306) of Calif.io Kernel Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination or write kernel memory Description: The issue was addressed with improved input sanitization. CVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel) Kernel Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination Description: An integer overflow was addressed with improved input validation. CVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple Watch Series 6 and later Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-43810: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination Description: A memory initialization issue was addressed with improved memory handling. CVE-2026-64775: Ryan Hileman via Xint Code (xint.io) Kernel Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: This issue was addressed with improved input validation. CVE-2026-39868: V
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Apple Watchos Affected: unknown
Create a notification for this product.
Credits
Apple Product Security via Fulldisclosure
Relationships
reference GCVE-1988-2026-0292 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Watchos",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-07-27-2026-6 watchOS 26.6\n\nwatchOS 26.6 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/128068.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccounts Framework\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to fingerprint the user\nDescription: This issue was addressed with improved data protection.\nCVE-2026-64733: Rosyna Keller of Totally Not Malicious Software\n(paradisefacade.com)\n\nApp Store\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved checks.\nCVE-2026-43801: Rahul Raj\n\nApple Neural Engine\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28928: Dun\n\nAudio\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\nAuthKit\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to fingerprint the user\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-43730: David Strnadel\n\nAVEVideoEncoder\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges\nDescription: A buffer overflow was addressed with improved size\nvalidation.\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\nCloudAttestation\nAvailable for: Apple Watch Series 6 and later\nImpact: A maliciously crafted app may be able to bypass code signing\nenforcement\nDescription: A validation issue was addressed with improved input\nsanitization.\nCVE-2026-43813: Anton Pakhunov\n\nContacts\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to add contacts without user authorization\nDescription: An authorization issue was addressed with improved\nvalidation.\nCVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel\nFebrero\n\nContacts\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted contact may leak sensitive data\nDescription: The issue was addressed with improved checks.\nCVE-2026-64734: Daniel Williams\n\nCoreAudio\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted audio file may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\nCoreAudio\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43744: Mathis Mansi\u00e8re, an anonymous researcher\n\nCoreAudio\nAvailable for: Apple Watch Series 6 and later\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43803: Rahul Raj\n\nCoreMedia\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\nCoreMedia\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-43759: \uc774\uc7ac\uc601, Rajdip Dey Sarkar, Arni Hardarson (Neonix Security)\n\ncurl\nAvailable for: Apple Watch Series 6 and later\nImpact: Authentication credentials may be sent to a server on another\norigin\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-3784\nCVE-2026-3783\n\nData Detectors UI\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-43758: HvxyZLF\n\nFoundation\nAvailable for: Apple Watch Series 6 and later\nImpact: A malicious app may be able to access protected user data\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43714: an anonymous researcher\n\nFrontBoard\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed by using HTTPS when sending\ninformation over the network.\nCVE-2026-64742: Hu\u1ef3nh T\u1ea5n Ng\u00e0n\n\nGame Center\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43796: Ilya Andr (andrd3v) of Positive Technologies, Stanislav\nJelezoglo\n\nHeimdal\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64692: Redon Gashi\n\nImageIO\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted texture may lead to unexpected\napp termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day\nInitiative\n\nImageIO\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64716: Arni Hardarson, Jonathan Alush-Aben, Peter Malone\n\nImageIO\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-64758: \uc9c4\uaddc\uc815 (Gyujeong Jin, @G1uN4sh)\n\nImageIO\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted file may lead to a\ndenial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64754: PETOWORKS\uc758 Bugeun Choi (@Bugeun), Rahul Raj\n\nImageIO\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted image may lead to a\ndenial-of-service\nDescription: A type confusion issue was addressed with improved checks.\nCVE-2026-64693: Geonha Lee (@leegn4a)\n\nIOGPUFamily\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-43743: Lyutoon, Dun\n\nIOKit\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-43805: \uc774\uc7ac\uc601\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43778: f0r of MurphySec, Feng Xue and XGPT of ThreatBook,\nMahmoud Abdelmoniem, an anonymous researcher, Wang Yu, Lyutoon, Hiroki\nImai (LAC Co., Ltd.), DARKNAVY (@DarkNavyOrg), F\u00e1bio Lu\u00eds @scanpt,\nNicolas Rabrenovic\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64709: Pasquale Scola, Billy Jheng Bing Jhong and Pan Zhenpeng\n(@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: A remote attacker may be able to bypass network filters\nDescription: An inconsistent user interface issue was addressed with\nimproved state management.