- GNA identifier
- GNA-1988 GCVE registry Recent publications
Recent vulnerabilities
387 GCVE records assigned by this organization as GNA-1988GCVE-1988-2026-0291
Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-11 11:47
VLAI
EPSS
VEX
Title
APPLE-SA-07-27-2026-5 tvOS 26.6
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-07-27-2026-5 tvOS 26.6
tvOS 26.6 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/128069.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accounts Framework
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to fingerprint the user
Description: This issue was addressed with improved data protection.
CVE-2026-64733: Rosyna Keller of Totally Not Malicious Software
(paradisefacade.com)
App Store
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved checks.
CVE-2026-43801: Rahul Raj
Apple Neural Engine
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-28928: Dun
Audio
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause a denial-of-service
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)
AuthKit
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to fingerprint the user
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-43730: David Strnadel
AVEVideoEncoder
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to execute arbitrary code with kernel
privileges
Description: A buffer overflow was addressed with improved size
validation.
CVE-2026-64747: Franco Belman at Blackwing Intelligence
CloudAttestation
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: A maliciously crafted app may be able to bypass code signing
enforcement
Description: A validation issue was addressed with improved input
sanitization.
CVE-2026-43813: Anton Pakhunov
CoreAudio
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing a maliciously crafted audio file may corrupt process
memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative
CoreAudio
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing an audio stream in a maliciously crafted media file
may terminate the process
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43744: Mathis Mansière, an anonymous researcher
CoreAudio
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: A remote attacker may be able to cause unexpected system
termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43803: Rahul Raj
CoreMedia
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing a maliciously crafted video file may lead to
unexpected app termination
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2026-43711: James Duffy (@0x4A616D657344)
curl
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Authentication credentials may be sent to a server on another
origin
Description: This is a vulnerability in open source code and Apple
Software is among the affected projects. The CVE-ID was assigned by a
third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2026-3784
CVE-2026-3783
FrontBoard
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to access sensitive user data
Description: This issue was addressed by using HTTPS when sending
information over the network.
CVE-2026-64742: Huỳnh Tấn Ngàn
Game Center
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: A malicious app may be able to break out of its sandbox
Description: A parsing issue in the handling of directory paths was
addressed with improved path validation.
CVE-2026-64740: Manuel Fernandez (Stackhopper Security)
Game Center
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved data protection.
CVE-2026-43796: Ilya Andr (andrd3v) of Positive Technologies, Stanislav
Jelezoglo
Heimdal
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause a denial-of-service
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-64692: Redon Gashi
ImageIO
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing a maliciously crafted texture may lead to unexpected
app termination
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day
Initiative
ImageIO
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing a maliciously crafted image may corrupt process
memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64716: Arni Hardarson, Jonathan Alush-Aben, Peter Malone
ImageIO
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: The issue was addressed with improved bounds checks.
CVE-2026-64758: 진규정 (Gyujeong Jin, @G1uN4sh)
ImageIO
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing a maliciously crafted file may lead to a
denial-of-service
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-64754: PETOWORKS의 Bugeun Choi (@Bugeun), Rahul Raj
ImageIO
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing a maliciously crafted image may lead to a
denial-of-service
Description: A type confusion issue was addressed with improved checks.
CVE-2026-64693: Geonha Lee (@leegn4a)
IOGPUFamily
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause unexpected system termination
Description: A race condition was addressed with improved state
handling.
CVE-2026-43743: Lyutoon, Dun
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-43778: f0r of MurphySec, Feng Xue and XGPT of ThreatBook,
Mahmoud Abdelmoniem, an anonymous researcher, Wang Yu, Lyutoon, Hiroki
Imai (LAC Co., Ltd.), DARKNAVY (@DarkNavyOrg), Fábio Luís @scanpt,
Nicolas Rabrenovic
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to disclose kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64709: Pasquale Scola, Billy Jheng Bing Jhong and Pan Zhenpeng
(@Peterpan0927) of STAR Labs SG Pte. Ltd.
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: A remote attacker may be able to bypass network filters
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2026-64735: Gor Aleksanyan
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43739: impost0r (ret2plt), Ruslan Dautov, Aleksandr Tarasikov,
jay, Dhiyanesh Selvaraj (@redroot97), Vinay Kumar Rasala (Xplo8E) from
Appknox, Lyutoon, DongJun Kim (smlijun) with UIUC, Hwiwon Lee (hwiwonl)
with UIUC, Jongseong Kim (nevul37) with UIUC, Younggi Park (grill66)
with UIUC, Peter Malone, an anonymous researcher, Hari Shanmugam (The
Hxr1), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR
Labs SG Pte. Ltd., Marco Grassi, Dun, Daniele Castronovo, Michal
Kosiorek
CVE-2026-43816: Josh Maine of Calif.io, Ruslan Dautov, 재영 정, @rootxran
(Rao Ali Nawaz), Chanwit Muenprakoddee (ChemIndy), an anonymous
researcher, Ye Zhang (@VAR10CK) of Baidu Security, Franco Belman at
Blackwing Intelligence, Christian Figueroa, Johnny Franks (@zeroxjf),
Ashmit Sharma & Atul RV, Peter Malone, Muhamad Syaiful, Muneeb Amin
Bhat, Dhiyanesh Selvaraj (@redroot97), Ali Marzouq, Bountyy Oy - Mihalis
Haatainen, Huy Nguyen (@34306) of Calif.io
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-43822: Eddy Tsalolikhin, Michal Kosiorek
CVE-2026-64729: Josh Maine of Calif.io, beist, Adam Doupé of ASU SEFCOM,
Dun, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR
Labs SG Pte. Ltd., Johnny Franks (@zeroxjf)
CVE-2026-43814: Somair Ansar, Huy Nguyen (@34306) of Calif.io
CVE-2026-64700: Asjid Kalam (@odinshell)
CVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)
of STAR Labs SG Pte. Ltd.
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Connecting to a malicious NFS server may lead to kernel memory
corruption
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-28931: Redon Gashi, Abhijeet Singh (linkedin.com/in/abhiunix/),
Peter Malone, Omar Cerrito
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-43817: Huy Nguyen (@34306) of Calif.io
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause unexpected system termination or
write kernel memory
Description: The issue was addressed with improved input sanitization.
CVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel)
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause unexpected system termination
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)
of STAR Labs SG Pte. Ltd.
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause unexpected system termination
Description: A type confusion issue was addressed with improved memory
handling.
CVE-2026-64727: Ye Zhang (@VAR10CK) of Baidu Security
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: A remote user may be able to cause unexpected system termination
or corrupt kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43810: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)
of STAR Labs SG Pte. Ltd.
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause unexpected system termination
Description: A memory initialization issue was addressed with improved
memory handling.
CVE-2026-64775: Ryan Hileman via Xint Code (xint.io)
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: This issue was addressed with improved input validation.
CVE-2026-39868: Vladislav Shevchenko (Positive Technologies), Ye Zhang
(@VAR10CK) of Baidu Security, Billy Jheng Bing Jhong and Pan Zhenpeng
(@Peterpan0927) of STAR Labs SG Pte. Ltd.
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause unexpected system termination
Description: A race condition was addressed with improved state
handling.
CVE-2026-64720: an anonymous researcher, Asjid Kalam (@odinshell), Jian
Zhou and Ye Zhang
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause unexpected system
Severity
No CVSS data available.
Assigner
References
7 references
Relationships
reference
GCVE-1988-2026-0291 (this record)
- related CVE-2026-28928
- related CVE-2026-28931
- related CVE-2026-28979
- related CVE-2026-3783
- related CVE-2026-3784
- related CVE-2026-39868
- related CVE-2026-39872
- related CVE-2026-43663
- related CVE-2026-43673
- related CVE-2026-43699
- related CVE-2026-43700
- related CVE-2026-43701
- related CVE-2026-43703
- related CVE-2026-43704
- related CVE-2026-43705
- related CVE-2026-43706
- related CVE-2026-43707
- related CVE-2026-43708
- related CVE-2026-43709
- related CVE-2026-43711
- related CVE-2026-43712
- related CVE-2026-43713
- related CVE-2026-43715
- related CVE-2026-43717
- related CVE-2026-43718
- related CVE-2026-43720
- related CVE-2026-43721
- related CVE-2026-43723
- related CVE-2026-43724
- related CVE-2026-43725
- related CVE-2026-43726
- related CVE-2026-43729
- related CVE-2026-43730
- related CVE-2026-43731
- related CVE-2026-43732
- related CVE-2026-43734
- related CVE-2026-43735
- related CVE-2026-43739
- related CVE-2026-43740
- related CVE-2026-43742
- related CVE-2026-43743
- related CVE-2026-43744
- related CVE-2026-43745
- related CVE-2026-43769
- related CVE-2026-43770
- related CVE-2026-43778
- related CVE-2026-43780
- related CVE-2026-43796
- related CVE-2026-43799
- related CVE-2026-43800
- related CVE-2026-43801
- related CVE-2026-43803
- related CVE-2026-43807
- related CVE-2026-43810
- related CVE-2026-43812
- related CVE-2026-43813
- related CVE-2026-43814
- related CVE-2026-43816
- related CVE-2026-43817
- related CVE-2026-43821
- related CVE-2026-43822
- related CVE-2026-64692
- related CVE-2026-64693
- related CVE-2026-64700
- related CVE-2026-64709
- related CVE-2026-64713
- related CVE-2026-64716
- related CVE-2026-64718
- related CVE-2026-64719
- related CVE-2026-64720
- related CVE-2026-64721
- related CVE-2026-64724
- related CVE-2026-64725
- related CVE-2026-64726
- related CVE-2026-64727
- related CVE-2026-64728
- related CVE-2026-64729
- related CVE-2026-64730
- related CVE-2026-64733
- related CVE-2026-64735
- related CVE-2026-64739
- related CVE-2026-64740
- related CVE-2026-64741
- related CVE-2026-64742
- related CVE-2026-64743
- related CVE-2026-64747
- related CVE-2026-64751
- related CVE-2026-64754
- related CVE-2026-64758
- related CVE-2026-64763
- related CVE-2026-64764
- related CVE-2026-64765
- related CVE-2026-64766
- related CVE-2026-64768
- related CVE-2026-64769
- related CVE-2026-64770
- related CVE-2026-64771
- related CVE-2026-64772
- related CVE-2026-64774
- related CVE-2026-64775
{
"containers": {
"cna": {
"affected": [
{
"product": "Tvos",
"vendor": "Apple",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-07-27-2026-5 tvOS 26.6\n\ntvOS 26.6 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/128069.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccounts Framework\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to fingerprint the user\nDescription: This issue was addressed with improved data protection.\nCVE-2026-64733: Rosyna Keller of Totally Not Malicious Software\n(paradisefacade.com)\n\nApp Store\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved checks.\nCVE-2026-43801: Rahul Raj\n\nApple Neural Engine\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28928: Dun\n\nAudio\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\nAuthKit\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to fingerprint the user\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-43730: David Strnadel\n\nAVEVideoEncoder\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges\nDescription: A buffer overflow was addressed with improved size\nvalidation.\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\nCloudAttestation\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: A maliciously crafted app may be able to bypass code signing\nenforcement\nDescription: A validation issue was addressed with improved input\nsanitization.\nCVE-2026-43813: Anton Pakhunov\n\nCoreAudio\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted audio file may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\nCoreAudio\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43744: Mathis Mansi\u00e8re, an anonymous researcher\n\nCoreAudio\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43803: Rahul Raj\n\nCoreMedia\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\ncurl\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Authentication credentials may be sent to a server on another\norigin\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-3784\nCVE-2026-3783\n\nFrontBoard\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed by using HTTPS when sending\ninformation over the network.\nCVE-2026-64742: Hu\u1ef3nh T\u1ea5n Ng\u00e0n\n\nGame Center\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\nGame Center\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43796: Ilya Andr (andrd3v) of Positive Technologies, Stanislav\nJelezoglo\n\nHeimdal\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64692: Redon Gashi\n\nImageIO\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted texture may lead to unexpected\napp termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day\nInitiative\n\nImageIO\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64716: Arni Hardarson, Jonathan Alush-Aben, Peter Malone\n\nImageIO\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-64758: \uc9c4\uaddc\uc815 (Gyujeong Jin, @G1uN4sh)\n\nImageIO\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted file may lead to a\ndenial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64754: PETOWORKS\uc758 Bugeun Choi (@Bugeun), Rahul Raj\n\nImageIO\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted image may lead to a\ndenial-of-service\nDescription: A type confusion issue was addressed with improved checks.\nCVE-2026-64693: Geonha Lee (@leegn4a)\n\nIOGPUFamily\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-43743: Lyutoon, Dun\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43778: f0r of MurphySec, Feng Xue and XGPT of ThreatBook,\nMahmoud Abdelmoniem, an anonymous researcher, Wang Yu, Lyutoon, Hiroki\nImai (LAC Co., Ltd.), DARKNAVY (@DarkNavyOrg), F\u00e1bio Lu\u00eds @scanpt,\nNicolas Rabrenovic\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64709: Pasquale Scola, Billy Jheng Bing Jhong and Pan Zhenpeng\n(@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: A remote attacker may be able to bypass network filters\nDescription: An inconsistent user interface issue was addressed with\nimproved state management.\nCVE-2026-64735: Gor Aleksanyan\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43739: impost0r (ret2plt), Ruslan Dautov, Aleksandr Tarasikov,\njay, Dhiyanesh Selvaraj (@redroot97), Vinay Kumar Rasala (Xplo8E) from\nAppknox, Lyutoon, DongJun Kim (smlijun) with UIUC, Hwiwon Lee (hwiwonl)\nwith UIUC, Jongseong Kim (nevul37) with UIUC, Younggi Park (grill66)\nwith UIUC, Peter Malone, an anonymous researcher, Hari Shanmugam (The\nHxr1), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR\nLabs SG Pte. Ltd., Marco Grassi, Dun, Daniele Castronovo, Michal\nKosiorek\nCVE-2026-43816: Josh Maine of Calif.io, Ruslan Dautov, \uc7ac\uc601 \uc815, @rootxran\n(Rao Ali Nawaz), Chanwit Muenprakoddee (ChemIndy), an anonymous\nresearcher, Ye Zhang (@VAR10CK) of Baidu Security, Franco Belman at\nBlackwing Intelligence, Christian Figueroa, Johnny Franks (@zeroxjf),\nAshmit Sharma \u0026 Atul RV, Peter Malone, Muhamad Syaiful, Muneeb Amin\nBhat, Dhiyanesh Selvaraj (@redroot97), Ali Marzouq, Bountyy Oy - Mihalis\nHaatainen, Huy Nguyen (@34306) of Calif.io\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43822: Eddy Tsalolikhin, Michal Kosiorek\nCVE-2026-64729: Josh Maine of Calif.io, beist, Adam Doup\u00e9 of ASU SEFCOM,\nDun, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR\nLabs SG Pte. Ltd., Johnny Franks (@zeroxjf)\nCVE-2026-43814: Somair Ansar, Huy Nguyen (@34306) of Calif.io\nCVE-2026-64700: Asjid Kalam (@odinshell)\nCVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Connecting to a malicious NFS server may lead to kernel memory\ncorruption\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28931: Redon Gashi, Abhijeet Singh (linkedin.com/in/abhiunix/),\nPeter Malone, Omar Cerrito\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43817: Huy Nguyen (@34306) of Calif.io\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel)\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A type confusion issue was addressed with improved memory\nhandling.\nCVE-2026-64727: Ye Zhang (@VAR10CK) of Baidu Security\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: A remote user may be able to cause unexpected system termination\nor corrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43810: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A memory initialization issue was addressed with improved\nmemory handling.\nCVE-2026-64775: Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: This issue was addressed with improved input validation.\nCVE-2026-39868: Vladislav Shevchenko (Positive Technologies), Ye Zhang\n(@VAR10CK) of Baidu Security, Billy Jheng Bing Jhong and Pan Zhenpeng\n(@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-64720: an anonymous researcher, Asjid Kalam (@odinshell), Jian\nZhou and Ye Zhang\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system "
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:47:46Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/20"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/20"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/en-us/128069"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/20"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-07-27-2026-5 tvOS 26.6",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-28928",
"type": "related"
},
{
"destId": "CVE-2026-28931",
"type": "related"
},
{
"destId": "CVE-2026-28979",
"type": "related"
},
{
"destId": "CVE-2026-3783",
"type": "related"
},
{
"destId": "CVE-2026-3784",
"type": "related"
},
{
"destId": "CVE-2026-39868",
"type": "related"
},
{
"destId": "CVE-2026-39872",
"type": "related"
},
{
"destId": "CVE-2026-43663",
"type": "related"
},
{
"destId": "CVE-2026-43673",
"type": "related"
},
{
"destId": "CVE-2026-43699",
"type": "related"
},
{
"destId": "CVE-2026-43700",
"type": "related"
},
{
"destId": "CVE-2026-43701",
"type": "related"
},
{
"destId": "CVE-2026-43703",
"type": "related"
},
{
"destId": "CVE-2026-43704",
"type": "related"
},
{
"destId": "CVE-2026-43705",
"type": "related"
},
{
"destId": "CVE-2026-43706",
"type": "related"
},
{
"destId": "CVE-2026-43707",
"type": "related"
},
{
"destId": "CVE-2026-43708",
"type": "related"
},
{
"destId": "CVE-2026-43709",
"type": "related"
},
{
"destId": "CVE-2026-43711",
"type": "related"
},
{
"destId": "CVE-2026-43712",
"type": "related"
},
{
"destId": "CVE-2026-43713",
"type": "related"
},
{
"destId": "CVE-2026-43715",
"type": "related"
},
{
"destId": "CVE-2026-43717",
"type": "related"
},
{
"destId": "CVE-2026-43718",
"type": "related"
},
{
"destId": "CVE-2026-43720",
"type": "related"
},
{
"destId": "CVE-2026-43721",
"type": "related"
},
{
"destId": "CVE-2026-43723",
"type": "related"
},
{
"destId": "CVE-2026-43724",
"type": "related"
},
{
"destId": "CVE-2026-43725",
"type": "related"
},
{
"destId": "CVE-2026-43726",
"type": "related"
},
{
"destId": "CVE-2026-43729",
"type": "related"
},
{
"destId": "CVE-2026-43730",
"type": "related"
},
{
"destId": "CVE-2026-43731",
"type": "related"
},
{
"destId": "CVE-2026-43732",
"type": "related"
},
{
"destId": "CVE-2026-43734",
"type": "related"
},
{
"destId": "CVE-2026-43735",
"type": "related"
},
{
"destId": "CVE-2026-43739",
"type": "related"
},
{
"destId": "CVE-2026-43740",
"type": "related"
},
{
"destId": "CVE-2026-43742",
"type": "related"
},
{
"destId": "CVE-2026-43743",
"type": "related"
},
{
"destId": "CVE-2026-43744",
"type": "related"
},
{
"destId": "CVE-2026-43745",
"type": "related"
},
{
"destId": "CVE-2026-43769",
"type": "related"
},
{
"destId": "CVE-2026-43770",
"type": "related"
},
{
"destId": "CVE-2026-43778",
"type": "related"
},
{
"destId": "CVE-2026-43780",
"type": "related"
},
{
"destId": "CVE-2026-43796",
"type": "related"
},
{
"destId": "CVE-2026-43799",
"type": "related"
},
{
"destId": "CVE-2026-43800",
"type": "related"
},
{
"destId": "CVE-2026-43801",
"type": "related"
},
{
"destId": "CVE-2026-43803",
"type": "related"
},
{
"destId": "CVE-2026-43807",
"type": "related"
},
{
"destId": "CVE-2026-43810",
"type": "related"
},
{
"destId": "CVE-2026-43812",
"type": "related"
},
{
"destId": "CVE-2026-43813",
"type": "related"
},
{
"destId": "CVE-2026-43814",
"type": "related"
},
{
"destId": "CVE-2026-43816",
"type": "related"
},
{
"destId": "CVE-2026-43817",
"type": "related"
},
{
"destId": "CVE-2026-43821",
"type": "related"
},
{
"destId": "CVE-2026-43822",
"type": "related"
},
{
"destId": "CVE-2026-64692",
"type": "related"
},
{
"destId": "CVE-2026-64693",
"type": "related"
},
{
"destId": "CVE-2026-64700",
"type": "related"
},
{
"destId": "CVE-2026-64709",
"type": "related"
},
{
"destId": "CVE-2026-64713",
"type": "related"
},
{
"destId": "CVE-2026-64716",
"type": "related"
},
{
"destId": "CVE-2026-64718",
"type": "related"
},
{
"destId": "CVE-2026-64719",
"type": "related"
},
{
"destId": "CVE-2026-64720",
"type": "related"
},
{
"destId": "CVE-2026-64721",
"type": "related"
},
{
"destId": "CVE-2026-64724",
"type": "related"
},
{
"destId": "CVE-2026-64725",
"type": "related"
},
{
"destId": "CVE-2026-64726",
"type": "related"
},
{
"destId": "CVE-2026-64727",
"type": "related"
},
{
"destId": "CVE-2026-64728",
"type": "related"
},
{
"destId": "CVE-2026-64729",
"type": "related"
},
{
"destId": "CVE-2026-64730",
"type": "related"
},
{
"destId": "CVE-2026-64733",
"type": "related"
},
{
"destId": "CVE-2026-64735",
"type": "related"
},
{
"destId": "CVE-2026-64739",
"type": "related"
},
{
"destId": "CVE-2026-64740",
"type": "related"
},
{
"destId": "CVE-2026-64741",
"type": "related"
},
{
"destId": "CVE-2026-64742",
"type": "related"
},
{
"destId": "CVE-2026-64743",
"type": "related"
},
{
"destId": "CVE-2026-64747",
"type": "related"
},
{
"destId": "CVE-2026-64751",
"type": "related"
},
{
"destId": "CVE-2026-64754",
"type": "related"
},
{
"destId": "CVE-2026-64758",
"type": "related"
},
{
"destId": "CVE-2026-64763",
"type": "related"
},
{
"destId": "CVE-2026-64764",
"type": "related"
},
{
"destId": "CVE-2026-64765",
"type": "related"
},
{
"destId": "CVE-2026-64766",
"type": "related"
},
{
"destId": "CVE-2026-64768",
"type": "related"
},
{
"destId": "CVE-2026-64769",
"type": "related"
},
{
"destId": "CVE-2026-64770",
"type": "related"
},
{
"destId": "CVE-2026-64771",
"type": "related"
},
{
"destId": "CVE-2026-64772",
"type": "related"
},
{
"destId": "CVE-2026-64774",
"type": "related"
},
{
"destId": "CVE-2026-64775",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0291",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/20",
"automated": true,
"contentSha256": "2aca66bf0b36d14d22534543b23c469e414626d904471132d2e37c7f2a16abf1",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/20",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-07-28T00:24:11Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0291"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T11:40:47Z",
"dateUpdated": "2026-09-11T11:47:46Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0291"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0043
Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:47
VLAI
EPSS
VEX
Title
APPLE-SA-07-27-2026-5 tvOS 26.6
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-07-27-2026-5 tvOS 26.6
tvOS 26.6 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/128069.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accounts Framework
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to fingerprint the user
Description: This issue was addressed with improved data protection.