\nCVE-2026-64735: Gor Aleksanyan\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43739: impost0r (ret2plt), Ruslan Dautov, Aleksandr Tarasikov,\njay, Dhiyanesh Selvaraj (@redroot97), Vinay Kumar Rasala (Xplo8E) from\nAppknox, Lyutoon, DongJun Kim (smlijun) with UIUC, Hwiwon Lee (hwiwonl)\nwith UIUC, Jongseong Kim (nevul37) with UIUC, Younggi Park (grill66)\nwith UIUC, Peter Malone, an anonymous researcher, Hari Shanmugam (The\nHxr1), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR\nLabs SG Pte. Ltd., Marco Grassi, Dun, Daniele Castronovo, Michal\nKosiorek\nCVE-2026-43816: Josh Maine of Calif.io, Ruslan Dautov, \uc7ac\uc601 \uc815, @rootxran\n(Rao Ali Nawaz), Chanwit Muenprakoddee (ChemIndy), an anonymous\nresearcher, Ye Zhang (@VAR10CK) of Baidu Security, Franco Belman at\nBlackwing Intelligence, Christian Figueroa, Johnny Franks (@zeroxjf),\nAshmit Sharma \u0026 Atul RV, Peter Malone, Muhamad Syaiful, Muneeb Amin\nBhat, Dhiyanesh Selvaraj (@redroot97), Ali Marzouq, Bountyy Oy - Mihalis\nHaatainen, Huy Nguyen (@34306) of Calif.io\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43822: Eddy Tsalolikhin, Michal Kosiorek\nCVE-2026-64729: Josh Maine of Calif.io, beist, Adam Doup\u00e9 of ASU SEFCOM,\nDun, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR\nLabs SG Pte. Ltd., Johnny Franks (@zeroxjf)\nCVE-2026-43814: Somair Ansar, Huy Nguyen (@34306) of Calif.io\nCVE-2026-64700: Asjid Kalam (@odinshell)\nCVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: Connecting to a malicious NFS server may lead to kernel memory\ncorruption\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28931: Redon Gashi, Abhijeet Singh (linkedin.com/in/abhiunix/),\nPeter Malone, Omar Cerrito\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43817: Huy Nguyen (@34306) of Calif.io\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel)\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: A remote user may be able to cause unexpected system termination\nor corrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43810: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A memory initialization issue was addressed with improved\nmemory handling.\nCVE-2026-64775: Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: This issue was addressed with improved input validation.\nCVE-2026-39868: V"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:47:47Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/21"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/21"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/en-us/128068"
        },
        {
          "url": "https://support.apple.com/kb/HT204641"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/21"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-07-27-2026-6 watchOS 26.6",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-28928",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28931",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28973",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28979",
              "type": "related"
            },
            {
              "destId": "CVE-2026-3783",
              "type": "related"
            },
            {
              "destId": "CVE-2026-3784",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39868",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39872",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43663",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43673",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43676",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43699",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43700",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43701",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43703",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43704",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43705",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43706",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43707",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43708",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43709",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43711",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43712",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43713",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43714",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43715",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43717",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43718",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43720",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43721",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43723",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43724",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43725",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43726",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43727",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43730",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43731",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43732",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43734",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43735",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43739",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43740",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43742",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43743",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43744",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43745",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43758",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43759",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43769",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43778",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43780",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43796",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43799",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43800",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43801",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43803",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43805",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43807",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43810",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43813",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43814",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43816",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43817",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43821",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43822",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64692",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64693",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64700",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64709",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64713",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64716",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64718",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64719",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64720",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64721",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64724",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64725",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64726",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64728",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64729",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64730",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64733",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64734",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64735",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64739",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64741",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64742",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64743",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64746",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64747",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64751",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64754",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64757",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64758",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64763",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64764",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64765",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64766",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64775",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64783",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0292",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/21",
            "automated": true,
            "contentSha256": "ffd6955a65f961da5d777187fc4e1798b0627198e546dddbe139826655056ca6",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/21",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-28T00:27:00Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0292"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:48Z",
    "dateUpdated": "2026-09-11T11:47:47Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0292"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0044

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:47
VLAI
Title
APPLE-SA-07-27-2026-6 watchOS 26.6
Summary
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-07-27-2026-6 watchOS 26.6 watchOS 26.6 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/128068. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accounts Framework Available for: Apple Watch Series 6 and later Impact: An app may be able to fingerprint the user Description: This issue was addressed with improved data protection. CVE-2026-64733: Rosyna Keller of Totally Not Malicious Software (paradisefacade.com) App Store Available for: Apple Watch Series 6 and later Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved checks. CVE-2026-43801: Rahul Raj Apple Neural Engine Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-28928: Dun Audio Available for: Apple Watch Series 6 and later Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/) AuthKit Available for: Apple Watch Series 6 and later Impact: An app may be able to fingerprint the user Description: A permissions issue was addressed with additional restrictions. CVE-2026-43730: David Strnadel AVEVideoEncoder Available for: Apple Watch Series 6 and later Impact: An app may be able to execute arbitrary code with kernel privileges Description: A buffer overflow was addressed with improved size validation. CVE-2026-64747: Franco Belman at Blackwing Intelligence CloudAttestation Available for: Apple Watch Series 6 and later Impact: A maliciously crafted app may be able to bypass code signing enforcement Description: A validation issue was addressed with improved input sanitization. CVE-2026-43813: Anton Pakhunov Contacts Available for: Apple Watch Series 6 and later Impact: An app may be able to add contacts without user authorization Description: An authorization issue was addressed with improved validation. CVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel Febrero Contacts Available for: Apple Watch Series 6 and later Impact: Processing a maliciously crafted contact may leak sensitive data Description: The issue was addressed with improved checks. CVE-2026-64734: Daniel Williams CoreAudio Available for: Apple Watch Series 6 and later Impact: Processing a maliciously crafted audio file may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative CoreAudio Available for: Apple Watch Series 6 and later Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43744: Mathis Mansière, an anonymous researcher CoreAudio Available for: Apple Watch Series 6 and later Impact: A remote attacker may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43803: Rahul Raj CoreMedia Available for: Apple Watch Series 6 and later Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: A memory corruption issue was addressed with improved memory handling. CVE-2026-43711: James Duffy (@0x4A616D657344) CoreMedia Available for: Apple Watch Series 6 and later Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-43759: 이재영, Rajdip Dey Sarkar, Arni Hardarson (Neonix Security) curl Available for: Apple Watch Series 6 and later Impact: Authentication credentials may be sent to a server on another origin Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2026-3784 CVE-2026-3783 Data Detectors UI Available for: Apple Watch Series 6 and later Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-43758: HvxyZLF Foundation Available for: Apple Watch Series 6 and later Impact: A malicious app may be able to access protected user data Description: The issue was addressed with improved input sanitization. CVE-2026-43714: an anonymous researcher FrontBoard Available for: Apple Watch Series 6 and later Impact: An app may be able to access sensitive user data Description: This issue was addressed by using HTTPS when sending information over the network. CVE-2026-64742: Huỳnh Tấn Ngàn Game Center Available for: Apple Watch Series 6 and later Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved data protection. CVE-2026-43796: Ilya Andr (andrd3v) of Positive Technologies, Stanislav Jelezoglo Heimdal Available for: Apple Watch Series 6 and later Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64692: Redon Gashi ImageIO Available for: Apple Watch Series 6 and later Impact: Processing a maliciously crafted texture may lead to unexpected app