CVE-2026-64733: Rosyna Keller of Totally Not Malicious Software
(paradisefacade.com)
App Store
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved checks.
CVE-2026-43801: Rahul Raj
Apple Neural Engine
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-28928: Dun
Audio
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause a denial-of-service
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)
AuthKit
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to fingerprint the user
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-43730: David Strnadel
AVEVideoEncoder
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to execute arbitrary code with kernel
privileges
Description: A buffer overflow was addressed with improved size
validation.
CVE-2026-64747: Franco Belman at Blackwing Intelligence
CloudAttestation
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: A maliciously crafted app may be able to bypass code signing
enforcement
Description: A validation issue was addressed with improved input
sanitization.
CVE-2026-43813: Anton Pakhunov
CoreAudio
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing a maliciously crafted audio file may corrupt process
memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative
CoreAudio
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing an audio stream in a maliciously crafted media file
may terminate the process
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43744: Mathis Mansière, an anonymous researcher
CoreAudio
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: A remote attacker may be able to cause unexpected system
termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43803: Rahul Raj
CoreMedia
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing a maliciously crafted video file may lead to
unexpected app termination
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2026-43711: James Duffy (@0x4A616D657344)
curl
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Authentication credentials may be sent to a server on another
origin
Description: This is a vulnerability in open source code and Apple
Software is among the affected projects. The CVE-ID was assigned by a
third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2026-3784
CVE-2026-3783
FrontBoard
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to access sensitive user data
Description: This issue was addressed by using HTTPS when sending
information over the network.
CVE-2026-64742: Huỳnh Tấn Ngàn
Game Center
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: A malicious app may be able to break out of its sandbox
Description: A parsing issue in the handling of directory paths was
addressed with improved path validation.
CVE-2026-64740: Manuel Fernandez (Stackhopper Security)
Game Center
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved data protection.
CVE-2026-43796: Ilya Andr (andrd3v) of Positive Technologies, Stanislav
Jelezoglo
Heimdal
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause a denial-of-service
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-64692: Redon Gashi
ImageIO
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing a maliciously crafted texture may lead to unexpected
app termination
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day
Initiative
ImageIO
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing a maliciously crafted image may corrupt process
memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64716: Arni Hardarson, Jonathan Alush-Aben, Peter Malone
ImageIO
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: The issue was addressed with improved bounds checks.
CVE-2026-64758: 진규정 (Gyujeong Jin, @G1uN4sh)
ImageIO
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing a maliciously crafted file may lead to a
denial-of-service
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-64754: PETOWORKS의 Bugeun Choi (@Bugeun), Rahul Raj
ImageIO
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing a maliciously crafted image may lead to a
denial-of-service
Description: A type confusion issue was addressed with improved checks.
CVE-2026-64693: Geonha Lee (@leegn4a)
IOGPUFamily
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause unexpected system termination
Description: A race condition was addressed with improved state
handling.
CVE-2026-43743: Lyutoon, Dun
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-43778: f0r of MurphySec, Feng Xue and XGPT of ThreatBook,
Mahmoud Abdelmoniem, an anonymous researcher, Wang Yu, Lyutoon, Hiroki
Imai (LAC Co., Ltd.), DARKNAVY (@DarkNavyOrg), Fábio Luís @scanpt,
Nicolas Rabrenovic
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to disclose kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64709: Pasquale Scola, Billy Jheng Bing Jhong and Pan Zhenpeng
(@Peterpan0927) of STAR Labs SG Pte. Ltd.
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: A remote attacker may be able to bypass network filters
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2026-64735: Gor Aleksanyan
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43739: impost0r (ret2plt), Ruslan Dautov, Aleksandr Tarasikov,
jay, Dhiyanesh Selvaraj (@redroot97), Vinay Kumar Rasala (Xplo8E) from
Appknox, Lyutoon, DongJun Kim (smlijun) with UIUC, Hwiwon Lee (hwiwonl)
with UIUC, Jongseong Kim (nevul37) with UIUC, Younggi Park (grill66)
with UIUC, Peter Malone, an anonymous researcher, Hari Shanmugam (The
Hxr1), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR
Labs SG Pte. Ltd., Marco Grassi, Dun, Daniele Castronovo, Michal
Kosiorek
CVE-2026-43816: Josh Maine of Calif.io, Ruslan Dautov, 재영 정, @rootxran
(Rao Ali Nawaz), Chanwit Muenprakoddee (ChemIndy), an anonymous
researcher, Ye Zhang (@VAR10CK) of Baidu Security, Franco Belman at
Blackwing Intelligence, Christian Figueroa, Johnny Franks (@zeroxjf),
Ashmit Sharma & Atul RV, Peter Malone, Muhamad Syaiful, Muneeb Amin
Bhat, Dhiyanesh Selvaraj (@redroot97), Ali Marzouq, Bountyy Oy - Mihalis
Haatainen, Huy Nguyen (@34306) of Calif.io
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-43822: Eddy Tsalolikhin, Michal Kosiorek
CVE-2026-64729: Josh Maine of Calif.io, beist, Adam Doupé of ASU SEFCOM,
Dun, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR
Labs SG Pte. Ltd., Johnny Franks (@zeroxjf)
CVE-2026-43814: Somair Ansar, Huy Nguyen (@34306) of Calif.io
CVE-2026-64700: Asjid Kalam (@odinshell)
CVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)
of STAR Labs SG Pte. Ltd.
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Connecting to a malicious NFS server may lead to kernel memory
corruption
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-28931: Redon Gashi, Abhijeet Singh (linkedin.com/in/abhiunix/),
Peter Malone, Omar Cerrito
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-43817: Huy Nguyen (@34306) of Calif.io
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause unexpected system termination or
write kernel memory
Description: The issue was addressed with improved input sanitization.
CVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel)
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause unexpected system termination
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)
of STAR Labs SG Pte. Ltd.
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause unexpected system termination
Description: A type confusion issue was addressed with improved memory
handling.
CVE-2026-64727: Ye Zhang (@VAR10CK) of Baidu Security
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: A remote user may be able to cause unexpected system termination
or corrupt kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43810: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)
of STAR Labs SG Pte. Ltd.
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause unexpected system termination
Description: A memory initialization issue was addressed with improved
memory handling.
CVE-2026-64775: Ryan Hileman via Xint Code (xint.io)
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: This issue was addressed with improved input validation.
CVE-2026-39868: Vladislav Shevchenko (Positive Technologies), Ye Zhang
(@VAR10CK) of Baidu Security, Billy Jheng Bing Jhong and Pan Zhenpeng
(@Peterpan0927) of STAR Labs SG Pte. Ltd.
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause unexpected system termination
Description: A race condition was addressed with improved state
handling.
CVE-2026-64720: an anonymous researcher, Asjid Kalam (@odinshell), Jian
Zhou and Ye Zhang
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause unexpected system
Severity
No CVSS data available.
Assigner
References
7 references
{
"containers": {
"cna": {
"affected": [
{
"product": "Tvos",
"vendor": "Apple",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-07-27-2026-5 tvOS 26.6\n\ntvOS 26.6 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/128069.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccounts Framework\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to fingerprint the user\nDescription: This issue was addressed with improved data protection.\nCVE-2026-64733: Rosyna Keller of Totally Not Malicious Software\n(paradisefacade.com)\n\nApp Store\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved checks.\nCVE-2026-43801: Rahul Raj\n\nApple Neural Engine\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28928: Dun\n\nAudio\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\nAuthKit\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to fingerprint the user\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-43730: David Strnadel\n\nAVEVideoEncoder\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges\nDescription: A buffer overflow was addressed with improved size\nvalidation.\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\nCloudAttestation\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: A maliciously crafted app may be able to bypass code signing\nenforcement\nDescription: A validation issue was addressed with improved input\nsanitization.\nCVE-2026-43813: Anton Pakhunov\n\nCoreAudio\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted audio file may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\nCoreAudio\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43744: Mathis Mansi\u00e8re, an anonymous researcher\n\nCoreAudio\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43803: Rahul Raj\n\nCoreMedia\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\ncurl\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Authentication credentials may be sent to a server on another\norigin\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-3784\nCVE-2026-3783\n\nFrontBoard\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed by using HTTPS when sending\ninformation over the network.\nCVE-2026-64742: Hu\u1ef3nh T\u1ea5n Ng\u00e0n\n\nGame Center\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\nGame Center\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43796: Ilya Andr (andrd3v) of Positive Technologies, Stanislav\nJelezoglo\n\nHeimdal\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64692: Redon Gashi\n\nImageIO\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted texture may lead to unexpected\napp termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day\nInitiative\n\nImageIO\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64716: Arni Hardarson, Jonathan Alush-Aben, Peter Malone\n\nImageIO\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-64758: \uc9c4\uaddc\uc815 (Gyujeong Jin, @G1uN4sh)\n\nImageIO\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted file may lead to a\ndenial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64754: PETOWORKS\uc758 Bugeun Choi (@Bugeun), Rahul Raj\n\nImageIO\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted image may lead to a\ndenial-of-service\nDescription: A type confusion issue was addressed with improved checks.\nCVE-2026-64693: Geonha Lee (@leegn4a)\n\nIOGPUFamily\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-43743: Lyutoon, Dun\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43778: f0r of MurphySec, Feng Xue and XGPT of ThreatBook,\nMahmoud Abdelmoniem, an anonymous researcher, Wang Yu, Lyutoon, Hiroki\nImai (LAC Co., Ltd.), DARKNAVY (@DarkNavyOrg), F\u00e1bio Lu\u00eds @scanpt,\nNicolas Rabrenovic\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64709: Pasquale Scola, Billy Jheng Bing Jhong and Pan Zhenpeng\n(@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: A remote attacker may be able to bypass network filters\nDescription: An inconsistent user interface issue was addressed with\nimproved state management.\nCVE-2026-64735: Gor Aleksanyan\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43739: impost0r (ret2plt), Ruslan Dautov, Aleksandr Tarasikov,\njay, Dhiyanesh Selvaraj (@redroot97), Vinay Kumar Rasala (Xplo8E) from\nAppknox, Lyutoon, DongJun Kim (smlijun) with UIUC, Hwiwon Lee (hwiwonl)\nwith UIUC, Jongseong Kim (nevul37) with UIUC, Younggi Park (grill66)\nwith UIUC, Peter Malone, an anonymous researcher, Hari Shanmugam (The\nHxr1), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR\nLabs SG Pte. Ltd., Marco Grassi, Dun, Daniele Castronovo, Michal\nKosiorek\nCVE-2026-43816: Josh Maine of Calif.io, Ruslan Dautov, \uc7ac\uc601 \uc815, @rootxran\n(Rao Ali Nawaz), Chanwit Muenprakoddee (ChemIndy), an anonymous\nresearcher, Ye Zhang (@VAR10CK) of Baidu Security, Franco Belman at\nBlackwing Intelligence, Christian Figueroa, Johnny Franks (@zeroxjf),\nAshmit Sharma \u0026 Atul RV, Peter Malone, Muhamad Syaiful, Muneeb Amin\nBhat, Dhiyanesh Selvaraj (@redroot97), Ali Marzouq, Bountyy Oy - Mihalis\nHaatainen, Huy Nguyen (@34306) of Calif.io\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43822: Eddy Tsalolikhin, Michal Kosiorek\nCVE-2026-64729: Josh Maine of Calif.io, beist, Adam Doup\u00e9 of ASU SEFCOM,\nDun, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR\nLabs SG Pte. Ltd., Johnny Franks (@zeroxjf)\nCVE-2026-43814: Somair Ansar, Huy Nguyen (@34306) of Calif.io\nCVE-2026-64700: Asjid Kalam (@odinshell)\nCVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Connecting to a malicious NFS server may lead to kernel memory\ncorruption\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28931: Redon Gashi, Abhijeet Singh (linkedin.com/in/abhiunix/),\nPeter Malone, Omar Cerrito\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43817: Huy Nguyen (@34306) of Calif.io\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43724: impost0r (ret2plt), Hyunwoo Kim (@v4bel)\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A type confusion issue was addressed with improved memory\nhandling.\nCVE-2026-64727: Ye Zhang (@VAR10CK) of Baidu Security\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: A remote user may be able to cause unexpected system termination\nor corrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43810: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A memory initialization issue was addressed with improved\nmemory handling.\nCVE-2026-64775: Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: This issue was addressed with improved input validation.\nCVE-2026-39868: Vladislav Shevchenko (Positive Technologies), Ye Zhang\n(@VAR10CK) of Baidu Security, Billy Jheng Bing Jhong and Pan Zhenpeng\n(@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-64720: an anonymous researcher, Asjid Kalam (@odinshell), Jian\nZhou and Ye Zhang\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system "
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:47:46Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/20"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/20"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/en-us/128069"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/20"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-07-27-2026-5 tvOS 26.6",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0043",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/20",
"automated": true,
"contentSha256": "2aca66bf0b36d14d22534543b23c469e414626d904471132d2e37c7f2a16abf1",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/20",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-07-28T00:24:11Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:21Z",
"dateUpdated": "2026-09-11T11:47:46Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0043"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0290
Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-11 11:47
VLAI
EPSS
VEX
Title
APPLE-SA-07-27-2026-4 macOS Sonoma 14.8.8
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-07-27-2026-4 macOS Sonoma 14.8.8
macOS Sonoma 14.8.8 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/128072.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accounts
Available for: macOS Sonoma
Impact: An app may be able to gain root privileges
Description: A parsing issue in the handling of directory paths was
addressed with improved path validation.
CVE-2026-43749: Adam Franke, Trung Nguyen (@everping) of CyStack, Ashish
Kunwar
afpfs
Available for: macOS Sonoma
Impact: A remote attacker may be able to cause unexpected system
termination or corrupt kernel memory
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-64767: Dave G.
apache
Available for: macOS Sonoma
Impact: A remote attacker may be able to cause a denial-of-service
Description: This is a vulnerability in open source code and Apple
Software is among the affected projects. The CVE-ID was assigned by a
third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2026-23918: Юлия Мерцалова
APFS
Available for: macOS Sonoma
Impact: A remote user may be able to cause unexpected system termination
or corrupt kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64695: Peter Malone
App Store
Available for: macOS Sonoma
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved checks.
CVE-2026-43801: Rahul Raj
Apple Account
Available for: macOS Sonoma
Impact: An app may be able to access sensitive user data
Description: A race condition was addressed with improved state
handling.
CVE-2026-43781: Pinak Oza
Apple Account
Available for: macOS Sonoma
Impact: A malicious app may be able to break out of its sandbox
Description: An authorization issue was addressed with improved state
management.
CVE-2026-64737: Robert Mindo
AppleRAID
Available for: macOS Sonoma
Impact: A local user may be able to read kernel memory
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-43681: impost0r (ret2plt), David Ige - Beryllium Security
Assets
Available for: macOS Sonoma
Impact: A malicious application may be able to bypass Privacy
preferences
Description: An authorization issue was addressed with improved state
management.
CVE-2026-43672: 이재영
ATS
Available for: macOS Sonoma
Impact: An app may be able to read files outside of its sandbox
Description: A permissions issue was addressed by removing the
vulnerable code.
CVE-2026-43763: Pavan Nallamothu, Jared Reyes
Audio
Available for: macOS Sonoma
Impact: An app may be able to break out of its sandbox
Description: An access issue was addressed with additional sandbox
restrictions.
CVE-2026-64702: John Lussier
Audio
Available for: macOS Sonoma
Impact: An app may be able to cause a denial-of-service
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)
AVEVideoEncoder
Available for: macOS Sonoma
Impact: An app may be able to execute arbitrary code with kernel
privileges
Description: A buffer overflow was addressed with improved size
validation.
CVE-2026-64747: Franco Belman at Blackwing Intelligence
AVEVideoEncoder
Available for: macOS Sonoma
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun
BackgroundAssets
Available for: macOS Sonoma
Impact: An app may be able to delete files for which it does not have
permission
Description: A permissions issue was addressed with improved validation.
CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab
BOM
Available for: macOS Sonoma
Impact: A maliciously crafted ZIP archive may bypass Gatekeeper checks
Description: The issue was addressed with improved checks.
CVE-2026-28849: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
cd9660
Available for: macOS Sonoma
Impact: An app may be able to cause unexpected system termination or
read kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64698: Richard Zana, Peter Malone, Nathaniel Oh (@calysteon),
an anonymous researcher
Contacts
Available for: macOS Sonoma
Impact: Processing a maliciously crafted contact may leak sensitive data
Description: The issue was addressed with improved checks.
CVE-2026-64734: Daniel Williams
Control Center
Available for: macOS Sonoma
Impact: An app may be able to access user-sensitive data
Description: A logic issue was addressed with improved validation.
CVE-2026-43756: 이재영
Core Services
Available for: macOS Sonoma
Impact: An app may be able to gain root privileges
Description: A race condition was addressed with improved state
handling.
CVE-2026-43693: Gergely Kalman (@gergely_kalman)
CoreAudio
Available for: macOS Sonoma
Impact: Processing a maliciously crafted audio file may corrupt process
memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative
CoreAudio
Available for: macOS Sonoma
Impact: Processing an audio stream in a maliciously crafted media file
may terminate the process
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43744: Mathis Mansière, an anonymous researcher
CoreAudio
Available for: macOS Sonoma
Impact: A remote attacker may be able to cause unexpected system
termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43803: Rahul Raj
CoreMedia
Available for: macOS Sonoma
Impact: Processing a maliciously crafted video file may lead to
unexpected app termination
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2026-43711: James Duffy (@0x4A616D657344)
CoreServices
Available for: macOS Sonoma
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: The issue was addressed with improved checks.
CVE-2026-28936: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
CoreUI
Available for: macOS Sonoma
Impact: Processing a maliciously crafted asset catalog may result in
disclosure of process memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43738: Peter Malone
CoreVideo
Available for: macOS Sonoma
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43802: an anonymous researcher
Crash Reporter
Available for: macOS Sonoma
Impact: An app may be able to leak sensitive user information
Description: A privacy issue was addressed by removing sensitive data.
CVE-2026-64710: Matthew Schneider
CUPS
Available for: macOS Sonoma
Impact: A malicious app may be able to gain root privileges
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-39875: XBreach.ai, Dallas Dubs, Andreas Jaegersberger & Ro
Achterberg of Nosebeard Labs, Aaron Grattafiori - NVIDIA AI Red Team
CUPS
Available for: macOS Sonoma
Impact: An app may be able to gain root privileges
Description: An injection issue was addressed with improved validation.
CVE-2026-43698: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
curl
Available for: macOS Sonoma
Impact: Authentication credentials may be sent to a server on another
origin
Description: This is a vulnerability in open source code and Apple
Software is among the affected projects. The CVE-ID was assigned by a
third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2026-3784
CVE-2026-3783
Data Detectors UI
Available for: macOS Sonoma
Impact: An app may be able to access sensitive user data
Description: An authorization issue was addressed with improved state
management.