termination Description: An integer overflow was addressed with improved input validation. CVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative ImageIO Available for: Apple Watch Series 6 and later Impact: Processing a maliciously crafted image may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-64716: Arni Hardarson, Jonathan Alush-Aben, Peter Malone ImageIO Available for: Apple Watch Series 6 and later Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: The issue was addressed with improved bounds checks. CVE-2026-64758: 진규정 (Gyujeong Jin, @G1uN4sh) ImageIO Available for: Apple Watch Series 6 and later Impact: Processing a maliciously crafted file may lead to a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64754: PETOWORKS의 Bugeun Choi (@Bugeun), Rahul Raj ImageIO Available for: Apple Watch Series 6 and later Impact: Processing a maliciously crafted image may lead to a denial-of-service Description: A type confusion issue was addressed with improved checks. CVE-2026-64693: Geonha Lee (@leegn4a) IOGPUFamily Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination Description: A race condition was addressed with improved state handling. CVE-2026-43743: Lyutoon, Dun IOKit Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination or write kernel memory Description: A race condition was addressed with improved state handling. CVE-2026-43805: 이재영 Kernel Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2026-43778: f0r of MurphySec, Feng Xue and XGPT of ThreatBook, Mahmoud Abdelmoniem, an anonymous researcher, Wang Yu, Lyutoon, Hiroki Imai (LAC Co., Ltd.), DARKNAVY (@DarkNavyOrg), Fábio Luís @scanpt, Nicolas Rabrenovic Kernel Available for: Apple Watch Series 6 and later Impact: An app may be able to disclose kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64709: Pasquale Scola, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple Watch Series 6 and later Impact: A remote attacker may be able to bypass network filters Description: An inconsistent user interface issue was addressed with improved state management. CVE-2026-64735: Gor Aleksanyan Kernel Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43739: impost0r (ret2plt), Ruslan Dautov, Aleksandr Tarasikov, jay, Dhiyanesh Selvaraj (@redroot97), Vinay Kumar Rasala (Xplo8E) from Appknox, Lyutoon, DongJun Kim (smlijun) with UIUC, Hwiwon Lee (hwiwonl) with UIUC, Jongseong Kim (nevul37) with UIUC, Younggi Park (grill66) with UIUC, Peter Malone, an anonymous researcher, Hari Shanmugam (The Hxr1), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Marco Grassi, Dun, Daniele Castronovo, Michal Kosiorek CVE-2026-43816: Josh Maine of Calif.io, Ruslan Dautov, 재영 정, @rootxran (Rao Ali Nawaz), Chanwit Muenprakoddee (ChemIndy), an anonymous researcher, Ye Zhang (@VAR10CK) of Baidu Security, Franco Belman at Blackwing Intelligence, Christian Figueroa, Johnny Franks (@zeroxjf), Ashmit Sharma & Atul RV, Peter Malone, Muhamad Syaiful, Muneeb Amin Bhat, Dhiyanesh Selvaraj (@redroot97), Ali Marzouq, Bountyy Oy - Mihalis Haatainen, Huy Nguyen (@34306) of Calif.io Kernel Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-43822: Eddy Tsalolikhin, Michal Kosiorek CVE-2026-64729: Josh Maine of Calif.io, beist, Adam Doupé of ASU SEFCOM, Dun, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Johnny Franks (@zeroxjf) CVE-2026-43814: Somair Ansar, Huy Nguyen (@34306) of Calif.io CVE-2026-64700: Asjid Kalam (@odinshell) CVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple Watch Series 6 and later Impact: Connecting to a malicious NFS server may lead to kernel memory corruption Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-28931: Redon Gashi, Abhijeet Singh (linkedin.com/in/abhiunix/), Peter Malone, Omar Cerrito Kernel Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-43817: Huy Nguyen (@34306) of Calif.io Kernel Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination or write kernel memory Description: The issue was addressed with improved input sanitization. CVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel) Kernel Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination Description: An integer overflow was addressed with improved input validation. CVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple Watch Series 6 and later Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-43810: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination Description: A memory initialization issue was addressed with improved memory handling. CVE-2026-64775: Ryan Hileman via Xint Code (xint.io) Kernel Available for: Apple Watch Series 6 and later Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: This issue was addressed with improved input validation. CVE-2026-39868: V
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Apple Watchos Affected: unknown
Create a notification for this product.
Credits
Apple Product Security via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Watchos",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-07-27-2026-6 watchOS 26.6\n\nwatchOS 26.6 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/128068.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccounts Framework\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to fingerprint the user\nDescription: This issue was addressed with improved data protection.\nCVE-2026-64733: Rosyna Keller of Totally Not Malicious Software\n(paradisefacade.com)\n\nApp Store\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved checks.\nCVE-2026-43801: Rahul Raj\n\nApple Neural Engine\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28928: Dun\n\nAudio\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\nAuthKit\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to fingerprint the user\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-43730: David Strnadel\n\nAVEVideoEncoder\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges\nDescription: A buffer overflow was addressed with improved size\nvalidation.\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\nCloudAttestation\nAvailable for: Apple Watch Series 6 and later\nImpact: A maliciously crafted app may be able to bypass code signing\nenforcement\nDescription: A validation issue was addressed with improved input\nsanitization.\nCVE-2026-43813: Anton Pakhunov\n\nContacts\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to add contacts without user authorization\nDescription: An authorization issue was addressed with improved\nvalidation.\nCVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel\nFebrero\n\nContacts\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted contact may leak sensitive data\nDescription: The issue was addressed with improved checks.