CVE-2026-43758: HvxyZLF
DesktopServices
Available for: macOS Sonoma
Impact: An app may bypass Gatekeeper checks
Description: A file quarantine bypass was addressed with additional
checks.
CVE-2026-64708: Lance Cain - Offensive Security Engineer, SpecterOps
Inc.
Disk Images
Available for: macOS Sonoma
Impact: An app may be able to elevate privileges
Description: A race condition was addressed with improved state
handling.
CVE-2026-28926: Jonathan Bar Or (@yo_yo_yo_jbo)
Disk Images
Available for: macOS Sonoma
Impact: Parsing a maliciously crafted file may lead to an unexpected app
termination
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-43747: Anthony Laou Hine Tsuei (@anarcheuz)
Disk Images
Available for: macOS Sonoma
Impact: An app may be able to cause unexpected system termination
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-64694: Gil Portnoy & Henry
Disk Images
Available for: macOS Sonoma
Impact: An app may be able to bypass network restrictions
Description: A permissions issue was addressed with additional sandbox
restrictions.
CVE-2026-28945: Ayaan Ahmad
Disk Images
Available for: macOS Sonoma
Impact: An app may be able to disclose kernel memory
Description: The issue was addressed with improved bounds checks.
CVE-2026-64776: Hyunwoo Kim (@v4bel)
DriverKit
Available for: macOS Sonoma
Impact: An app may be able to cause unexpected system termination
Description: An issue existed in the handling of environment variables.
This issue was addressed with improved validation.
CVE-2026-43793: erdene-och Byambabayar
DriverKit
Available for: macOS Sonoma
Impact: An attacker with physical access to a locked device may be able
to view sensitive user information
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-43753: Niels Hofmans
Foundation
Available for: macOS Sonoma
Impact: A malicious app may be able to access protected user data
Description: The issue was addressed with improved input sanitization.
CVE-2026-43714: an anonymous researcher
Game Center
Available for: macOS Sonoma
Impact: A malicious app may be able to break out of its sandbox
Description: A parsing issue in the handling of directory paths was
addressed with improved path validation.
CVE-2026-64740: Manuel Fernandez (Stackhopper Security)
Game Center
Available for: macOS Sonoma
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved data protection.
CVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive
Technologies
Heimdal
Available for: macOS Sonoma
Impact: An app may be able to cause a denial-of-service
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-64692: Redon Gashi
HFS
Available for: macOS Sonoma
Impact: A remote user may be able to cause unexpected system termination
or corrupt kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43682: Trung Nguyen (@everping) of CyStack, Peter Malone,
Nicolas Rabrenovic, Dave G., Atul R V & Ashmit Sharma
HFS
Available for: macOS Sonoma
Impact: Processing a maliciously crafted image may lead to arbitrary
code execution
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-28981: Hcamael and 章鱼哥@aipy （aipyaipy.com）, Aswin Kumar
Gokulakannan, Surya Narayan Kushwaha, Dun
HFS
Available for: macOS Sonoma
Impact: Mounting a maliciously crafted disk image may cause unexpected
system termination or corrupt kernel memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-43773: Surya Narayan Kushwaha, Richard Zana, Peter Malone,
Hyunwoo Kim (@v4bel), Cem Onat Karagun
HFS
Available for: macOS Sonoma
Impact: An app may be able to cause unexpected system termination
Description: The issue was addressed with
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apple | Macos Sonoma |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0290 (this record)
- related CVE-2025-43325
- related CVE-2026-20672
- related CVE-2026-23918
- related CVE-2026-28849
- related CVE-2026-28896
- related CVE-2026-28900
- related CVE-2026-28911
- related CVE-2026-28914
- related CVE-2026-28926
- related CVE-2026-28932
- related CVE-2026-28936
- related CVE-2026-28945
- related CVE-2026-28961
- related CVE-2026-28973
- related CVE-2026-28981
- related CVE-2026-28982
- related CVE-2026-28983
- related CVE-2026-3783
- related CVE-2026-3784
- related CVE-2026-39868
- related CVE-2026-39873
- related CVE-2026-39874
- related CVE-2026-39875
- related CVE-2026-39877
- related CVE-2026-43661
- related CVE-2026-43665
- related CVE-2026-43672
- related CVE-2026-43673
- related CVE-2026-43681
- related CVE-2026-43682
- related CVE-2026-43693
- related CVE-2026-43694
- related CVE-2026-43698
- related CVE-2026-43703
- related CVE-2026-43706
- related CVE-2026-43710
- related CVE-2026-43711
- related CVE-2026-43714
- related CVE-2026-43722
- related CVE-2026-43723
- related CVE-2026-43724
- related CVE-2026-43738
- related CVE-2026-43744
- related CVE-2026-43747
- related CVE-2026-43749
- related CVE-2026-43750
- related CVE-2026-43753
- related CVE-2026-43754
- related CVE-2026-43755
- related CVE-2026-43756
- related CVE-2026-43757
- related CVE-2026-43758
- related CVE-2026-43760
- related CVE-2026-43763
- related CVE-2026-43764
- related CVE-2026-43765
- related CVE-2026-43766
- related CVE-2026-43767
- related CVE-2026-43768
- related CVE-2026-43769
- related CVE-2026-43770
- related CVE-2026-43771
- related CVE-2026-43772
- related CVE-2026-43773
- related CVE-2026-43774
- related CVE-2026-43777
- related CVE-2026-43778
- related CVE-2026-43779
- related CVE-2026-43780
- related CVE-2026-43781
- related CVE-2026-43782
- related CVE-2026-43793
- related CVE-2026-43796
- related CVE-2026-43799
- related CVE-2026-43801
- related CVE-2026-43802
- related CVE-2026-43803
- related CVE-2026-43805
- related CVE-2026-43807
- related CVE-2026-43809
- related CVE-2026-43810
- related CVE-2026-43818
- related CVE-2026-43822
- related CVE-2026-4424
- related CVE-2026-64692
- related CVE-2026-64693
- related CVE-2026-64694
- related CVE-2026-64695
- related CVE-2026-64696
- related CVE-2026-64697
- related CVE-2026-64698
- related CVE-2026-64699
- related CVE-2026-64700
- related CVE-2026-64702
- related CVE-2026-64703
- related CVE-2026-64704
- related CVE-2026-64707
- related CVE-2026-64708
- related CVE-2026-64709
- related CVE-2026-64710
- related CVE-2026-64711
- related CVE-2026-64716
- related CVE-2026-64721
- related CVE-2026-64723
- related CVE-2026-64724
- related CVE-2026-64725
- related CVE-2026-64734
- related CVE-2026-64735
- related CVE-2026-64737
- related CVE-2026-64738
- related CVE-2026-64739
- related CVE-2026-64740
- related CVE-2026-64744
- related CVE-2026-64747
- related CVE-2026-64754
- related CVE-2026-64762
- related CVE-2026-64763
- related CVE-2026-64764
- related CVE-2026-64765
- related CVE-2026-64766
- related CVE-2026-64767
- related CVE-2026-64768
- related CVE-2026-64769
- related CVE-2026-64770
- related CVE-2026-64774
- related CVE-2026-64775
- related CVE-2026-64776
{
"containers": {
"cna": {
"affected": [
{
"product": "Macos Sonoma",
"vendor": "Apple",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-07-27-2026-4 macOS Sonoma 14.8.8\n\nmacOS Sonoma 14.8.8 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/128072.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccounts\nAvailable for: macOS Sonoma\nImpact: An app may be able to gain root privileges\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-43749: Adam Franke, Trung Nguyen (@everping) of CyStack, Ashish\nKunwar\n\nafpfs\nAvailable for: macOS Sonoma\nImpact: A remote attacker may be able to cause unexpected system\ntermination or corrupt kernel memory\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-64767: Dave G.\n\napache\nAvailable for: macOS Sonoma\nImpact: A remote attacker may be able to cause a denial-of-service\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-23918: \u042e\u043b\u0438\u044f \u041c\u0435\u0440\u0446\u0430\u043b\u043e\u0432\u0430\n\nAPFS\nAvailable for: macOS Sonoma\nImpact: A remote user may be able to cause unexpected system termination\nor corrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64695: Peter Malone\n\nApp Store\nAvailable for: macOS Sonoma\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved checks.\nCVE-2026-43801: Rahul Raj\n\nApple Account\nAvailable for: macOS Sonoma\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-43781: Pinak Oza\n\nApple Account\nAvailable for: macOS Sonoma\nImpact: A malicious app may be able to break out of its sandbox\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-64737: Robert Mindo\n\nAppleRAID\nAvailable for: macOS Sonoma\nImpact: A local user may be able to read kernel memory\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-43681: impost0r (ret2plt), David Ige - Beryllium Security\n\nAssets\nAvailable for: macOS Sonoma\nImpact: A malicious application may be able to bypass Privacy\npreferences\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-43672: \uc774\uc7ac\uc601\n\nATS\nAvailable for: macOS Sonoma\nImpact: An app may be able to read files outside of its sandbox\nDescription: A permissions issue was addressed by removing the\nvulnerable code.\nCVE-2026-43763: Pavan Nallamothu, Jared Reyes\n\nAudio\nAvailable for: macOS Sonoma\nImpact: An app may be able to break out of its sandbox\nDescription: An access issue was addressed with additional sandbox\nrestrictions.\nCVE-2026-64702: John Lussier\n\nAudio\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\nAVEVideoEncoder\nAvailable for: macOS Sonoma\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges\nDescription: A buffer overflow was addressed with improved size\nvalidation.\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\nAVEVideoEncoder\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun\n\nBackgroundAssets\nAvailable for: macOS Sonoma\nImpact: An app may be able to delete files for which it does not have\npermission\nDescription: A permissions issue was addressed with improved validation.\nCVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity\u0027s WeBin lab\n\nBOM\nAvailable for: macOS Sonoma\nImpact: A maliciously crafted ZIP archive may bypass Gatekeeper checks\nDescription: The issue was addressed with improved checks.\nCVE-2026-28849: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\ncd9660\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause unexpected system termination or\nread kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64698: Richard Zana, Peter Malone, Nathaniel Oh (@calysteon),\nan anonymous researcher\n\nContacts\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted contact may leak sensitive data\nDescription: The issue was addressed with improved checks.\nCVE-2026-64734: Daniel Williams\n\nControl Center\nAvailable for: macOS Sonoma\nImpact: An app may be able to access user-sensitive data\nDescription: A logic issue was addressed with improved validation.\nCVE-2026-43756: \uc774\uc7ac\uc601\n\nCore Services\nAvailable for: macOS Sonoma\nImpact: An app may be able to gain root privileges\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-43693: Gergely Kalman (@gergely_kalman)\n\nCoreAudio\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted audio file may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\nCoreAudio\nAvailable for: macOS Sonoma\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43744: Mathis Mansi\u00e8re, an anonymous researcher\n\nCoreAudio\nAvailable for: macOS Sonoma\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43803: Rahul Raj\n\nCoreMedia\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\nCoreServices\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved checks.\nCVE-2026-28936: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nCoreUI\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted asset catalog may result in\ndisclosure of process memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43738: Peter Malone\n\nCoreVideo\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43802: an anonymous researcher\n\nCrash Reporter\nAvailable for: macOS Sonoma\nImpact: An app may be able to leak sensitive user information\nDescription: A privacy issue was addressed by removing sensitive data.\nCVE-2026-64710: Matthew Schneider\n\nCUPS\nAvailable for: macOS Sonoma\nImpact: A malicious app may be able to gain root privileges\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-39875: XBreach.ai, Dallas Dubs, Andreas Jaegersberger \u0026 Ro\nAchterberg of Nosebeard Labs, Aaron Grattafiori - NVIDIA AI Red Team\n\nCUPS\nAvailable for: macOS Sonoma\nImpact: An app may be able to gain root privileges\nDescription: An injection issue was addressed with improved validation.\nCVE-2026-43698: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\ncurl\nAvailable for: macOS Sonoma\nImpact: Authentication credentials may be sent to a server on another\norigin\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-3784\nCVE-2026-3783\n\nData Detectors UI\nAvailable for: macOS Sonoma\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-43758: HvxyZLF\n\nDesktopServices\nAvailable for: macOS Sonoma\nImpact: An app may bypass Gatekeeper checks\nDescription: A file quarantine bypass was addressed with additional\nchecks.\nCVE-2026-64708: Lance Cain - Offensive Security Engineer, SpecterOps\nInc.\n\nDisk Images\nAvailable for: macOS Sonoma\nImpact: An app may be able to elevate privileges\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-28926: Jonathan Bar Or (@yo_yo_yo_jbo)\n\nDisk Images\nAvailable for: macOS Sonoma\nImpact: Parsing a maliciously crafted file may lead to an unexpected app\ntermination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43747: Anthony Laou Hine Tsuei (@anarcheuz)\n\nDisk Images\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-64694: Gil Portnoy \u0026 Henry\n\nDisk Images\nAvailable for: macOS Sonoma\nImpact: An app may be able to bypass network restrictions\nDescription: A permissions issue was addressed with additional sandbox\nrestrictions.\nCVE-2026-28945: Ayaan Ahmad\n\nDisk Images\nAvailable for: macOS Sonoma\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-64776: Hyunwoo Kim (@v4bel)\n\nDriverKit\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause unexpected system termination\nDescription: An issue existed in the handling of environment variables.\nThis issue was addressed with improved validation.\nCVE-2026-43793: erdene-och Byambabayar\n\nDriverKit\nAvailable for: macOS Sonoma\nImpact: An attacker with physical access to a locked device may be able\nto view sensitive user information\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43753: Niels Hofmans\n\nFoundation\nAvailable for: macOS Sonoma\nImpact: A malicious app may be able to access protected user data\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43714: an anonymous researcher\n\nGame Center\nAvailable for: macOS Sonoma\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\nGame Center\nAvailable for: macOS Sonoma\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive\nTechnologies\n\nHeimdal\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64692: Redon Gashi\n\nHFS\nAvailable for: macOS Sonoma\nImpact: A remote user may be able to cause unexpected system termination\nor corrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43682: Trung Nguyen (@everping) of CyStack, Peter Malone,\nNicolas Rabrenovic, Dave G., Atul R V \u0026 Ashmit Sharma\n\nHFS\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted image may lead to arbitrary\ncode execution\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28981: Hcamael and \u7ae0\u9c7c\u54e5@aipy \uff08aipyaipy.com\uff09, Aswin Kumar\nGokulakannan, Surya Narayan Kushwaha, Dun\n\nHFS\nAvailable for: macOS Sonoma\nImpact: Mounting a maliciously crafted disk image may cause unexpected\nsystem termination or corrupt kernel memory\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43773: Surya Narayan Kushwaha, Richard Zana, Peter Malone,\nHyunwoo Kim (@v4bel), Cem Onat Karagun\n\nHFS\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause unexpected system termination\nDescription: The issue was addressed with"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:47:41Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/19"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/19"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/downloads/"
},
{
"url": "https://support.apple.com/en-us/128072"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/19"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-07-27-2026-4 macOS Sonoma 14.8.8",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2025-43325",
"type": "related"
},
{
"destId": "CVE-2026-20672",
"type": "related"
},
{
"destId": "CVE-2026-23918",
"type": "related"
},
{
"destId": "CVE-2026-28849",
"type": "related"
},
{
"destId": "CVE-2026-28896",
"type": "related"
},
{
"destId": "CVE-2026-28900",
"type": "related"
},
{
"destId": "CVE-2026-28911",
"type": "related"
},
{
"destId": "CVE-2026-28914",
"type": "related"
},
{
"destId": "CVE-2026-28926",
"type": "related"
},
{
"destId": "CVE-2026-28932",
"type": "related"
},
{
"destId": "CVE-2026-28936",
"type": "related"
},
{
"destId": "CVE-2026-28945",
"type": "related"
},
{
"destId": "CVE-2026-28961",
"type": "related"
},
{
"destId": "CVE-2026-28973",
"type": "related"
},
{
"destId": "CVE-2026-28981",
"type": "related"
},
{
"destId": "CVE-2026-28982",
"type": "related"
},
{
"destId": "CVE-2026-28983",
"type": "related"
},
{
"destId": "CVE-2026-3783",
"type": "related"
},
{
"destId": "CVE-2026-3784",
"type": "related"
},
{
"destId": "CVE-2026-39868",
"type": "related"
},
{
"destId": "CVE-2026-39873",
"type": "related"
},
{
"destId": "CVE-2026-39874",
"type": "related"
},
{
"destId": "CVE-2026-39875",
"type": "related"
},
{
"destId": "CVE-2026-39877",
"type": "related"
},
{
"destId": "CVE-2026-43661",
"type": "related"
},
{
"destId": "CVE-2026-43665",
"type": "related"
},
{
"destId": "CVE-2026-43672",
"type": "related"
},
{
"destId": "CVE-2026-43673",
"type": "related"
},
{
"destId": "CVE-2026-43681",
"type": "related"
},
{
"destId": "CVE-2026-43682",
"type": "related"
},
{
"destId": "CVE-2026-43693",
"type": "related"
},
{
"destId": "CVE-2026-43694",
"type": "related"
},
{
"destId": "CVE-2026-43698",
"type": "related"
},
{
"destId": "CVE-2026-43703",
"type": "related"
},
{
"destId": "CVE-2026-43706",
"type": "related"
},
{
"destId": "CVE-2026-43710",
"type": "related"
},
{
"destId": "CVE-2026-43711",
"type": "related"
},
{
"destId": "CVE-2026-43714",
"type": "related"
},
{
"destId": "CVE-2026-43722",
"type": "related"
},
{
"destId": "CVE-2026-43723",
"type": "related"
},
{
"destId": "CVE-2026-43724",
"type": "related"
},
{
"destId": "CVE-2026-43738",
"type": "related"
},
{
"destId": "CVE-2026-43744",
"type": "related"
},
{
"destId": "CVE-2026-43747",
"type": "related"
},
{
"destId": "CVE-2026-43749",
"type": "related"
},
{
"destId": "CVE-2026-43750",
"type": "related"
},
{
"destId": "CVE-2026-43753",
"type": "related"
},
{
"destId": "CVE-2026-43754",
"type": "related"
},
{
"destId": "CVE-2026-43755",
"type": "related"
},
{
"destId": "CVE-2026-43756",
"type": "related"
},
{
"destId": "CVE-2026-43757",
"type": "related"
},
{
"destId": "CVE-2026-43758",
"type": "related"
},
{
"destId": "CVE-2026-43760",
"type": "related"
},
{
"destId": "CVE-2026-43763",
"type": "related"
},
{
"destId": "CVE-2026-43764",
"type": "related"
},
{
"destId": "CVE-2026-43765",
"type": "related"
},
{
"destId": "CVE-2026-43766",
"type": "related"
},
{
"destId": "CVE-2026-43767",
"type": "related"
},
{
"destId": "CVE-2026-43768",
"type": "related"
},
{
"destId": "CVE-2026-43769",
"type": "related"
},
{
"destId": "CVE-2026-43770",
"type": "related"
},
{
"destId": "CVE-2026-43771",
"type": "related"
},
{
"destId": "CVE-2026-43772",
"type": "related"
},
{
"destId": "CVE-2026-43773",
"type": "related"
},
{
"destId": "CVE-2026-43774",
"type": "related"
},
{
"destId": "CVE-2026-43777",
"type": "related"
},
{
"destId": "CVE-2026-43778",
"type": "related"
},
{
"destId": "CVE-2026-43779",
"type": "related"
},
{
"destId": "CVE-2026-43780",
"type": "related"
},
{
"destId": "CVE-2026-43781",
"type": "related"
},
{
"destId": "CVE-2026-43782",
"type": "related"
},
{
"destId": "CVE-2026-43793",
"type": "related"
},
{
"destId": "CVE-2026-43796",
"type": "related"
},
{
"destId": "CVE-2026-43799",
"type": "related"
},
{
"destId": "CVE-2026-43801",
"type": "related"
},
{
"destId": "CVE-2026-43802",
"type": "related"
},
{
"destId": "CVE-2026-43803",
"type": "related"
},
{
"destId": "CVE-2026-43805",
"type": "related"
},
{
"destId": "CVE-2026-43807",
"type": "related"
},
{
"destId": "CVE-2026-43809",
"type": "related"
},
{
"destId": "CVE-2026-43810",
"type": "related"
},
{
"destId": "CVE-2026-43818",
"type": "related"
},
{
"destId": "CVE-2026-43822",
"type": "related"
},
{
"destId": "CVE-2026-4424",
"type": "related"
},
{
"destId": "CVE-2026-64692",
"type": "related"
},
{
"destId": "CVE-2026-64693",
"type": "related"
},
{
"destId": "CVE-2026-64694",
"type": "related"
},
{
"destId": "CVE-2026-64695",
"type": "related"
},
{
"destId": "CVE-2026-64696",
"type": "related"
},
{
"destId": "CVE-2026-64697",
"type": "related"
},
{
"destId": "CVE-2026-64698",
"type": "related"
},
{
"destId": "CVE-2026-64699",
"type": "related"
},
{
"destId": "CVE-2026-64700",
"type": "related"
},
{
"destId": "CVE-2026-64702",
"type": "related"
},
{
"destId": "CVE-2026-64703",
"type": "related"
},
{
"destId": "CVE-2026-64704",
"type": "related"
},
{
"destId": "CVE-2026-64707",
"type": "related"
},
{
"destId": "CVE-2026-64708",
"type": "related"
},
{
"destId": "CVE-2026-64709",
"type": "related"
},
{
"destId": "CVE-2026-64710",
"type": "related"
},
{
"destId": "CVE-2026-64711",
"type": "related"
},
{
"destId": "CVE-2026-64716",
"type": "related"
},
{
"destId": "CVE-2026-64721",
"type": "related"
},
{
"destId": "CVE-2026-64723",
"type": "related"
},
{
"destId": "CVE-2026-64724",
"type": "related"
},
{
"destId": "CVE-2026-64725",
"type": "related"
},
{
"destId": "CVE-2026-64734",
"type": "related"
},
{
"destId": "CVE-2026-64735",
"type": "related"
},
{
"destId": "CVE-2026-64737",
"type": "related"
},
{
"destId": "CVE-2026-64738",
"type": "related"
},
{
"destId": "CVE-2026-64739",
"type": "related"
},
{
"destId": "CVE-2026-64740",
"type": "related"
},
{
"destId": "CVE-2026-64744",
"type": "related"
},
{
"destId": "CVE-2026-64747",
"type": "related"
},
{
"destId": "CVE-2026-64754",
"type": "related"
},
{
"destId": "CVE-2026-64762",
"type": "related"
},
{
"destId": "CVE-2026-64763",
"type": "related"
},
{
"destId": "CVE-2026-64764",
"type": "related"
},
{
"destId": "CVE-2026-64765",
"type": "related"
},
{
"destId": "CVE-2026-64766",
"type": "related"
},
{
"destId": "CVE-2026-64767",
"type": "related"
},
{
"destId": "CVE-2026-64768",
"type": "related"
},
{
"destId": "CVE-2026-64769",
"type": "related"
},
{
"destId": "CVE-2026-64770",
"type": "related"
},
{
"destId": "CVE-2026-64774",
"type": "related"
},
{
"destId": "CVE-2026-64775",
"type": "related"
},
{
"destId": "CVE-2026-64776",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0290",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/19",
"automated": true,
"contentSha256": "ec03a2d218b69dc7ce06cd9f0bf5f6850a1964223cc1bef0f9466ca4f7384d34",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/19",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-07-28T00:21:11Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0290"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T11:40:47Z",
"dateUpdated": "2026-09-11T11:47:41Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0290"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0042
Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:47
VLAI
EPSS
VEX
Title
APPLE-SA-07-27-2026-4 macOS Sonoma 14.8.8
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-07-27-2026-4 macOS Sonoma 14.8.8
macOS Sonoma 14.8.8 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/128072.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accounts
Available for: macOS Sonoma
Impact: An app may be able to gain root privileges
Description: A parsing issue in the handling of directory paths was
addressed with improved path validation.
CVE-2026-43749: Adam Franke, Trung Nguyen (@everping) of CyStack, Ashish
Kunwar
afpfs
Available for: macOS Sonoma
Impact: A remote attacker may be able to cause unexpected system
termination or corrupt kernel memory
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-64767: Dave G.
apache
Available for: macOS Sonoma
Impact: A remote attacker may be able to cause a denial-of-service
Description: This is a vulnerability in open source code and Apple
Software is among the affected projects. The CVE-ID was assigned by a
third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2026-23918: Юлия Мерцалова
APFS
Available for: macOS Sonoma
Impact: A remote user may be able to cause unexpected system termination
or corrupt kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64695: Peter Malone
App Store
Available for: macOS Sonoma
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved checks.
CVE-2026-43801: Rahul Raj
Apple Account
Available for: macOS Sonoma
Impact: An app may be able to access sensitive user data
Description: A race condition was addressed with improved state
handling.
CVE-2026-43781: Pinak Oza
Apple Account
Available for: macOS Sonoma
Impact: A malicious app may be able to break out of its sandbox
Description: An authorization issue was addressed with improved state
management.
CVE-2026-64737: Robert Mindo
AppleRAID
Available for: macOS Sonoma
Impact: A local user may be able to read kernel memory
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-43681: impost0r (ret2plt), David Ige - Beryllium Security
Assets
Available for: macOS Sonoma
Impact: A malicious application may be able to bypass Privacy
preferences
Description: An authorization issue was addressed with improved state
management.
CVE-2026-43672: 이재영
ATS
Available for: macOS Sonoma
Impact: An app may be able to read files outside of its sandbox
Description: A permissions issue was addressed by removing the
vulnerable code.
CVE-2026-43763: Pavan Nallamothu, Jared Reyes
Audio
Available for: macOS Sonoma
Impact: An app may be able to break out of its sandbox
Description: An access issue was addressed with additional sandbox
restrictions.
CVE-2026-64702: John Lussier
Audio
Available for: macOS Sonoma
Impact: An app may be able to cause a denial-of-service
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)
AVEVideoEncoder
Available for: macOS Sonoma
Impact: An app may be able to execute arbitrary code with kernel
privileges
Description: A buffer overflow was addressed with improved size
validation.
CVE-2026-64747: Franco Belman at Blackwing Intelligence
AVEVideoEncoder
Available for: macOS Sonoma
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun
BackgroundAssets
Available for: macOS Sonoma
Impact: An app may be able to delete files for which it does not have
permission
Description: A permissions issue was addressed with improved validation.
CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab
BOM
Available for: macOS Sonoma
Impact: A maliciously crafted ZIP archive may bypass Gatekeeper checks
Description: The issue was addressed with improved checks.
CVE-2026-28849: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
cd9660
Available for: macOS Sonoma
Impact: An app may be able to cause unexpected system termination or
read kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64698: Richard Zana, Peter Malone, Nathaniel Oh (@calysteon),
an anonymous researcher
Contacts
Available for: macOS Sonoma
Impact: Processing a maliciously crafted contact may leak sensitive data
Description: The issue was addressed with improved checks.
CVE-2026-64734: Daniel Williams
Control Center
Available for: macOS Sonoma
Impact: An app may be able to access user-sensitive data
Description: A logic issue was addressed with improved validation.
CVE-2026-43756: 이재영
Core Services
Available for: macOS Sonoma
Impact: An app may be able to gain root privileges
Description: A race condition was addressed with improved state
handling.
CVE-2026-43693: Gergely Kalman (@gergely_kalman)
CoreAudio
Available for: macOS Sonoma
Impact: Processing a maliciously crafted audio file may corrupt process
memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative
CoreAudio
Available for: macOS Sonoma
Impact: Processing an audio stream in a maliciously crafted media file
may terminate the process
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43744: Mathis Mansière, an anonymous researcher
CoreAudio
Available for: macOS Sonoma
Impact: A remote attacker may be able to cause unexpected system
termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43803: Rahul Raj
CoreMedia
Available for: macOS Sonoma
Impact: Processing a maliciously crafted video file may lead to
unexpected app termination
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2026-43711: James Duffy (@0x4A616D657344)
CoreServices
Available for: macOS Sonoma
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: The issue was addressed with improved checks.
CVE-2026-28936: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
CoreUI
Available for: macOS Sonoma
Impact: Processing a maliciously crafted asset catalog may result in
disclosure of process memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43738: Peter Malone
CoreVideo
Available for: macOS Sonoma
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43802: an anonymous researcher
Crash Reporter
Available for: macOS Sonoma
Impact: An app may be able to leak sensitive user information
Description: A privacy issue was addressed by removing sensitive data.
CVE-2026-64710: Matthew Schneider
CUPS
Available for: macOS Sonoma
Impact: A malicious app may be able to gain root privileges
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-39875: XBreach.ai, Dallas Dubs, Andreas Jaegersberger & Ro
Achterberg of Nosebeard Labs, Aaron Grattafiori - NVIDIA AI Red Team
CUPS
Available for: macOS Sonoma
Impact: An app may be able to gain root privileges
Description: An injection issue was addressed with improved validation.
CVE-2026-43698: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
curl
Available for: macOS Sonoma
Impact: Authentication credentials may be sent to a server on another
origin
Description: This is a vulnerability in open source code and Apple
Software is among the affected projects. The CVE-ID was assigned by a
third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2026-3784
CVE-2026-3783
Data Detectors UI
Available for: macOS Sonoma
Impact: An app may be able to access sensitive user data
Description: An authorization issue was addressed with improved state
management.
CVE-2026-43758: HvxyZLF
DesktopServices
Available for: macOS Sonoma
Impact: An app may bypass Gatekeeper checks
Description: A file quarantine bypass was addressed with additional
checks.
CVE-2026-64708: Lance Cain - Offensive Security Engineer, SpecterOps
Inc.
Disk Images
Available for: macOS Sonoma
Impact: An app may be able to elevate privileges
Description: A race condition was addressed with improved state
handling.
CVE-2026-28926: Jonathan Bar Or (@yo_yo_yo_jbo)
Disk Images
Available for: macOS Sonoma
Impact: Parsing a maliciously crafted file may lead to an unexpected app
termination
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-43747: Anthony Laou Hine Tsuei (@anarcheuz)
Disk Images
Available for: macOS Sonoma
Impact: An app may be able to cause unexpected system termination
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-64694: Gil Portnoy & Henry
Disk Images
Available for: macOS Sonoma
Impact: An app may be able to bypass network restrictions
Description: A permissions issue was addressed with additional sandbox
restrictions.
CVE-2026-28945: Ayaan Ahmad
Disk Images
Available for: macOS Sonoma
Impact: An app may be able to disclose kernel memory
Description: The issue was addressed with improved bounds checks.
CVE-2026-64776: Hyunwoo Kim (@v4bel)
DriverKit
Available for: macOS Sonoma
Impact: An app may be able to cause unexpected system termination
Description: An issue existed in the handling of environment variables.
This issue was addressed with improved validation.
CVE-2026-43793: erdene-och Byambabayar
DriverKit
Available for: macOS Sonoma
Impact: An attacker with physical access to a locked device may be able
to view sensitive user information
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-43753: Niels Hofmans
Foundation
Available for: macOS Sonoma
Impact: A malicious app may be able to access protected user data
Description: The issue was addressed with improved input sanitization.
CVE-2026-43714: an anonymous researcher
Game Center
Available for: macOS Sonoma
Impact: A malicious app may be able to break out of its sandbox
Description: A parsing issue in the handling of directory paths was
addressed with improved path validation.
CVE-2026-64740: Manuel Fernandez (Stackhopper Security)
Game Center
Available for: macOS Sonoma
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved data protection.
CVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive
Technologies
Heimdal
Available for: macOS Sonoma
Impact: An app may be able to cause a denial-of-service
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-64692: Redon Gashi
HFS
Available for: macOS Sonoma
Impact: A remote user may be able to cause unexpected system termination
or corrupt kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43682: Trung Nguyen (@everping) of CyStack, Peter Malone,
Nicolas Rabrenovic, Dave G., Atul R V & Ashmit Sharma
HFS
Available for: macOS Sonoma
Impact: Processing a maliciously crafted image may lead to arbitrary
code execution
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-28981: Hcamael and 章鱼哥@aipy （aipyaipy.com）, Aswin Kumar
Gokulakannan, Surya Narayan Kushwaha, Dun
HFS
Available for: macOS Sonoma
Impact: Mounting a maliciously crafted disk image may cause unexpected
system termination or corrupt kernel memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-43773: Surya Narayan Kushwaha, Richard Zana, Peter Malone,
Hyunwoo Kim (@v4bel), Cem Onat Karagun
HFS
Available for: macOS Sonoma
Impact: An app may be able to cause unexpected system termination
Description: The issue was addressed with
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apple | Macos Sonoma |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "Macos Sonoma",
"vendor": "Apple",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-07-27-2026-4 macOS Sonoma 14.8.8\n\nmacOS Sonoma 14.8.8 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/128072.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccounts\nAvailable for: macOS Sonoma\nImpact: An app may be able to gain root privileges\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-43749: Adam Franke, Trung Nguyen (@everping) of CyStack, Ashish\nKunwar\n\nafpfs\nAvailable for: macOS Sonoma\nImpact: A remote attacker may be able to cause unexpected system\ntermination or corrupt kernel memory\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-64767: Dave G.\n\napache\nAvailable for: macOS Sonoma\nImpact: A remote attacker may be able to cause a denial-of-service\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-23918: \u042e\u043b\u0438\u044f \u041c\u0435\u0440\u0446\u0430\u043b\u043e\u0432\u0430\n\nAPFS\nAvailable for: macOS Sonoma\nImpact: A remote user may be able to cause unexpected system termination\nor corrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64695: Peter Malone\n\nApp Store\nAvailable for: macOS Sonoma\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved checks.\nCVE-2026-43801: Rahul Raj\n\nApple Account\nAvailable for: macOS Sonoma\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-43781: Pinak Oza\n\nApple Account\nAvailable for: macOS Sonoma\nImpact: A malicious app may be able to break out of its sandbox\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-64737: Robert Mindo\n\nAppleRAID\nAvailable for: macOS Sonoma\nImpact: A local user may be able to read kernel memory\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-43681: impost0r (ret2plt), David Ige - Beryllium Security\n\nAssets\nAvailable for: macOS Sonoma\nImpact: A malicious application may be able to bypass Privacy\npreferences\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-43672: \uc774\uc7ac\uc601\n\nATS\nAvailable for: macOS Sonoma\nImpact: An app may be able to read files outside of its sandbox\nDescription: A permissions issue was addressed by removing the\nvulnerable code.\nCVE-2026-43763: Pavan Nallamothu, Jared Reyes\n\nAudio\nAvailable for: macOS Sonoma\nImpact: An app may be able to break out of its sandbox\nDescription: An access issue was addressed with additional sandbox\nrestrictions.\nCVE-2026-64702: John Lussier\n\nAudio\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\nAVEVideoEncoder\nAvailable for: macOS Sonoma\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges\nDescription: A buffer overflow was addressed with improved size\nvalidation.\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\nAVEVideoEncoder\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun\n\nBackgroundAssets\nAvailable for: macOS Sonoma\nImpact: An app may be able to delete files for which it does not have\npermission\nDescription: A permissions issue was addressed with improved validation.\nCVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity\u0027s WeBin lab\n\nBOM\nAvailable for: macOS Sonoma\nImpact: A maliciously crafted ZIP archive may bypass Gatekeeper checks\nDescription: The issue was addressed with improved checks.\nCVE-2026-28849: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\ncd9660\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause unexpected system termination or\nread kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64698: Richard Zana, Peter Malone, Nathaniel Oh (@calysteon),\nan anonymous researcher\n\nContacts\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted contact may leak sensitive data\nDescription: The issue was addressed with improved checks.\nCVE-2026-64734: Daniel Williams\n\nControl Center\nAvailable for: macOS Sonoma\nImpact: An app may be able to access user-sensitive data\nDescription: A logic issue was addressed with improved validation.\nCVE-2026-43756: \uc774\uc7ac\uc601\n\nCore Services\nAvailable for: macOS Sonoma\nImpact: An app may be able to gain root privileges\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-43693: Gergely Kalman (@gergely_kalman)\n\nCoreAudio\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted audio file may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\nCoreAudio\nAvailable for: macOS Sonoma\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43744: Mathis Mansi\u00e8re, an anonymous researcher\n\nCoreAudio\nAvailable for: macOS Sonoma\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43803: Rahul Raj\n\nCoreMedia\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\nCoreServices\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved checks.\nCVE-2026-28936: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nCoreUI\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted asset catalog may result in\ndisclosure of process memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43738: Peter Malone\n\nCoreVideo\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43802: an anonymous researcher\n\nCrash Reporter\nAvailable for: macOS Sonoma\nImpact: An app may be able to leak sensitive user information\nDescription: A privacy issue was addressed by removing sensitive data.\nCVE-2026-64710: Matthew Schneider\n\nCUPS\nAvailable for: macOS Sonoma\nImpact: A malicious app may be able to gain root privileges\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-39875: XBreach.ai, Dallas Dubs, Andreas Jaegersberger \u0026 Ro\nAchterberg of Nosebeard Labs, Aaron Grattafiori - NVIDIA AI Red Team\n\nCUPS\nAvailable for: macOS Sonoma\nImpact: An app may be able to gain root privileges\nDescription: An injection issue was addressed with improved validation.\nCVE-2026-43698: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\ncurl\nAvailable for: macOS Sonoma\nImpact: Authentication credentials may be sent to a server on another\norigin\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-3784\nCVE-2026-3783\n\nData Detectors UI\nAvailable for: macOS Sonoma\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-43758: HvxyZLF\n\nDesktopServices\nAvailable for: macOS Sonoma\nImpact: An app may bypass Gatekeeper checks\nDescription: A file quarantine bypass was addressed with additional\nchecks.\nCVE-2026-64708: Lance Cain - Offensive Security Engineer, SpecterOps\nInc.\n\nDisk Images\nAvailable for: macOS Sonoma\nImpact: An app may be able to elevate privileges\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-28926: Jonathan Bar Or (@yo_yo_yo_jbo)\n\nDisk Images\nAvailable for: macOS Sonoma\nImpact: Parsing a maliciously crafted file may lead to an unexpected app\ntermination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43747: Anthony Laou Hine Tsuei (@anarcheuz)\n\nDisk Images\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-64694: Gil Portnoy \u0026 Henry\n\nDisk Images\nAvailable for: macOS Sonoma\nImpact: An app may be able to bypass network restrictions\nDescription: A permissions issue was addressed with additional sandbox\nrestrictions.\nCVE-2026-28945: Ayaan Ahmad\n\nDisk Images\nAvailable for: macOS Sonoma\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-64776: Hyunwoo Kim (@v4bel)\n\nDriverKit\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause unexpected system termination\nDescription: An issue existed in the handling of environment variables.\nThis issue was addressed with improved validation.\nCVE-2026-43793: erdene-och Byambabayar\n\nDriverKit\nAvailable for: macOS Sonoma\nImpact: An attacker with physical access to a locked device may be able\nto view sensitive user information\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43753: Niels Hofmans\n\nFoundation\nAvailable for: macOS Sonoma\nImpact: A malicious app may be able to access protected user data\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43714: an anonymous researcher\n\nGame Center\nAvailable for: macOS Sonoma\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\nGame Center\nAvailable for: macOS Sonoma\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive\nTechnologies\n\nHeimdal\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64692: Redon Gashi\n\nHFS\nAvailable for: macOS Sonoma\nImpact: A remote user may be able to cause unexpected system termination\nor corrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43682: Trung Nguyen (@everping) of CyStack, Peter Malone,\nNicolas Rabrenovic, Dave G., Atul R V \u0026 Ashmit Sharma\n\nHFS\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted image may lead to arbitrary\ncode execution\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28981: Hcamael and \u7ae0\u9c7c\u54e5@aipy \uff08aipyaipy.com\uff09, Aswin Kumar\nGokulakannan, Surya Narayan Kushwaha, Dun\n\nHFS\nAvailable for: macOS Sonoma\nImpact: Mounting a maliciously crafted disk image may cause unexpected\nsystem termination or corrupt kernel memory\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43773: Surya Narayan Kushwaha, Richard Zana, Peter Malone,\nHyunwoo Kim (@v4bel), Cem Onat Karagun\n\nHFS\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause unexpected system termination\nDescription: The issue was addressed with"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:47:41Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/19"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/19"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/downloads/"
},
{
"url": "https://support.apple.com/en-us/128072"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/19"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-07-27-2026-4 macOS Sonoma 14.8.8",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0042",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/19",
"automated": true,
"contentSha256": "ec03a2d218b69dc7ce06cd9f0bf5f6850a1964223cc1bef0f9466ca4f7384d34",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/19",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-07-28T00:21:11Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:21Z",
"dateUpdated": "2026-09-11T11:47:41Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0042"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0289
Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-11 11:47
VLAI
EPSS
VEX
Title
APPLE-SA-07-27-2026-3 macOS Sequoia 15.7.8
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-07-27-2026-3 macOS Sequoia 15.7.8
macOS Sequoia 15.7.8 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/128071.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accounts
Available for: macOS Sequoia
Impact: An app may be able to gain root privileges
Description: A parsing issue in the handling of directory paths was
addressed with improved path validation.
CVE-2026-43749: Adam Franke, Trung Nguyen (@everping) of CyStack, Ashish
Kunwar
afpfs
Available for: macOS Sequoia
Impact: A remote attacker may be able to cause unexpected system
termination or corrupt kernel memory
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-64767: Dave G.
apache
Available for: macOS Sequoia
Impact: A remote attacker may be able to cause a denial-of-service
Description: This is a vulnerability in open source code and Apple
Software is among the affected projects. The CVE-ID was assigned by a
third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2026-23918: Юлия Мерцалова
APFS
Available for: macOS Sequoia
Impact: A remote user may be able to cause unexpected system termination
or corrupt kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64695: Peter Malone
App Store
Available for: macOS Sequoia
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved checks.