\nCVE-2026-64734: Daniel Williams\n\nCoreAudio\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted audio file may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\nCoreAudio\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43744: Mathis Mansi\u00e8re, an anonymous researcher\n\nCoreAudio\nAvailable for: Apple Watch Series 6 and later\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43803: Rahul Raj\n\nCoreMedia\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\nCoreMedia\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-43759: \uc774\uc7ac\uc601, Rajdip Dey Sarkar, Arni Hardarson (Neonix Security)\n\ncurl\nAvailable for: Apple Watch Series 6 and later\nImpact: Authentication credentials may be sent to a server on another\norigin\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-3784\nCVE-2026-3783\n\nData Detectors UI\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-43758: HvxyZLF\n\nFoundation\nAvailable for: Apple Watch Series 6 and later\nImpact: A malicious app may be able to access protected user data\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43714: an anonymous researcher\n\nFrontBoard\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed by using HTTPS when sending\ninformation over the network.\nCVE-2026-64742: Hu\u1ef3nh T\u1ea5n Ng\u00e0n\n\nGame Center\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43796: Ilya Andr (andrd3v) of Positive Technologies, Stanislav\nJelezoglo\n\nHeimdal\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64692: Redon Gashi\n\nImageIO\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted texture may lead to unexpected\napp termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day\nInitiative\n\nImageIO\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64716: Arni Hardarson, Jonathan Alush-Aben, Peter Malone\n\nImageIO\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-64758: \uc9c4\uaddc\uc815 (Gyujeong Jin, @G1uN4sh)\n\nImageIO\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted file may lead to a\ndenial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64754: PETOWORKS\uc758 Bugeun Choi (@Bugeun), Rahul Raj\n\nImageIO\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted image may lead to a\ndenial-of-service\nDescription: A type confusion issue was addressed with improved checks.\nCVE-2026-64693: Geonha Lee (@leegn4a)\n\nIOGPUFamily\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-43743: Lyutoon, Dun\n\nIOKit\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-43805: \uc774\uc7ac\uc601\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43778: f0r of MurphySec, Feng Xue and XGPT of ThreatBook,\nMahmoud Abdelmoniem, an anonymous researcher, Wang Yu, Lyutoon, Hiroki\nImai (LAC Co., Ltd.), DARKNAVY (@DarkNavyOrg), F\u00e1bio Lu\u00eds @scanpt,\nNicolas Rabrenovic\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64709: Pasquale Scola, Billy Jheng Bing Jhong and Pan Zhenpeng\n(@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: A remote attacker may be able to bypass network filters\nDescription: An inconsistent user interface issue was addressed with\nimproved state management.\nCVE-2026-64735: Gor Aleksanyan\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43739: impost0r (ret2plt), Ruslan Dautov, Aleksandr Tarasikov,\njay, Dhiyanesh Selvaraj (@redroot97), Vinay Kumar Rasala (Xplo8E) from\nAppknox, Lyutoon, DongJun Kim (smlijun) with UIUC, Hwiwon Lee (hwiwonl)\nwith UIUC, Jongseong Kim (nevul37) with UIUC, Younggi Park (grill66)\nwith UIUC, Peter Malone, an anonymous researcher, Hari Shanmugam (The\nHxr1), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR\nLabs SG Pte. Ltd., Marco Grassi, Dun, Daniele Castronovo, Michal\nKosiorek\nCVE-2026-43816: Josh Maine of Calif.io, Ruslan Dautov, \uc7ac\uc601 \uc815, @rootxran\n(Rao Ali Nawaz), Chanwit Muenprakoddee (ChemIndy), an anonymous\nresearcher, Ye Zhang (@VAR10CK) of Baidu Security, Franco Belman at\nBlackwing Intelligence, Christian Figueroa, Johnny Franks (@zeroxjf),\nAshmit Sharma \u0026 Atul RV, Peter Malone, Muhamad Syaiful, Muneeb Amin\nBhat, Dhiyanesh Selvaraj (@redroot97), Ali Marzouq, Bountyy Oy - Mihalis\nHaatainen, Huy Nguyen (@34306) of Calif.io\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43822: Eddy Tsalolikhin, Michal Kosiorek\nCVE-2026-64729: Josh Maine of Calif.io, beist, Adam Doup\u00e9 of ASU SEFCOM,\nDun, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR\nLabs SG Pte. Ltd., Johnny Franks (@zeroxjf)\nCVE-2026-43814: Somair Ansar, Huy Nguyen (@34306) of Calif.io\nCVE-2026-64700: Asjid Kalam (@odinshell)\nCVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: Connecting to a malicious NFS server may lead to kernel memory\ncorruption\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28931: Redon Gashi, Abhijeet Singh (linkedin.com/in/abhiunix/),\nPeter Malone, Omar Cerrito\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43817: Huy Nguyen (@34306) of Calif.io\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel)\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: A remote user may be able to cause unexpected system termination\nor corrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43810: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A memory initialization issue was addressed with improved\nmemory handling.\nCVE-2026-64775: Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: This issue was addressed with improved input validation.\nCVE-2026-39868: V"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:47:47Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/21"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/21"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/en-us/128068"
        },
        {
          "url": "https://support.apple.com/kb/HT204641"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/21"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-07-27-2026-6 watchOS 26.6",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0044",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/21",
            "automated": true,
            "contentSha256": "ffd6955a65f961da5d777187fc4e1798b0627198e546dddbe139826655056ca6",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/21",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-28T00:27:00Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:47:47Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0044"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
displaying 61 - 70 publications in total 387