CVE-2026-43801: Rahul Raj
Apple Account
Available for: macOS Sequoia
Impact: An app may be able to access sensitive user data
Description: A race condition was addressed with improved state
handling.
CVE-2026-43781: Pinak Oza
Apple Account
Available for: macOS Sequoia
Impact: A malicious app may be able to break out of its sandbox
Description: An authorization issue was addressed with improved state
management.
CVE-2026-64737: Robert Mindo
Apple Neural Engine
Available for: macOS Sequoia
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43748: an anonymous researcher, tamdao, Franco Belman at
Blackwing Intelligence
AppleDouble
Available for: macOS Sequoia
Impact: Processing a maliciously crafted file may lead to unexpected app
termination or arbitrary code execution
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-43776: Peter Malone, Nicolas Rabrenovic, Irvin Wang
AppleRAID
Available for: macOS Sequoia
Impact: A local user may be able to read kernel memory
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-43681: impost0r (ret2plt), David Ige - Beryllium Security
Assets
Available for: macOS Sequoia
Impact: A malicious application may be able to bypass Privacy
preferences
Description: An authorization issue was addressed with improved state
management.
CVE-2026-43672: 이재영
ATS
Available for: macOS Sequoia
Impact: An app may be able to read files outside of its sandbox
Description: A permissions issue was addressed by removing the
vulnerable code.
CVE-2026-43763: Pavan Nallamothu, Jared Reyes
Audio
Available for: macOS Sequoia
Impact: An app may be able to break out of its sandbox
Description: An access issue was addressed with additional sandbox
restrictions.
CVE-2026-64702: John Lussier
Audio
Available for: macOS Sequoia
Impact: An app may be able to cause a denial-of-service
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)
AVEVideoEncoder
Available for: macOS Sequoia
Impact: An app may be able to execute arbitrary code with kernel
privileges
Description: A buffer overflow was addressed with improved size
validation.
CVE-2026-64747: Franco Belman at Blackwing Intelligence
AVEVideoEncoder
Available for: macOS Sequoia
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun
BackgroundAssets
Available for: macOS Sequoia
Impact: An app may be able to delete files for which it does not have
permission
Description: A permissions issue was addressed with improved validation.
CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab
BOM
Available for: macOS Sequoia
Impact: A maliciously crafted ZIP archive may bypass Gatekeeper checks
Description: The issue was addressed with improved checks.
CVE-2026-28849: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
cd9660
Available for: macOS Sequoia
Impact: An app may be able to cause unexpected system termination or
read kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64698: Richard Zana, Peter Malone, Nathaniel Oh (@calysteon),
an anonymous researcher
Contacts
Available for: macOS Sequoia
Impact: Processing a maliciously crafted contact may leak sensitive data
Description: The issue was addressed with improved checks.
CVE-2026-64734: Daniel Williams
Control Center
Available for: macOS Sequoia
Impact: An app may be able to access user-sensitive data
Description: A logic issue was addressed with improved validation.
CVE-2026-43756: 이재영
Core Services
Available for: macOS Sequoia
Impact: An app may be able to gain root privileges
Description: A race condition was addressed with improved state
handling.
CVE-2026-43693: Gergely Kalman (@gergely_kalman)
CoreAudio
Available for: macOS Sequoia
Impact: Processing a maliciously crafted audio file may corrupt process
memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative
CoreAudio
Available for: macOS Sequoia
Impact: Processing an audio stream in a maliciously crafted media file
may terminate the process
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43744: Mathis Mansière, an anonymous researcher
CoreAudio
Available for: macOS Sequoia
Impact: A remote attacker may be able to cause unexpected system
termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43803: Rahul Raj
CoreMedia
Available for: macOS Sequoia
Impact: An app may be able to access sensitive user data
Description: An authorization issue was addressed with improved state
management.
CVE-2026-43775: Csaba Fitzl (@theevilbit) of Iru
CoreMedia
Available for: macOS Sequoia
Impact: Processing a maliciously crafted video file may lead to
unexpected app termination
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2026-43711: James Duffy (@0x4A616D657344)
CoreServices
Available for: macOS Sequoia
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: The issue was addressed with improved checks.
CVE-2026-28936: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
CoreUI
Available for: macOS Sequoia
Impact: Processing a maliciously crafted asset catalog may result in
disclosure of process memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43738: Peter Malone
CoreVideo
Available for: macOS Sequoia
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43802: an anonymous researcher
Crash Reporter
Available for: macOS Sequoia
Impact: An app may be able to leak sensitive user information
Description: A privacy issue was addressed by removing sensitive data.
CVE-2026-64710: Matthew Schneider
CUPS
Available for: macOS Sequoia
Impact: A malicious app may be able to gain root privileges
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-39875: XBreach.ai, Dallas Dubs, Andreas Jaegersberger & Ro
Achterberg of Nosebeard Labs, Aaron Grattafiori - NVIDIA AI Red Team
CUPS
Available for: macOS Sequoia
Impact: An app may be able to gain root privileges
Description: An injection issue was addressed with improved validation.
CVE-2026-43698: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
curl
Available for: macOS Sequoia
Impact: Authentication credentials may be sent to a server on another
origin
Description: This is a vulnerability in open source code and Apple
Software is among the affected projects. The CVE-ID was assigned by a
third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2026-3784
CVE-2026-3783
Data Detectors UI
Available for: macOS Sequoia
Impact: An app may be able to access sensitive user data
Description: An authorization issue was addressed with improved state
management.
CVE-2026-43758: HvxyZLF
DesktopServices
Available for: macOS Sequoia
Impact: An app may bypass Gatekeeper checks
Description: A file quarantine bypass was addressed with additional
checks.
CVE-2026-64708: Lance Cain - Offensive Security Engineer, SpecterOps
Inc.
Disk Images
Available for: macOS Sequoia
Impact: An app may be able to elevate privileges
Description: A race condition was addressed with improved state
handling.
CVE-2026-28926: Jonathan Bar Or (@yo_yo_yo_jbo)
Disk Images
Available for: macOS Sequoia
Impact: Parsing a maliciously crafted file may lead to an unexpected app
termination
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-43747: Anthony Laou Hine Tsuei (@anarcheuz)
Disk Images
Available for: macOS Sequoia
Impact: An app may be able to cause unexpected system termination
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-64694: Gil Portnoy & Henry
Disk Images
Available for: macOS Sequoia
Impact: An app may be able to bypass network restrictions
Description: A permissions issue was addressed with additional sandbox
restrictions.
CVE-2026-28945: Ayaan Ahmad
Disk Images
Available for: macOS Sequoia
Impact: An app may be able to disclose kernel memory
Description: The issue was addressed with improved bounds checks.
CVE-2026-64776: Hyunwoo Kim (@v4bel)
DriverKit
Available for: macOS Sequoia
Impact: An app may be able to cause unexpected system termination
Description: An issue existed in the handling of environment variables.
This issue was addressed with improved validation.
CVE-2026-43793: erdene-och Byambabayar
DriverKit
Available for: macOS Sequoia
Impact: An attacker with physical access to a locked device may be able
to view sensitive user information
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-43753: Niels Hofmans
Foundation
Available for: macOS Sequoia
Impact: A malicious app may be able to access protected user data
Description: The issue was addressed with improved input sanitization.
CVE-2026-43714: an anonymous researcher
Game Center
Available for: macOS Sequoia
Impact: A malicious app may be able to break out of its sandbox
Description: A parsing issue in the handling of directory paths was
addressed with improved path validation.
CVE-2026-64740: Manuel Fernandez (Stackhopper Security)
Game Center
Available for: macOS Sequoia
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved data protection.
CVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive
Technologies
Heimdal
Available for: macOS Sequoia
Impact: An app may be able to cause a denial-of-service
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-64692: Redon Gashi
HFS
Available for: macOS Sequoia
Impact: A remote user may be able to cause unexpected system termination
or corrupt kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43682: Trung Nguyen (@everpi
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apple | Macos Sequoia |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0289 (this record)
- related CVE-2025-43325
- related CVE-2026-20672
- related CVE-2026-23918
- related CVE-2026-28849
- related CVE-2026-28896
- related CVE-2026-28900
- related CVE-2026-28912
- related CVE-2026-28914
- related CVE-2026-28926
- related CVE-2026-28932
- related CVE-2026-28936
- related CVE-2026-28945
- related CVE-2026-28961
- related CVE-2026-28973
- related CVE-2026-28981
- related CVE-2026-28982
- related CVE-2026-28983
- related CVE-2026-3783
- related CVE-2026-3784
- related CVE-2026-39868
- related CVE-2026-39873
- related CVE-2026-39874
- related CVE-2026-39875
- related CVE-2026-39877
- related CVE-2026-43653
- related CVE-2026-43661
- related CVE-2026-43665
- related CVE-2026-43672
- related CVE-2026-43673
- related CVE-2026-43681
- related CVE-2026-43682
- related CVE-2026-43693
- related CVE-2026-43694
- related CVE-2026-43698
- related CVE-2026-43703
- related CVE-2026-43706
- related CVE-2026-43710
- related CVE-2026-43711
- related CVE-2026-43714
- related CVE-2026-43722
- related CVE-2026-43723
- related CVE-2026-43724
- related CVE-2026-43729
- related CVE-2026-43733
- related CVE-2026-43738
- related CVE-2026-43744
- related CVE-2026-43747
- related CVE-2026-43748
- related CVE-2026-43749
- related CVE-2026-43750
- related CVE-2026-43753
- related CVE-2026-43754
- related CVE-2026-43756
- related CVE-2026-43757
- related CVE-2026-43758
- related CVE-2026-43763
- related CVE-2026-43764
- related CVE-2026-43765
- related CVE-2026-43766
- related CVE-2026-43767
- related CVE-2026-43768
- related CVE-2026-43769
- related CVE-2026-43770
- related CVE-2026-43771
- related CVE-2026-43772
- related CVE-2026-43773
- related CVE-2026-43774
- related CVE-2026-43775
- related CVE-2026-43776
- related CVE-2026-43777
- related CVE-2026-43778
- related CVE-2026-43779
- related CVE-2026-43780
- related CVE-2026-43781
- related CVE-2026-43782
- related CVE-2026-43793
- related CVE-2026-43796
- related CVE-2026-43799
- related CVE-2026-43801
- related CVE-2026-43802
- related CVE-2026-43803
- related CVE-2026-43805
- related CVE-2026-43807
- related CVE-2026-43809
- related CVE-2026-43810
- related CVE-2026-43812
- related CVE-2026-43818
- related CVE-2026-43822
- related CVE-2026-4424
- related CVE-2026-64692
- related CVE-2026-64693
- related CVE-2026-64694
- related CVE-2026-64695
- related CVE-2026-64696
- related CVE-2026-64697
- related CVE-2026-64698
- related CVE-2026-64699
- related CVE-2026-64700
- related CVE-2026-64702
- related CVE-2026-64703
- related CVE-2026-64704
- related CVE-2026-64707
- related CVE-2026-64708
- related CVE-2026-64709
- related CVE-2026-64710
- related CVE-2026-64711
- related CVE-2026-64716
- related CVE-2026-64721
- related CVE-2026-64722
- related CVE-2026-64723
- related CVE-2026-64724
- related CVE-2026-64725
- related CVE-2026-64731
- related CVE-2026-64734
- related CVE-2026-64735
- related CVE-2026-64737
- related CVE-2026-64738
- related CVE-2026-64739
- related CVE-2026-64740
- related CVE-2026-64744
- related CVE-2026-64745
- related CVE-2026-64747
- related CVE-2026-64749
- related CVE-2026-64754
- related CVE-2026-64762
- related CVE-2026-64763
- related CVE-2026-64764
- related CVE-2026-64765
- related CVE-2026-64766
- related CVE-2026-64767
- related CVE-2026-64768
- related CVE-2026-64769
- related CVE-2026-64770
- related CVE-2026-64771
- related CVE-2026-64772
- related CVE-2026-64774
- related CVE-2026-64775
- related CVE-2026-64776
{
"containers": {
"cna": {
"affected": [
{
"product": "Macos Sequoia",
"vendor": "Apple",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-07-27-2026-3 macOS Sequoia 15.7.8\n\nmacOS Sequoia 15.7.8 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/128071.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccounts\nAvailable for: macOS Sequoia\nImpact: An app may be able to gain root privileges\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-43749: Adam Franke, Trung Nguyen (@everping) of CyStack, Ashish\nKunwar\n\nafpfs\nAvailable for: macOS Sequoia\nImpact: A remote attacker may be able to cause unexpected system\ntermination or corrupt kernel memory\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-64767: Dave G.\n\napache\nAvailable for: macOS Sequoia\nImpact: A remote attacker may be able to cause a denial-of-service\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-23918: \u042e\u043b\u0438\u044f \u041c\u0435\u0440\u0446\u0430\u043b\u043e\u0432\u0430\n\nAPFS\nAvailable for: macOS Sequoia\nImpact: A remote user may be able to cause unexpected system termination\nor corrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64695: Peter Malone\n\nApp Store\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved checks.\nCVE-2026-43801: Rahul Raj\n\nApple Account\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-43781: Pinak Oza\n\nApple Account\nAvailable for: macOS Sequoia\nImpact: A malicious app may be able to break out of its sandbox\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-64737: Robert Mindo\n\nApple Neural Engine\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43748: an anonymous researcher, tamdao, Franco Belman at\nBlackwing Intelligence\n\nAppleDouble\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination or arbitrary code execution\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-43776: Peter Malone, Nicolas Rabrenovic, Irvin Wang\n\nAppleRAID\nAvailable for: macOS Sequoia\nImpact: A local user may be able to read kernel memory\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-43681: impost0r (ret2plt), David Ige - Beryllium Security\n\nAssets\nAvailable for: macOS Sequoia\nImpact: A malicious application may be able to bypass Privacy\npreferences\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-43672: \uc774\uc7ac\uc601\n\nATS\nAvailable for: macOS Sequoia\nImpact: An app may be able to read files outside of its sandbox\nDescription: A permissions issue was addressed by removing the\nvulnerable code.\nCVE-2026-43763: Pavan Nallamothu, Jared Reyes\n\nAudio\nAvailable for: macOS Sequoia\nImpact: An app may be able to break out of its sandbox\nDescription: An access issue was addressed with additional sandbox\nrestrictions.\nCVE-2026-64702: John Lussier\n\nAudio\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\nAVEVideoEncoder\nAvailable for: macOS Sequoia\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges\nDescription: A buffer overflow was addressed with improved size\nvalidation.\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\nAVEVideoEncoder\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun\n\nBackgroundAssets\nAvailable for: macOS Sequoia\nImpact: An app may be able to delete files for which it does not have\npermission\nDescription: A permissions issue was addressed with improved validation.\nCVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity\u0027s WeBin lab\n\nBOM\nAvailable for: macOS Sequoia\nImpact: A maliciously crafted ZIP archive may bypass Gatekeeper checks\nDescription: The issue was addressed with improved checks.\nCVE-2026-28849: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\ncd9660\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination or\nread kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64698: Richard Zana, Peter Malone, Nathaniel Oh (@calysteon),\nan anonymous researcher\n\nContacts\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted contact may leak sensitive data\nDescription: The issue was addressed with improved checks.\nCVE-2026-64734: Daniel Williams\n\nControl Center\nAvailable for: macOS Sequoia\nImpact: An app may be able to access user-sensitive data\nDescription: A logic issue was addressed with improved validation.\nCVE-2026-43756: \uc774\uc7ac\uc601\n\nCore Services\nAvailable for: macOS Sequoia\nImpact: An app may be able to gain root privileges\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-43693: Gergely Kalman (@gergely_kalman)\n\nCoreAudio\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted audio file may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\nCoreAudio\nAvailable for: macOS Sequoia\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43744: Mathis Mansi\u00e8re, an anonymous researcher\n\nCoreAudio\nAvailable for: macOS Sequoia\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43803: Rahul Raj\n\nCoreMedia\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-43775: Csaba Fitzl (@theevilbit) of Iru\n\nCoreMedia\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\nCoreServices\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved checks.\nCVE-2026-28936: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nCoreUI\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted asset catalog may result in\ndisclosure of process memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43738: Peter Malone\n\nCoreVideo\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43802: an anonymous researcher\n\nCrash Reporter\nAvailable for: macOS Sequoia\nImpact: An app may be able to leak sensitive user information\nDescription: A privacy issue was addressed by removing sensitive data.\nCVE-2026-64710: Matthew Schneider\n\nCUPS\nAvailable for: macOS Sequoia\nImpact: A malicious app may be able to gain root privileges\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-39875: XBreach.ai, Dallas Dubs, Andreas Jaegersberger \u0026 Ro\nAchterberg of Nosebeard Labs, Aaron Grattafiori - NVIDIA AI Red Team\n\nCUPS\nAvailable for: macOS Sequoia\nImpact: An app may be able to gain root privileges\nDescription: An injection issue was addressed with improved validation.\nCVE-2026-43698: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\ncurl\nAvailable for: macOS Sequoia\nImpact: Authentication credentials may be sent to a server on another\norigin\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-3784\nCVE-2026-3783\n\nData Detectors UI\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-43758: HvxyZLF\n\nDesktopServices\nAvailable for: macOS Sequoia\nImpact: An app may bypass Gatekeeper checks\nDescription: A file quarantine bypass was addressed with additional\nchecks.\nCVE-2026-64708: Lance Cain - Offensive Security Engineer, SpecterOps\nInc.\n\nDisk Images\nAvailable for: macOS Sequoia\nImpact: An app may be able to elevate privileges\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-28926: Jonathan Bar Or (@yo_yo_yo_jbo)\n\nDisk Images\nAvailable for: macOS Sequoia\nImpact: Parsing a maliciously crafted file may lead to an unexpected app\ntermination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43747: Anthony Laou Hine Tsuei (@anarcheuz)\n\nDisk Images\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-64694: Gil Portnoy \u0026 Henry\n\nDisk Images\nAvailable for: macOS Sequoia\nImpact: An app may be able to bypass network restrictions\nDescription: A permissions issue was addressed with additional sandbox\nrestrictions.\nCVE-2026-28945: Ayaan Ahmad\n\nDisk Images\nAvailable for: macOS Sequoia\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-64776: Hyunwoo Kim (@v4bel)\n\nDriverKit\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: An issue existed in the handling of environment variables.\nThis issue was addressed with improved validation.\nCVE-2026-43793: erdene-och Byambabayar\n\nDriverKit\nAvailable for: macOS Sequoia\nImpact: An attacker with physical access to a locked device may be able\nto view sensitive user information\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43753: Niels Hofmans\n\nFoundation\nAvailable for: macOS Sequoia\nImpact: A malicious app may be able to access protected user data\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43714: an anonymous researcher\n\nGame Center\nAvailable for: macOS Sequoia\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\nGame Center\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive\nTechnologies\n\nHeimdal\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64692: Redon Gashi\n\nHFS\nAvailable for: macOS Sequoia\nImpact: A remote user may be able to cause unexpected system termination\nor corrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43682: Trung Nguyen (@everpi"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:47:39Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/18"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/18"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/downloads/"
},
{
"url": "https://support.apple.com/en-us/128071"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/18"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-07-27-2026-3 macOS Sequoia 15.7.8",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2025-43325",
"type": "related"
},
{
"destId": "CVE-2026-20672",
"type": "related"
},
{
"destId": "CVE-2026-23918",
"type": "related"
},
{
"destId": "CVE-2026-28849",
"type": "related"
},
{
"destId": "CVE-2026-28896",
"type": "related"
},
{
"destId": "CVE-2026-28900",
"type": "related"
},
{
"destId": "CVE-2026-28912",
"type": "related"
},
{
"destId": "CVE-2026-28914",
"type": "related"
},
{
"destId": "CVE-2026-28926",
"type": "related"
},
{
"destId": "CVE-2026-28932",
"type": "related"
},
{
"destId": "CVE-2026-28936",
"type": "related"
},
{
"destId": "CVE-2026-28945",
"type": "related"
},
{
"destId": "CVE-2026-28961",
"type": "related"
},
{
"destId": "CVE-2026-28973",
"type": "related"
},
{
"destId": "CVE-2026-28981",
"type": "related"
},
{
"destId": "CVE-2026-28982",
"type": "related"
},
{
"destId": "CVE-2026-28983",
"type": "related"
},
{
"destId": "CVE-2026-3783",
"type": "related"
},
{
"destId": "CVE-2026-3784",
"type": "related"
},
{
"destId": "CVE-2026-39868",
"type": "related"
},
{
"destId": "CVE-2026-39873",
"type": "related"
},
{
"destId": "CVE-2026-39874",
"type": "related"
},
{
"destId": "CVE-2026-39875",
"type": "related"
},
{
"destId": "CVE-2026-39877",
"type": "related"
},
{
"destId": "CVE-2026-43653",
"type": "related"
},
{
"destId": "CVE-2026-43661",
"type": "related"
},
{
"destId": "CVE-2026-43665",
"type": "related"
},
{
"destId": "CVE-2026-43672",
"type": "related"
},
{
"destId": "CVE-2026-43673",
"type": "related"
},
{
"destId": "CVE-2026-43681",
"type": "related"
},
{
"destId": "CVE-2026-43682",
"type": "related"
},
{
"destId": "CVE-2026-43693",
"type": "related"
},
{
"destId": "CVE-2026-43694",
"type": "related"
},
{
"destId": "CVE-2026-43698",
"type": "related"
},
{
"destId": "CVE-2026-43703",
"type": "related"
},
{
"destId": "CVE-2026-43706",
"type": "related"
},
{
"destId": "CVE-2026-43710",
"type": "related"
},
{
"destId": "CVE-2026-43711",
"type": "related"
},
{
"destId": "CVE-2026-43714",
"type": "related"
},
{
"destId": "CVE-2026-43722",
"type": "related"
},
{
"destId": "CVE-2026-43723",
"type": "related"
},
{
"destId": "CVE-2026-43724",
"type": "related"
},
{
"destId": "CVE-2026-43729",
"type": "related"
},
{
"destId": "CVE-2026-43733",
"type": "related"
},
{
"destId": "CVE-2026-43738",
"type": "related"
},
{
"destId": "CVE-2026-43744",
"type": "related"
},
{
"destId": "CVE-2026-43747",
"type": "related"
},
{
"destId": "CVE-2026-43748",
"type": "related"
},
{
"destId": "CVE-2026-43749",
"type": "related"
},
{
"destId": "CVE-2026-43750",
"type": "related"
},
{
"destId": "CVE-2026-43753",
"type": "related"
},
{
"destId": "CVE-2026-43754",
"type": "related"
},
{
"destId": "CVE-2026-43756",
"type": "related"
},
{
"destId": "CVE-2026-43757",
"type": "related"
},
{
"destId": "CVE-2026-43758",
"type": "related"
},
{
"destId": "CVE-2026-43763",
"type": "related"
},
{
"destId": "CVE-2026-43764",
"type": "related"
},
{
"destId": "CVE-2026-43765",
"type": "related"
},
{
"destId": "CVE-2026-43766",
"type": "related"
},
{
"destId": "CVE-2026-43767",
"type": "related"
},
{
"destId": "CVE-2026-43768",
"type": "related"
},
{
"destId": "CVE-2026-43769",
"type": "related"
},
{
"destId": "CVE-2026-43770",
"type": "related"
},
{
"destId": "CVE-2026-43771",
"type": "related"
},
{
"destId": "CVE-2026-43772",
"type": "related"
},
{
"destId": "CVE-2026-43773",
"type": "related"
},
{
"destId": "CVE-2026-43774",
"type": "related"
},
{
"destId": "CVE-2026-43775",
"type": "related"
},
{
"destId": "CVE-2026-43776",
"type": "related"
},
{
"destId": "CVE-2026-43777",
"type": "related"
},
{
"destId": "CVE-2026-43778",
"type": "related"
},
{
"destId": "CVE-2026-43779",
"type": "related"
},
{
"destId": "CVE-2026-43780",
"type": "related"
},
{
"destId": "CVE-2026-43781",
"type": "related"
},
{
"destId": "CVE-2026-43782",
"type": "related"
},
{
"destId": "CVE-2026-43793",
"type": "related"
},
{
"destId": "CVE-2026-43796",
"type": "related"
},
{
"destId": "CVE-2026-43799",
"type": "related"
},
{
"destId": "CVE-2026-43801",
"type": "related"
},
{
"destId": "CVE-2026-43802",
"type": "related"
},
{
"destId": "CVE-2026-43803",
"type": "related"
},
{
"destId": "CVE-2026-43805",
"type": "related"
},
{
"destId": "CVE-2026-43807",
"type": "related"
},
{
"destId": "CVE-2026-43809",
"type": "related"
},
{
"destId": "CVE-2026-43810",
"type": "related"
},
{
"destId": "CVE-2026-43812",
"type": "related"
},
{
"destId": "CVE-2026-43818",
"type": "related"
},
{
"destId": "CVE-2026-43822",
"type": "related"
},
{
"destId": "CVE-2026-4424",
"type": "related"
},
{
"destId": "CVE-2026-64692",
"type": "related"
},
{
"destId": "CVE-2026-64693",
"type": "related"
},
{
"destId": "CVE-2026-64694",
"type": "related"
},
{
"destId": "CVE-2026-64695",
"type": "related"
},
{
"destId": "CVE-2026-64696",
"type": "related"
},
{
"destId": "CVE-2026-64697",
"type": "related"
},
{
"destId": "CVE-2026-64698",
"type": "related"
},
{
"destId": "CVE-2026-64699",
"type": "related"
},
{
"destId": "CVE-2026-64700",
"type": "related"
},
{
"destId": "CVE-2026-64702",
"type": "related"
},
{
"destId": "CVE-2026-64703",
"type": "related"
},
{
"destId": "CVE-2026-64704",
"type": "related"
},
{
"destId": "CVE-2026-64707",
"type": "related"
},
{
"destId": "CVE-2026-64708",
"type": "related"
},
{
"destId": "CVE-2026-64709",
"type": "related"
},
{
"destId": "CVE-2026-64710",
"type": "related"
},
{
"destId": "CVE-2026-64711",
"type": "related"
},
{
"destId": "CVE-2026-64716",
"type": "related"
},
{
"destId": "CVE-2026-64721",
"type": "related"
},
{
"destId": "CVE-2026-64722",
"type": "related"
},
{
"destId": "CVE-2026-64723",
"type": "related"
},
{
"destId": "CVE-2026-64724",
"type": "related"
},
{
"destId": "CVE-2026-64725",
"type": "related"
},
{
"destId": "CVE-2026-64731",
"type": "related"
},
{
"destId": "CVE-2026-64734",
"type": "related"
},
{
"destId": "CVE-2026-64735",
"type": "related"
},
{
"destId": "CVE-2026-64737",
"type": "related"
},
{
"destId": "CVE-2026-64738",
"type": "related"
},
{
"destId": "CVE-2026-64739",
"type": "related"
},
{
"destId": "CVE-2026-64740",
"type": "related"
},
{
"destId": "CVE-2026-64744",
"type": "related"
},
{
"destId": "CVE-2026-64745",
"type": "related"
},
{
"destId": "CVE-2026-64747",
"type": "related"
},
{
"destId": "CVE-2026-64749",
"type": "related"
},
{
"destId": "CVE-2026-64754",
"type": "related"
},
{
"destId": "CVE-2026-64762",
"type": "related"
},
{
"destId": "CVE-2026-64763",
"type": "related"
},
{
"destId": "CVE-2026-64764",
"type": "related"
},
{
"destId": "CVE-2026-64765",
"type": "related"
},
{
"destId": "CVE-2026-64766",
"type": "related"
},
{
"destId": "CVE-2026-64767",
"type": "related"
},
{
"destId": "CVE-2026-64768",
"type": "related"
},
{
"destId": "CVE-2026-64769",
"type": "related"
},
{
"destId": "CVE-2026-64770",
"type": "related"
},
{
"destId": "CVE-2026-64771",
"type": "related"
},
{
"destId": "CVE-2026-64772",
"type": "related"
},
{
"destId": "CVE-2026-64774",
"type": "related"
},
{
"destId": "CVE-2026-64775",
"type": "related"
},
{
"destId": "CVE-2026-64776",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0289",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/18",
"automated": true,
"contentSha256": "e64d1a889f433769bd47797e78ee4704310ebdb153b485d5ecb930df45b5b7a7",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/18",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-07-28T00:20:41Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0289"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T11:40:46Z",
"dateUpdated": "2026-09-11T11:47:39Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0289"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0041
Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:47
VLAI
EPSS
VEX
Title
APPLE-SA-07-27-2026-3 macOS Sequoia 15.7.8
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-07-27-2026-3 macOS Sequoia 15.7.8
macOS Sequoia 15.7.8 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/128071.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accounts
Available for: macOS Sequoia
Impact: An app may be able to gain root privileges
Description: A parsing issue in the handling of directory paths was
addressed with improved path validation.
CVE-2026-43749: Adam Franke, Trung Nguyen (@everping) of CyStack, Ashish
Kunwar
afpfs
Available for: macOS Sequoia
Impact: A remote attacker may be able to cause unexpected system
termination or corrupt kernel memory
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-64767: Dave G.
apache
Available for: macOS Sequoia
Impact: A remote attacker may be able to cause a denial-of-service
Description: This is a vulnerability in open source code and Apple
Software is among the affected projects. The CVE-ID was assigned by a
third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2026-23918: Юлия Мерцалова
APFS
Available for: macOS Sequoia
Impact: A remote user may be able to cause unexpected system termination
or corrupt kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64695: Peter Malone
App Store
Available for: macOS Sequoia
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved checks.
CVE-2026-43801: Rahul Raj
Apple Account
Available for: macOS Sequoia
Impact: An app may be able to access sensitive user data
Description: A race condition was addressed with improved state
handling.
CVE-2026-43781: Pinak Oza
Apple Account
Available for: macOS Sequoia
Impact: A malicious app may be able to break out of its sandbox
Description: An authorization issue was addressed with improved state
management.
CVE-2026-64737: Robert Mindo
Apple Neural Engine
Available for: macOS Sequoia
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43748: an anonymous researcher, tamdao, Franco Belman at
Blackwing Intelligence
AppleDouble
Available for: macOS Sequoia
Impact: Processing a maliciously crafted file may lead to unexpected app
termination or arbitrary code execution
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-43776: Peter Malone, Nicolas Rabrenovic, Irvin Wang
AppleRAID
Available for: macOS Sequoia
Impact: A local user may be able to read kernel memory
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-43681: impost0r (ret2plt), David Ige - Beryllium Security
Assets
Available for: macOS Sequoia
Impact: A malicious application may be able to bypass Privacy
preferences
Description: An authorization issue was addressed with improved state
management.
CVE-2026-43672: 이재영
ATS
Available for: macOS Sequoia
Impact: An app may be able to read files outside of its sandbox
Description: A permissions issue was addressed by removing the
vulnerable code.
CVE-2026-43763: Pavan Nallamothu, Jared Reyes
Audio
Available for: macOS Sequoia
Impact: An app may be able to break out of its sandbox
Description: An access issue was addressed with additional sandbox
restrictions.
CVE-2026-64702: John Lussier
Audio
Available for: macOS Sequoia
Impact: An app may be able to cause a denial-of-service
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)
AVEVideoEncoder
Available for: macOS Sequoia
Impact: An app may be able to execute arbitrary code with kernel
privileges
Description: A buffer overflow was addressed with improved size
validation.
CVE-2026-64747: Franco Belman at Blackwing Intelligence
AVEVideoEncoder
Available for: macOS Sequoia
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun
BackgroundAssets
Available for: macOS Sequoia
Impact: An app may be able to delete files for which it does not have
permission
Description: A permissions issue was addressed with improved validation.
CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab
BOM
Available for: macOS Sequoia
Impact: A maliciously crafted ZIP archive may bypass Gatekeeper checks
Description: The issue was addressed with improved checks.
CVE-2026-28849: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
cd9660
Available for: macOS Sequoia
Impact: An app may be able to cause unexpected system termination or
read kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64698: Richard Zana, Peter Malone, Nathaniel Oh (@calysteon),
an anonymous researcher
Contacts
Available for: macOS Sequoia
Impact: Processing a maliciously crafted contact may leak sensitive data
Description: The issue was addressed with improved checks.
CVE-2026-64734: Daniel Williams
Control Center
Available for: macOS Sequoia
Impact: An app may be able to access user-sensitive data
Description: A logic issue was addressed with improved validation.
CVE-2026-43756: 이재영
Core Services
Available for: macOS Sequoia
Impact: An app may be able to gain root privileges
Description: A race condition was addressed with improved state
handling.
CVE-2026-43693: Gergely Kalman (@gergely_kalman)
CoreAudio
Available for: macOS Sequoia
Impact: Processing a maliciously crafted audio file may corrupt process
memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative
CoreAudio
Available for: macOS Sequoia
Impact: Processing an audio stream in a maliciously crafted media file
may terminate the process
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43744: Mathis Mansière, an anonymous researcher
CoreAudio
Available for: macOS Sequoia
Impact: A remote attacker may be able to cause unexpected system
termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43803: Rahul Raj
CoreMedia
Available for: macOS Sequoia
Impact: An app may be able to access sensitive user data
Description: An authorization issue was addressed with improved state
management.
CVE-2026-43775: Csaba Fitzl (@theevilbit) of Iru
CoreMedia
Available for: macOS Sequoia
Impact: Processing a maliciously crafted video file may lead to
unexpected app termination
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2026-43711: James Duffy (@0x4A616D657344)
CoreServices
Available for: macOS Sequoia
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: The issue was addressed with improved checks.
CVE-2026-28936: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
CoreUI
Available for: macOS Sequoia
Impact: Processing a maliciously crafted asset catalog may result in
disclosure of process memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43738: Peter Malone
CoreVideo
Available for: macOS Sequoia
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43802: an anonymous researcher
Crash Reporter
Available for: macOS Sequoia
Impact: An app may be able to leak sensitive user information
Description: A privacy issue was addressed by removing sensitive data.
CVE-2026-64710: Matthew Schneider
CUPS
Available for: macOS Sequoia
Impact: A malicious app may be able to gain root privileges
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-39875: XBreach.ai, Dallas Dubs, Andreas Jaegersberger & Ro
Achterberg of Nosebeard Labs, Aaron Grattafiori - NVIDIA AI Red Team
CUPS
Available for: macOS Sequoia
Impact: An app may be able to gain root privileges
Description: An injection issue was addressed with improved validation.
CVE-2026-43698: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
curl
Available for: macOS Sequoia
Impact: Authentication credentials may be sent to a server on another
origin
Description: This is a vulnerability in open source code and Apple
Software is among the affected projects. The CVE-ID was assigned by a
third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2026-3784
CVE-2026-3783
Data Detectors UI
Available for: macOS Sequoia
Impact: An app may be able to access sensitive user data
Description: An authorization issue was addressed with improved state
management.
CVE-2026-43758: HvxyZLF
DesktopServices
Available for: macOS Sequoia
Impact: An app may bypass Gatekeeper checks
Description: A file quarantine bypass was addressed with additional
checks.
CVE-2026-64708: Lance Cain - Offensive Security Engineer, SpecterOps
Inc.
Disk Images
Available for: macOS Sequoia
Impact: An app may be able to elevate privileges
Description: A race condition was addressed with improved state
handling.
CVE-2026-28926: Jonathan Bar Or (@yo_yo_yo_jbo)
Disk Images
Available for: macOS Sequoia
Impact: Parsing a maliciously crafted file may lead to an unexpected app
termination
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-43747: Anthony Laou Hine Tsuei (@anarcheuz)
Disk Images
Available for: macOS Sequoia
Impact: An app may be able to cause unexpected system termination
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-64694: Gil Portnoy & Henry
Disk Images
Available for: macOS Sequoia
Impact: An app may be able to bypass network restrictions
Description: A permissions issue was addressed with additional sandbox
restrictions.
CVE-2026-28945: Ayaan Ahmad
Disk Images
Available for: macOS Sequoia
Impact: An app may be able to disclose kernel memory
Description: The issue was addressed with improved bounds checks.
CVE-2026-64776: Hyunwoo Kim (@v4bel)
DriverKit
Available for: macOS Sequoia
Impact: An app may be able to cause unexpected system termination
Description: An issue existed in the handling of environment variables.
This issue was addressed with improved validation.
CVE-2026-43793: erdene-och Byambabayar
DriverKit
Available for: macOS Sequoia
Impact: An attacker with physical access to a locked device may be able
to view sensitive user information
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-43753: Niels Hofmans
Foundation
Available for: macOS Sequoia
Impact: A malicious app may be able to access protected user data
Description: The issue was addressed with improved input sanitization.
CVE-2026-43714: an anonymous researcher
Game Center
Available for: macOS Sequoia
Impact: A malicious app may be able to break out of its sandbox
Description: A parsing issue in the handling of directory paths was
addressed with improved path validation.
CVE-2026-64740: Manuel Fernandez (Stackhopper Security)
Game Center
Available for: macOS Sequoia
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved data protection.
CVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive
Technologies
Heimdal
Available for: macOS Sequoia
Impact: An app may be able to cause a denial-of-service
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-64692: Redon Gashi
HFS
Available for: macOS Sequoia
Impact: A remote user may be able to cause unexpected system termination
or corrupt kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43682: Trung Nguyen (@everpi
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apple | Macos Sequoia |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "Macos Sequoia",
"vendor": "Apple",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-07-27-2026-3 macOS Sequoia 15.7.8\n\nmacOS Sequoia 15.7.8 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/128071.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccounts\nAvailable for: macOS Sequoia\nImpact: An app may be able to gain root privileges\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-43749: Adam Franke, Trung Nguyen (@everping) of CyStack, Ashish\nKunwar\n\nafpfs\nAvailable for: macOS Sequoia\nImpact: A remote attacker may be able to cause unexpected system\ntermination or corrupt kernel memory\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-64767: Dave G.\n\napache\nAvailable for: macOS Sequoia\nImpact: A remote attacker may be able to cause a denial-of-service\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-23918: \u042e\u043b\u0438\u044f \u041c\u0435\u0440\u0446\u0430\u043b\u043e\u0432\u0430\n\nAPFS\nAvailable for: macOS Sequoia\nImpact: A remote user may be able to cause unexpected system termination\nor corrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64695: Peter Malone\n\nApp Store\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved checks.\nCVE-2026-43801: Rahul Raj\n\nApple Account\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-43781: Pinak Oza\n\nApple Account\nAvailable for: macOS Sequoia\nImpact: A malicious app may be able to break out of its sandbox\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-64737: Robert Mindo\n\nApple Neural Engine\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43748: an anonymous researcher, tamdao, Franco Belman at\nBlackwing Intelligence\n\nAppleDouble\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination or arbitrary code execution\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-43776: Peter Malone, Nicolas Rabrenovic, Irvin Wang\n\nAppleRAID\nAvailable for: macOS Sequoia\nImpact: A local user may be able to read kernel memory\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-43681: impost0r (ret2plt), David Ige - Beryllium Security\n\nAssets\nAvailable for: macOS Sequoia\nImpact: A malicious application may be able to bypass Privacy\npreferences\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-43672: \uc774\uc7ac\uc601\n\nATS\nAvailable for: macOS Sequoia\nImpact: An app may be able to read files outside of its sandbox\nDescription: A permissions issue was addressed by removing the\nvulnerable code.\nCVE-2026-43763: Pavan Nallamothu, Jared Reyes\n\nAudio\nAvailable for: macOS Sequoia\nImpact: An app may be able to break out of its sandbox\nDescription: An access issue was addressed with additional sandbox\nrestrictions.\nCVE-2026-64702: John Lussier\n\nAudio\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\nAVEVideoEncoder\nAvailable for: macOS Sequoia\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges\nDescription: A buffer overflow was addressed with improved size\nvalidation.\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\nAVEVideoEncoder\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun\n\nBackgroundAssets\nAvailable for: macOS Sequoia\nImpact: An app may be able to delete files for which it does not have\npermission\nDescription: A permissions issue was addressed with improved validation.\nCVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity\u0027s WeBin lab\n\nBOM\nAvailable for: macOS Sequoia\nImpact: A maliciously crafted ZIP archive may bypass Gatekeeper checks\nDescription: The issue was addressed with improved checks.\nCVE-2026-28849: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\ncd9660\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination or\nread kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64698: Richard Zana, Peter Malone, Nathaniel Oh (@calysteon),\nan anonymous researcher\n\nContacts\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted contact may leak sensitive data\nDescription: The issue was addressed with improved checks.\nCVE-2026-64734: Daniel Williams\n\nControl Center\nAvailable for: macOS Sequoia\nImpact: An app may be able to access user-sensitive data\nDescription: A logic issue was addressed with improved validation.\nCVE-2026-43756: \uc774\uc7ac\uc601\n\nCore Services\nAvailable for: macOS Sequoia\nImpact: An app may be able to gain root privileges\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-43693: Gergely Kalman (@gergely_kalman)\n\nCoreAudio\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted audio file may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\nCoreAudio\nAvailable for: macOS Sequoia\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43744: Mathis Mansi\u00e8re, an anonymous researcher\n\nCoreAudio\nAvailable for: macOS Sequoia\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43803: Rahul Raj\n\nCoreMedia\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-43775: Csaba Fitzl (@theevilbit) of Iru\n\nCoreMedia\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\nCoreServices\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved checks.\nCVE-2026-28936: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nCoreUI\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted asset catalog may result in\ndisclosure of process memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43738: Peter Malone\n\nCoreVideo\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43802: an anonymous researcher\n\nCrash Reporter\nAvailable for: macOS Sequoia\nImpact: An app may be able to leak sensitive user information\nDescription: A privacy issue was addressed by removing sensitive data.\nCVE-2026-64710: Matthew Schneider\n\nCUPS\nAvailable for: macOS Sequoia\nImpact: A malicious app may be able to gain root privileges\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-39875: XBreach.ai, Dallas Dubs, Andreas Jaegersberger \u0026 Ro\nAchterberg of Nosebeard Labs, Aaron Grattafiori - NVIDIA AI Red Team\n\nCUPS\nAvailable for: macOS Sequoia\nImpact: An app may be able to gain root privileges\nDescription: An injection issue was addressed with improved validation.\nCVE-2026-43698: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\ncurl\nAvailable for: macOS Sequoia\nImpact: Authentication credentials may be sent to a server on another\norigin\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-3784\nCVE-2026-3783\n\nData Detectors UI\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-43758: HvxyZLF\n\nDesktopServices\nAvailable for: macOS Sequoia\nImpact: An app may bypass Gatekeeper checks\nDescription: A file quarantine bypass was addressed with additional\nchecks.\nCVE-2026-64708: Lance Cain - Offensive Security Engineer, SpecterOps\nInc.\n\nDisk Images\nAvailable for: macOS Sequoia\nImpact: An app may be able to elevate privileges\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-28926: Jonathan Bar Or (@yo_yo_yo_jbo)\n\nDisk Images\nAvailable for: macOS Sequoia\nImpact: Parsing a maliciously crafted file may lead to an unexpected app\ntermination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43747: Anthony Laou Hine Tsuei (@anarcheuz)\n\nDisk Images\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-64694: Gil Portnoy \u0026 Henry\n\nDisk Images\nAvailable for: macOS Sequoia\nImpact: An app may be able to bypass network restrictions\nDescription: A permissions issue was addressed with additional sandbox\nrestrictions.\nCVE-2026-28945: Ayaan Ahmad\n\nDisk Images\nAvailable for: macOS Sequoia\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-64776: Hyunwoo Kim (@v4bel)\n\nDriverKit\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: An issue existed in the handling of environment variables.\nThis issue was addressed with improved validation.\nCVE-2026-43793: erdene-och Byambabayar\n\nDriverKit\nAvailable for: macOS Sequoia\nImpact: An attacker with physical access to a locked device may be able\nto view sensitive user information\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43753: Niels Hofmans\n\nFoundation\nAvailable for: macOS Sequoia\nImpact: A malicious app may be able to access protected user data\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43714: an anonymous researcher\n\nGame Center\nAvailable for: macOS Sequoia\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\nGame Center\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43796: Stanislav Jelezoglo, Ilya Andr (andrd3v) of Positive\nTechnologies\n\nHeimdal\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64692: Redon Gashi\n\nHFS\nAvailable for: macOS Sequoia\nImpact: A remote user may be able to cause unexpected system termination\nor corrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43682: Trung Nguyen (@everpi"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:47:39Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/18"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/18"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/downloads/"
},
{
"url": "https://support.apple.com/en-us/128071"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/18"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-07-27-2026-3 macOS Sequoia 15.7.8",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0041",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/18",
"automated": true,
"contentSha256": "e64d1a889f433769bd47797e78ee4704310ebdb153b485d5ecb930df45b5b7a7",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/18",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-07-28T00:20:41Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:21Z",
"dateUpdated": "2026-09-11T11:47:39Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0041"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0288
Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-11 11:47
VLAI
EPSS
VEX
Title
APPLE-SA-07-27-2026-2 macOS Tahoe 26.6
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-07-27-2026-2 macOS Tahoe 26.6
macOS Tahoe 26.6 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/128067.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accounts
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: An access issue was addressed with additional sandbox
restrictions.
CVE-2026-43819: Omar Cerrito
Accounts
Available for: macOS Tahoe
Impact: An app may be able to gain root privileges
Description: A parsing issue in the handling of directory paths was
addressed with improved path validation.
CVE-2026-43749: Adam Franke, Ashish Kunwar, Trung Nguyen (@everping) of
CyStack
Accounts Framework
Available for: macOS Tahoe
Impact: An app may be able to fingerprint the user
Description: This issue was addressed with improved data protection.
CVE-2026-64733: Rosyna Keller of Totally Not Malicious Software
(paradisefacade.com)
afpfs
Available for: macOS Tahoe
Impact: A remote attacker may be able to cause unexpected system
termination or corrupt kernel memory
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-64767: Dave G.
apache
Available for: macOS Tahoe
Impact: A remote attacker may be able to cause a denial-of-service
Description: This is a vulnerability in open source code and Apple
Software is among the affected projects. The CVE-ID was assigned by a
third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2026-23918: Юлия Мерцалова
APFS
Available for: macOS Tahoe
Impact: A remote user may be able to cause unexpected system termination
or corrupt kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64695: Peter Malone
App Store
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved checks.
CVE-2026-43801: Rahul Raj
Apple Account
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: A race condition was addressed with improved state
handling.
CVE-2026-43781: Pinak Oza
Apple Account
Available for: macOS Tahoe
Impact: A malicious app may be able to break out of its sandbox
Description: An authorization issue was addressed with improved state
management.
CVE-2026-64737: Robert Mindo
Apple Neural Engine
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43748: an anonymous researcher, tamdao, Franco Belman at
Blackwing Intelligence
Apple Neural Engine
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-28928: Dun
AppleDouble
Available for: macOS Tahoe
Impact: Processing a maliciously crafted file may lead to unexpected app
termination or arbitrary code execution
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-43776: Irvin Wang, Peter Malone, Nicolas Rabrenovic
AppleRAID
Available for: macOS Tahoe
Impact: A local user may be able to read kernel memory
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-43681: impost0r (ret2plt), David Ige - Beryllium Security
Assets
Available for: macOS Tahoe
Impact: A malicious application may be able to bypass Privacy
preferences
Description: An authorization issue was addressed with improved state
management.
CVE-2026-43672: 이재영
ATS
Available for: macOS Tahoe
Impact: An app may be able to read files outside of its sandbox
Description: A permissions issue was addressed by removing the
vulnerable code.
CVE-2026-43763: Pavan Nallamothu, Jared Reyes
Audio
Available for: macOS Tahoe
Impact: An app may be able to break out of its sandbox
Description: An access issue was addressed with additional sandbox
restrictions.
CVE-2026-64702: John Lussier
Audio
Available for: macOS Tahoe
Impact: An app may be able to cause a denial-of-service
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)
AuthKit
Available for: macOS Tahoe
Impact: An app may be able to fingerprint the user
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-43730: David Strnadel
AVEVideoEncoder
Available for: macOS Tahoe
Impact: An app may be able to execute arbitrary code with kernel
privileges
Description: A buffer overflow was addressed with improved size
validation.
CVE-2026-64747: Franco Belman at Blackwing Intelligence
AVEVideoEncoder
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-64762: Dun, Franco Belman at Blackwing Intelligence
BackgroundAssets
Available for: macOS Tahoe
Impact: An app may be able to delete files for which it does not have
permission
Description: A permissions issue was addressed with improved validation.
CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab
cd9660
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination or
read kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64698: an anonymous researcher, Richard Zana, Nathaniel Oh
(@calysteon), Peter Malone
CloudAttestation
Available for: macOS Tahoe
Impact: A maliciously crafted app may be able to bypass code signing
enforcement
Description: A validation issue was addressed with improved input
sanitization.
CVE-2026-43813: Anton Pakhunov
Contacts
Available for: macOS Tahoe
Impact: An app may be able to add contacts without user authorization
Description: An authorization issue was addressed with improved
validation.
CVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel
Febrero
Contacts
Available for: macOS Tahoe
Impact: Processing a maliciously crafted contact may leak sensitive data
Description: The issue was addressed with improved checks.
CVE-2026-64734: Daniel Williams
Contacts
Available for: macOS Tahoe
Impact: An app may be able to access information about a user's contacts
Description: This issue was addressed with improved checks.
CVE-2026-43797: Arni Hardarson (Neonix Security)
Control Center
Available for: macOS Tahoe
Impact: An app may be able to access user-sensitive data
Description: A logic issue was addressed with improved validation.
CVE-2026-43756: 이재영
Core Services
Available for: macOS Tahoe
Impact: An app may be able to gain root privileges
Description: A race condition was addressed with improved state
handling.
CVE-2026-43693: Gergely Kalman (@gergely_kalman)
CoreAudio
Available for: macOS Tahoe
Impact: Processing a maliciously crafted audio file may corrupt process
memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative
CoreAudio
Available for: macOS Tahoe
Impact: Processing an audio stream in a maliciously crafted media file
may terminate the process
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43744: Mathis Mansière, an anonymous researcher
CoreAudio
Available for: macOS Tahoe
Impact: A remote attacker may be able to cause unexpected system
termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43803: Rahul Raj
CoreMedia
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: An authorization issue was addressed with improved state
management.
CVE-2026-43775: Csaba Fitzl (@theevilbit) of Iru
CVE-2026-43759: 이재영, Rajdip Dey Sarkar, Arni Hardarson (Neonix Security)
CoreMedia
Available for: macOS Tahoe
Impact: Processing a maliciously crafted video file may lead to
unexpected app termination
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2026-43711: James Duffy (@0x4A616D657344)
CoreVideo
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43802: an anonymous researcher
Crash Reporter
Available for: macOS Tahoe
Impact: An app may be able to leak sensitive user information
Description: A privacy issue was addressed by removing sensitive data.
CVE-2026-64710: Matthew Schneider
CUPS
Available for: macOS Tahoe
Impact: A malicious app may be able to gain root privileges
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-39875: Dallas Dubs, Aaron Grattafiori - NVIDIA AI Red Team,
XBreach.ai, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
CUPS
Available for: macOS Tahoe
Impact: An app may be able to gain root privileges
Description: An injection issue was addressed with improved validation.
CVE-2026-43698: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
curl
Available for: macOS Tahoe
Impact: Authentication credentials may be sent to a server on another
origin
Description: This is a vulnerability in open source code and Apple
Software is among the affected projects. The CVE-ID was assigned by a
third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2026-3784
CVE-2026-3783
Data Detectors UI
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: An authorization issue was addressed with improved state
management.
CVE-2026-43758: HvxyZLF
DesktopServices
Available for: macOS Tahoe
Impact: An app may bypass Gatekeeper checks
Description: A file quarantine bypass was addressed with additional
checks.
CVE-2026-64708: Lance Cain - Offensive Security Engineer, SpecterOps
Inc.
Disk Images
Available for: macOS Tahoe
Impact: An app may be able to disclose kernel memory
Description: The issue was addressed with improved bounds checks.
CVE-2026-64776: Hyunwoo Kim (@v4bel)
Disk Images
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-64694: Gil Portnoy & Henry
Disk Images
Available for: macOS Tahoe
Impact: Parsing a maliciously crafted file may lead to an unexpected app
termination
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-43747: Anthony Laou Hine Tsuei (@anarcheuz)
Disk Images
Available for: macOS Tahoe
Impact: An app may be able to bypass network restrictions
Description: A permissions issue was addressed with additional sandbox
restrictions.
CVE-2026-28945: Ayaan Ahmad
DriverKit
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: An issue existed in the handling of environment variables.
This issue was addressed with improved validation.
CVE-2026-43793: erdene-och Byambabayar
DriverKit
Available for: macOS Tahoe
Impact: An attacker with physical access to a locked device may be able
to view sensitive user information
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-43753: Niels Hofmans
Foundation
Available for: macOS Tahoe
Impact: A malicious app may be able to access protected user data
Description: The issue was addressed with improved input sanitization.
CVE-2026-43714: an anonymous researcher
Game Center
Available for: macOS Tahoe
Impact: A malicious app may be able to break out of its sandbox
Description: A parsing issue in the handling of directory paths was
addressed with improved path validation.
CVE-2026-64740: Manuel Fernandez (Stackhopper Security)
Game Center
Available for: macOS Tahoe
Impact: An app may be ab
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apple | Macos Tahoe |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0288 (this record)
- related CVE-2026-23918
- related CVE-2026-28911
- related CVE-2026-28912
- related CVE-2026-28928
- related CVE-2026-28931
- related CVE-2026-28932
- related CVE-2026-28945
- related CVE-2026-28973
- related CVE-2026-28981
- related CVE-2026-28982
- related CVE-2026-3783
- related CVE-2026-3784
- related CVE-2026-39873
- related CVE-2026-39874
- related CVE-2026-39875
- related CVE-2026-43672
- related CVE-2026-43673
- related CVE-2026-43681
- related CVE-2026-43682
- related CVE-2026-43693
- related CVE-2026-43694
- related CVE-2026-43698
- related CVE-2026-43710
- related CVE-2026-43711
- related CVE-2026-43714
- related CVE-2026-43723
- related CVE-2026-43728
- related CVE-2026-43729
- related CVE-2026-43730
- related CVE-2026-43733
- related CVE-2026-43739
- related CVE-2026-43740
- related CVE-2026-43744
- related CVE-2026-43747
- related CVE-2026-43748
- related CVE-2026-43749
- related CVE-2026-43750
- related CVE-2026-43753
- related CVE-2026-43754
- related CVE-2026-43755
- related CVE-2026-43756
- related CVE-2026-43757
- related CVE-2026-43758
- related CVE-2026-43759
- related CVE-2026-43760
- related CVE-2026-43763
- related CVE-2026-43764
- related CVE-2026-43765
- related CVE-2026-43766
- related CVE-2026-43767
- related CVE-2026-43768
- related CVE-2026-43769
- related CVE-2026-43770
- related CVE-2026-43771
- related CVE-2026-43772
- related CVE-2026-43773
- related CVE-2026-43774
- related CVE-2026-43775
- related CVE-2026-43776
- related CVE-2026-43777
- related CVE-2026-43778
- related CVE-2026-43779
- related CVE-2026-43780
- related CVE-2026-43781
- related CVE-2026-43782
- related CVE-2026-43792
- related CVE-2026-43793
- related CVE-2026-43796
- related CVE-2026-43797
- related CVE-2026-43799
- related CVE-2026-43800
- related CVE-2026-43801
- related CVE-2026-43802
- related CVE-2026-43803
- related CVE-2026-43804
- related CVE-2026-43805
- related CVE-2026-43806
- related CVE-2026-43809
- related CVE-2026-43810
- related CVE-2026-43812
- related CVE-2026-43813
- related CVE-2026-43814
- related CVE-2026-43816
- related CVE-2026-43817
- related CVE-2026-43818
- related CVE-2026-43819
- related CVE-2026-43821
- related CVE-2026-43822
- related CVE-2026-4424
- related CVE-2026-64691
- related CVE-2026-64692
- related CVE-2026-64693
- related CVE-2026-64694
- related CVE-2026-64695
- related CVE-2026-64696
- related CVE-2026-64697
- related CVE-2026-64698
- related CVE-2026-64699
- related CVE-2026-64700
- related CVE-2026-64702
- related CVE-2026-64703
- related CVE-2026-64704
- related CVE-2026-64707
- related CVE-2026-64708
- related CVE-2026-64709
- related CVE-2026-64710
- related CVE-2026-64711
- related CVE-2026-64713
- related CVE-2026-64716
- related CVE-2026-64718
- related CVE-2026-64719
- related CVE-2026-64720
- related CVE-2026-64721
- related CVE-2026-64722
- related CVE-2026-64723
- related CVE-2026-64724
- related CVE-2026-64725
- related CVE-2026-64726
- related CVE-2026-64727
- related CVE-2026-64728
- related CVE-2026-64729
- related CVE-2026-64730
- related CVE-2026-64731
- related CVE-2026-64733
- related CVE-2026-64734
- related CVE-2026-64735
- related CVE-2026-64737
- related CVE-2026-64738
- related CVE-2026-64739
- related CVE-2026-64740
- related CVE-2026-64743
- related CVE-2026-64744
- related CVE-2026-64745
- related CVE-2026-64746
- related CVE-2026-64747
- related CVE-2026-64749
- related CVE-2026-64751
- related CVE-2026-64754
- related CVE-2026-64757
- related CVE-2026-64758
- related CVE-2026-64762
- related CVE-2026-64763
- related CVE-2026-64764
- related CVE-2026-64765
- related CVE-2026-64766
- related CVE-2026-64767
- related CVE-2026-64768
- related CVE-2026-64769
- related CVE-2026-64770
- related CVE-2026-64771
- related CVE-2026-64772
- related CVE-2026-64774
- related CVE-2026-64775
- related CVE-2026-64776
- related CVE-2026-64783
{
"containers": {
"cna": {
"affected": [
{
"product": "Macos Tahoe",
"vendor": "Apple",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-07-27-2026-2 macOS Tahoe 26.6\n\nmacOS Tahoe 26.6 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/128067.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccounts\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: An access issue was addressed with additional sandbox\nrestrictions.\nCVE-2026-43819: Omar Cerrito\n\nAccounts\nAvailable for: macOS Tahoe\nImpact: An app may be able to gain root privileges\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-43749: Adam Franke, Ashish Kunwar, Trung Nguyen (@everping) of\nCyStack\n\nAccounts Framework\nAvailable for: macOS Tahoe\nImpact: An app may be able to fingerprint the user\nDescription: This issue was addressed with improved data protection.\nCVE-2026-64733: Rosyna Keller of Totally Not Malicious Software\n(paradisefacade.com)\n\nafpfs\nAvailable for: macOS Tahoe\nImpact: A remote attacker may be able to cause unexpected system\ntermination or corrupt kernel memory\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-64767: Dave G.\n\napache\nAvailable for: macOS Tahoe\nImpact: A remote attacker may be able to cause a denial-of-service\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-23918: \u042e\u043b\u0438\u044f \u041c\u0435\u0440\u0446\u0430\u043b\u043e\u0432\u0430\n\nAPFS\nAvailable for: macOS Tahoe\nImpact: A remote user may be able to cause unexpected system termination\nor corrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64695: Peter Malone\n\nApp Store\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved checks.\nCVE-2026-43801: Rahul Raj\n\nApple Account\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-43781: Pinak Oza\n\nApple Account\nAvailable for: macOS Tahoe\nImpact: A malicious app may be able to break out of its sandbox\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-64737: Robert Mindo\n\nApple Neural Engine\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43748: an anonymous researcher, tamdao, Franco Belman at\nBlackwing Intelligence\n\nApple Neural Engine\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28928: Dun\n\nAppleDouble\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination or arbitrary code execution\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-43776: Irvin Wang, Peter Malone, Nicolas Rabrenovic\n\nAppleRAID\nAvailable for: macOS Tahoe\nImpact: A local user may be able to read kernel memory\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-43681: impost0r (ret2plt), David Ige - Beryllium Security\n\nAssets\nAvailable for: macOS Tahoe\nImpact: A malicious application may be able to bypass Privacy\npreferences\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-43672: \uc774\uc7ac\uc601\n\nATS\nAvailable for: macOS Tahoe\nImpact: An app may be able to read files outside of its sandbox\nDescription: A permissions issue was addressed by removing the\nvulnerable code.\nCVE-2026-43763: Pavan Nallamothu, Jared Reyes\n\nAudio\nAvailable for: macOS Tahoe\nImpact: An app may be able to break out of its sandbox\nDescription: An access issue was addressed with additional sandbox\nrestrictions.\nCVE-2026-64702: John Lussier\n\nAudio\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\nAuthKit\nAvailable for: macOS Tahoe\nImpact: An app may be able to fingerprint the user\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-43730: David Strnadel\n\nAVEVideoEncoder\nAvailable for: macOS Tahoe\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges\nDescription: A buffer overflow was addressed with improved size\nvalidation.\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\nAVEVideoEncoder\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64762: Dun, Franco Belman at Blackwing Intelligence\n\nBackgroundAssets\nAvailable for: macOS Tahoe\nImpact: An app may be able to delete files for which it does not have\npermission\nDescription: A permissions issue was addressed with improved validation.\nCVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity\u0027s WeBin lab\n\ncd9660\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination or\nread kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64698: an anonymous researcher, Richard Zana, Nathaniel Oh\n(@calysteon), Peter Malone\n\nCloudAttestation\nAvailable for: macOS Tahoe\nImpact: A maliciously crafted app may be able to bypass code signing\nenforcement\nDescription: A validation issue was addressed with improved input\nsanitization.\nCVE-2026-43813: Anton Pakhunov\n\nContacts\nAvailable for: macOS Tahoe\nImpact: An app may be able to add contacts without user authorization\nDescription: An authorization issue was addressed with improved\nvalidation.\nCVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel\nFebrero\n\nContacts\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted contact may leak sensitive data\nDescription: The issue was addressed with improved checks.\nCVE-2026-64734: Daniel Williams\n\nContacts\nAvailable for: macOS Tahoe\nImpact: An app may be able to access information about a user\u0027s contacts\nDescription: This issue was addressed with improved checks.\nCVE-2026-43797: Arni Hardarson (Neonix Security)\n\nControl Center\nAvailable for: macOS Tahoe\nImpact: An app may be able to access user-sensitive data\nDescription: A logic issue was addressed with improved validation.\nCVE-2026-43756: \uc774\uc7ac\uc601\n\nCore Services\nAvailable for: macOS Tahoe\nImpact: An app may be able to gain root privileges\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-43693: Gergely Kalman (@gergely_kalman)\n\nCoreAudio\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted audio file may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\nCoreAudio\nAvailable for: macOS Tahoe\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43744: Mathis Mansi\u00e8re, an anonymous researcher\n\nCoreAudio\nAvailable for: macOS Tahoe\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43803: Rahul Raj\n\nCoreMedia\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-43775: Csaba Fitzl (@theevilbit) of Iru\nCVE-2026-43759: \uc774\uc7ac\uc601, Rajdip Dey Sarkar, Arni Hardarson (Neonix Security)\n\nCoreMedia\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\nCoreVideo\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43802: an anonymous researcher\n\nCrash Reporter\nAvailable for: macOS Tahoe\nImpact: An app may be able to leak sensitive user information\nDescription: A privacy issue was addressed by removing sensitive data.\nCVE-2026-64710: Matthew Schneider\n\nCUPS\nAvailable for: macOS Tahoe\nImpact: A malicious app may be able to gain root privileges\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-39875: Dallas Dubs, Aaron Grattafiori - NVIDIA AI Red Team,\nXBreach.ai, Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nCUPS\nAvailable for: macOS Tahoe\nImpact: An app may be able to gain root privileges\nDescription: An injection issue was addressed with improved validation.\nCVE-2026-43698: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\ncurl\nAvailable for: macOS Tahoe\nImpact: Authentication credentials may be sent to a server on another\norigin\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-3784\nCVE-2026-3783\n\nData Detectors UI\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-43758: HvxyZLF\n\nDesktopServices\nAvailable for: macOS Tahoe\nImpact: An app may bypass Gatekeeper checks\nDescription: A file quarantine bypass was addressed with additional\nchecks.\nCVE-2026-64708: Lance Cain - Offensive Security Engineer, SpecterOps\nInc.\n\nDisk Images\nAvailable for: macOS Tahoe\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-64776: Hyunwoo Kim (@v4bel)\n\nDisk Images\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-64694: Gil Portnoy \u0026 Henry\n\nDisk Images\nAvailable for: macOS Tahoe\nImpact: Parsing a maliciously crafted file may lead to an unexpected app\ntermination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43747: Anthony Laou Hine Tsuei (@anarcheuz)\n\nDisk Images\nAvailable for: macOS Tahoe\nImpact: An app may be able to bypass network restrictions\nDescription: A permissions issue was addressed with additional sandbox\nrestrictions.\nCVE-2026-28945: Ayaan Ahmad\n\nDriverKit\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: An issue existed in the handling of environment variables.\nThis issue was addressed with improved validation.\nCVE-2026-43793: erdene-och Byambabayar\n\nDriverKit\nAvailable for: macOS Tahoe\nImpact: An attacker with physical access to a locked device may be able\nto view sensitive user information\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43753: Niels Hofmans\n\nFoundation\nAvailable for: macOS Tahoe\nImpact: A malicious app may be able to access protected user data\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43714: an anonymous researcher\n\nGame Center\nAvailable for: macOS Tahoe\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\nGame Center\nAvailable for: macOS Tahoe\nImpact: An app may be ab"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:47:08Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/17"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/17"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/downloads/"
},
{
"url": "https://support.apple.com/en-us/128067"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/17"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-07-27-2026-2 macOS Tahoe 26.6",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-23918",
"type": "related"
},
{
"destId": "CVE-2026-28911",
"type": "related"
},
{
"destId": "CVE-2026-28912",
"type": "related"
},
{
"destId": "CVE-2026-28928",
"type": "related"
},
{
"destId": "CVE-2026-28931",
"type": "related"
},
{
"destId": "CVE-2026-28932",
"type": "related"
},
{
"destId": "CVE-2026-28945",
"type": "related"
},
{
"destId": "CVE-2026-28973",
"type": "related"
},
{
"destId": "CVE-2026-28981",
"type": "related"
},
{
"destId": "CVE-2026-28982",
"type": "related"
},
{
"destId": "CVE-2026-3783",
"type": "related"
},
{
"destId": "CVE-2026-3784",
"type": "related"
},
{
"destId": "CVE-2026-39873",
"type": "related"
},
{
"destId": "CVE-2026-39874",
"type": "related"
},
{
"destId": "CVE-2026-39875",
"type": "related"
},
{
"destId": "CVE-2026-43672",
"type": "related"
},
{
"destId": "CVE-2026-43673",
"type": "related"
},
{
"destId": "CVE-2026-43681",
"type": "related"
},
{
"destId": "CVE-2026-43682",
"type": "related"
},
{
"destId": "CVE-2026-43693",
"type": "related"
},
{
"destId": "CVE-2026-43694",
"type": "related"
},
{
"destId": "CVE-2026-43698",
"type": "related"
},
{
"destId": "CVE-2026-43710",
"type": "related"
},
{
"destId": "CVE-2026-43711",
"type": "related"
},
{
"destId": "CVE-2026-43714",
"type": "related"
},
{
"destId": "CVE-2026-43723",
"type": "related"
},
{
"destId": "CVE-2026-43728",
"type": "related"
},
{
"destId": "CVE-2026-43729",
"type": "related"
},
{
"destId": "CVE-2026-43730",
"type": "related"
},
{
"destId": "CVE-2026-43733",
"type": "related"
},
{
"destId": "CVE-2026-43739",
"type": "related"
},
{
"destId": "CVE-2026-43740",
"type": "related"
},
{
"destId": "CVE-2026-43744",
"type": "related"
},
{
"destId": "CVE-2026-43747",
"type": "related"
},
{
"destId": "CVE-2026-43748",
"type": "related"
},
{
"destId": "CVE-2026-43749",
"type": "related"
},
{
"destId": "CVE-2026-43750",
"type": "related"
},
{
"destId": "CVE-2026-43753",
"type": "related"
},
{
"destId": "CVE-2026-43754",
"type": "related"
},
{
"destId": "CVE-2026-43755",
"type": "related"
},
{
"destId": "CVE-2026-43756",
"type": "related"
},
{
"destId": "CVE-2026-43757",
"type": "related"
},
{
"destId": "CVE-2026-43758",
"type": "related"
},
{
"destId": "CVE-2026-43759",
"type": "related"
},
{
"destId": "CVE-2026-43760",
"type": "related"
},
{
"destId": "CVE-2026-43763",
"type": "related"
},
{
"destId": "CVE-2026-43764",
"type": "related"
},
{
"destId": "CVE-2026-43765",
"type": "related"
},
{
"destId": "CVE-2026-43766",
"type": "related"
},
{
"destId": "CVE-2026-43767",
"type": "related"
},
{
"destId": "CVE-2026-43768",
"type": "related"
},
{
"destId": "CVE-2026-43769",
"type": "related"
},
{
"destId": "CVE-2026-43770",
"type": "related"
},
{
"destId": "CVE-2026-43771",
"type": "related"
},
{
"destId": "CVE-2026-43772",
"type": "related"
},
{
"destId": "CVE-2026-43773",
"type": "related"
},
{
"destId": "CVE-2026-43774",
"type": "related"
},
{
"destId": "CVE-2026-43775",
"type": "related"
},
{
"destId": "CVE-2026-43776",
"type": "related"
},
{
"destId": "CVE-2026-43777",
"type": "related"
},
{
"destId": "CVE-2026-43778",
"type": "related"
},
{
"destId": "CVE-2026-43779",
"type": "related"
},
{
"destId": "CVE-2026-43780",
"type": "related"
},
{
"destId": "CVE-2026-43781",
"type": "related"
},
{
"destId": "CVE-2026-43782",
"type": "related"
},
{
"destId": "CVE-2026-43792",
"type": "related"
},
{
"destId": "CVE-2026-43793",
"type": "related"
},
{
"destId": "CVE-2026-43796",
"type": "related"
},
{
"destId": "CVE-2026-43797",
"type": "related"
},
{
"destId": "CVE-2026-43799",
"type": "related"
},
{
"destId": "CVE-2026-43800",
"type": "related"
},
{
"destId": "CVE-2026-43801",
"type": "related"
},
{
"destId": "CVE-2026-43802",
"type": "related"
},
{
"destId": "CVE-2026-43803",
"type": "related"
},
{
"destId": "CVE-2026-43804",
"type": "related"
},
{
"destId": "CVE-2026-43805",
"type": "related"
},
{
"destId": "CVE-2026-43806",
"type": "related"
},
{
"destId": "CVE-2026-43809",
"type": "related"
},
{
"destId": "CVE-2026-43810",
"type": "related"
},
{
"destId": "CVE-2026-43812",
"type": "related"
},
{
"destId": "CVE-2026-43813",
"type": "related"
},
{
"destId": "CVE-2026-43814",
"type": "related"
},
{
"destId": "CVE-2026-43816",
"type": "related"
},
{
"destId": "CVE-2026-43817",
"type": "related"
},
{
"destId": "CVE-2026-43818",
"type": "related"
},
{
"destId": "CVE-2026-43819",
"type": "related"
},
{
"destId": "CVE-2026-43821",
"type": "related"
},
{
"destId": "CVE-2026-43822",
"type": "related"
},
{
"destId": "CVE-2026-4424",
"type": "related"
},
{
"destId": "CVE-2026-64691",
"type": "related"
},
{
"destId": "CVE-2026-64692",
"type": "related"
},
{
"destId": "CVE-2026-64693",
"type": "related"
},
{
"destId": "CVE-2026-64694",
"type": "related"
},
{
"destId": "CVE-2026-64695",
"type": "related"
},
{
"destId": "CVE-2026-64696",
"type": "related"
},
{
"destId": "CVE-2026-64697",
"type": "related"
},
{
"destId": "CVE-2026-64698",
"type": "related"
},
{
"destId": "CVE-2026-64699",
"type": "related"
},
{
"destId": "CVE-2026-64700",
"type": "related"
},
{
"destId": "CVE-2026-64702",
"type": "related"
},
{
"destId": "CVE-2026-64703",
"type": "related"
},
{
"destId": "CVE-2026-64704",
"type": "related"
},
{
"destId": "CVE-2026-64707",
"type": "related"
},
{
"destId": "CVE-2026-64708",
"type": "related"
},
{
"destId": "CVE-2026-64709",
"type": "related"
},
{
"destId": "CVE-2026-64710",
"type": "related"
},
{
"destId": "CVE-2026-64711",
"type": "related"
},
{
"destId": "CVE-2026-64713",
"type": "related"
},
{
"destId": "CVE-2026-64716",
"type": "related"
},
{
"destId": "CVE-2026-64718",
"type": "related"
},
{
"destId": "CVE-2026-64719",
"type": "related"
},
{
"destId": "CVE-2026-64720",
"type": "related"
},
{
"destId": "CVE-2026-64721",
"type": "related"
},
{
"destId": "CVE-2026-64722",
"type": "related"
},
{
"destId": "CVE-2026-64723",
"type": "related"
},
{
"destId": "CVE-2026-64724",
"type": "related"
},
{
"destId": "CVE-2026-64725",
"type": "related"
},
{
"destId": "CVE-2026-64726",
"type": "related"
},
{
"destId": "CVE-2026-64727",
"type": "related"
},
{
"destId": "CVE-2026-64728",
"type": "related"
},
{
"destId": "CVE-2026-64729",
"type": "related"
},
{
"destId": "CVE-2026-64730",
"type": "related"
},
{
"destId": "CVE-2026-64731",
"type": "related"
},
{
"destId": "CVE-2026-64733",
"type": "related"
},
{
"destId": "CVE-2026-64734",
"type": "related"
},
{
"destId": "CVE-2026-64735",
"type": "related"
},
{
"destId": "CVE-2026-64737",
"type": "related"
},
{
"destId": "CVE-2026-64738",
"type": "related"
},
{
"destId": "CVE-2026-64739",
"type": "related"
},
{
"destId": "CVE-2026-64740",
"type": "related"
},
{
"destId": "CVE-2026-64743",
"type": "related"
},
{
"destId": "CVE-2026-64744",
"type": "related"
},
{
"destId": "CVE-2026-64745",
"type": "related"
},
{
"destId": "CVE-2026-64746",
"type": "related"
},
{
"destId": "CVE-2026-64747",
"type": "related"
},
{
"destId": "CVE-2026-64749",
"type": "related"
},
{
"destId": "CVE-2026-64751",
"type": "related"
},
{
"destId": "CVE-2026-64754",
"type": "related"
},
{
"destId": "CVE-2026-64757",
"type": "related"
},
{
"destId": "CVE-2026-64758",
"type": "related"
},
{
"destId": "CVE-2026-64762",
"type": "related"
},
{
"destId": "CVE-2026-64763",
"type": "related"
},
{
"destId": "CVE-2026-64764",
"type": "related"
},
{
"destId": "CVE-2026-64765",
"type": "related"
},
{
"destId": "CVE-2026-64766",
"type": "related"
},
{
"destId": "CVE-2026-64767",
"type": "related"
},
{
"destId": "CVE-2026-64768",
"type": "related"
},
{
"destId": "CVE-2026-64769",
"type": "related"
},
{
"destId": "CVE-2026-64770",
"type": "related"
},
{
"destId": "CVE-2026-64771",
"type": "related"
},
{
"destId": "CVE-2026-64772",
"type": "related"
},
{
"destId": "CVE-2026-64774",
"type": "related"
},
{
"destId": "CVE-2026-64775",
"type": "related"
},
{
"destId": "CVE-2026-64776",
"type": "related"
},
{
"destId": "CVE-2026-64783",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0288",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/17",
"automated": true,
"contentSha256": "b77e3bd23b7d5a05b59a0b0fb5b935fc5cdd5feabeb5315eef61d4ad5269540e",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/17",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-07-28T00:20:15Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0288"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T11:40:46Z",
"dateUpdated": "2026-09-11T11:47:08Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0288"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0040
Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:47
VLAI
EPSS
VEX
Title
APPLE-SA-07-27-2026-2 macOS Tahoe 26.6
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-07-27-2026-2 macOS Tahoe 26.6
macOS Tahoe 26.6 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/128067.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accounts
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: An access issue was addressed with additional sandbox
restrictions.
CVE-2026-43819: Omar Cerrito
Accounts
Available for: macOS Tahoe
Impact: An app may be able to gain root privileges
Description: A parsing issue in the handling of directory paths was
addressed with improved path validation.
CVE-2026-43749: Adam Franke, Ashish Kunwar, Trung Nguyen (@everping) of
CyStack
Accounts Framework
Available for: macOS Tahoe
Impact: An app may be able to fingerprint the user
Description: This issue was addressed with improved data protection.
CVE-2026-64733: Rosyna Keller of Totally Not Malicious Software
(paradisefacade.com)
afpfs
Available for: macOS Tahoe
Impact: A remote attacker may be able to cause unexpected system
termination or corrupt kernel memory
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-64767: Dave G.
apache
Available for: macOS Tahoe
Impact: A remote attacker may be able to cause a denial-of-service
Description: This is a vulnerability in open source code and Apple
Software is among the affected projects. The CVE-ID was assigned by a
third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2026-23918: Юлия Мерцалова
APFS
Available for: macOS Tahoe
Impact: A remote user may be able to cause unexpected system termination
or corrupt kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64695: Peter Malone
App Store
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved checks.
CVE-2026-43801: Rahul Raj
Apple Account
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: A race condition was addressed with improved state
handling.
CVE-2026-43781: Pinak Oza
Apple Account
Available for: macOS Tahoe
Impact: A malicious app may be able to break out of its sandbox
Description: An authorization issue was addressed with improved state
management.
CVE-2026-64737: Robert Mindo
Apple Neural Engine
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43748: an anonymous researcher, tamdao, Franco Belman at
Blackwing Intelligence
Apple Neural Engine
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-28928: Dun
AppleDouble
Available for: macOS Tahoe
Impact: Processing a maliciously crafted file may lead to unexpected app
termination or arbitrary code execution
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-43776: Irvin Wang, Peter Malone, Nicolas Rabrenovic
AppleRAID
Available for: macOS Tahoe
Impact: A local user may be able to read kernel memory
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-43681: impost0r (ret2plt), David Ige - Beryllium Security
Assets
Available for: macOS Tahoe
Impact: A malicious application may be able to bypass Privacy
preferences
Description: An authorization issue was addressed with improved state
management.
CVE-2026-43672: 이재영
ATS
Available for: macOS Tahoe
Impact: An app may be able to read files outside of its sandbox
Description: A permissions issue was addressed by removing the
vulnerable code.
CVE-2026-43763: Pavan Nallamothu, Jared Reyes
Audio
Available for: macOS Tahoe
Impact: An app may be able to break out of its sandbox
Description: An access issue was addressed with additional sandbox
restrictions.
CVE-2026-64702: John Lussier
Audio
Available for: macOS Tahoe
Impact: An app may be able to cause a denial-of-service
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)
AuthKit
Available for: macOS Tahoe
Impact: An app may be able to fingerprint the user
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-43730: David Strnadel
AVEVideoEncoder
Available for: macOS Tahoe
Impact: An app may be able to execute arbitrary code with kernel
privileges
Description: A buffer overflow was addressed with improved size
validation.
CVE-2026-64747: Franco Belman at Blackwing Intelligence
AVEVideoEncoder
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-64762: Dun, Franco Belman at Blackwing Intelligence
BackgroundAssets
Available for: macOS Tahoe
Impact: An app may be able to delete files for which it does not have
permission
Description: A permissions issue was addressed with improved validation.
CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab
cd9660
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination or
read kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64698: an anonymous researcher, Richard Zana, Nathaniel Oh
(@calysteon), Peter Malone
CloudAttestation
Available for: macOS Tahoe
Impact: A maliciously crafted app may be able to bypass code signing
enforcement
Description: A validation issue was addressed with improved input
sanitization.
CVE-2026-43813: Anton Pakhunov
Contacts
Available for: macOS Tahoe
Impact: An app may be able to add contacts without user authorization
Description: An authorization issue was addressed with improved
validation.
CVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel
Febrero
Contacts
Available for: macOS Tahoe
Impact: Processing a maliciously crafted contact may leak sensitive data
Description: The issue was addressed with improved checks.
CVE-2026-64734: Daniel Williams
Contacts
Available for: macOS Tahoe
Impact: An app may be able to access information about a user's contacts
Description: This issue was addressed with improved checks.
CVE-2026-43797: Arni Hardarson (Neonix Security)
Control Center
Available for: macOS Tahoe
Impact: An app may be able to access user-sensitive data
Description: A logic issue was addressed with improved validation.
CVE-2026-43756: 이재영
Core Services
Available for: macOS Tahoe
Impact: An app may be able to gain root privileges
Description: A race condition was addressed with improved state
handling.
CVE-2026-43693: Gergely Kalman (@gergely_kalman)
CoreAudio
Available for: macOS Tahoe
Impact: Processing a maliciously crafted audio file may corrupt process
memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative
CoreAudio
Available for: macOS Tahoe
Impact: Processing an audio stream in a maliciously crafted media file
may terminate the process
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43744: Mathis Mansière, an anonymous researcher
CoreAudio
Available for: macOS Tahoe
Impact: A remote attacker may be able to cause unexpected system
termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43803: Rahul Raj
CoreMedia
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: An authorization issue was addressed with improved state
management.
CVE-2026-43775: Csaba Fitzl (@theevilbit) of Iru
CVE-2026-43759: 이재영, Rajdip Dey Sarkar, Arni Hardarson (Neonix Security)
CoreMedia
Available for: macOS Tahoe
Impact: Processing a maliciously crafted video file may lead to
unexpected app termination
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2026-43711: James Duffy (@0x4A616D657344)
CoreVideo
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43802: an anonymous researcher
Crash Reporter
Available for: macOS Tahoe
Impact: An app may be able to leak sensitive user information
Description: A privacy issue was addressed by removing sensitive data.
CVE-2026-64710: Matthew Schneider
CUPS
Available for: macOS Tahoe
Impact: A malicious app may be able to gain root privileges
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-39875: Dallas Dubs, Aaron Grattafiori - NVIDIA AI Red Team,
XBreach.ai, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
CUPS
Available for: macOS Tahoe
Impact: An app may be able to gain root privileges
Description: An injection issue was addressed with improved validation.
CVE-2026-43698: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
curl
Available for: macOS Tahoe
Impact: Authentication credentials may be sent to a server on another
origin
Description: This is a vulnerability in open source code and Apple
Software is among the affected projects. The CVE-ID was assigned by a
third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2026-3784
CVE-2026-3783
Data Detectors UI
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: An authorization issue was addressed with improved state
management.
CVE-2026-43758: HvxyZLF
DesktopServices
Available for: macOS Tahoe
Impact: An app may bypass Gatekeeper checks
Description: A file quarantine bypass was addressed with additional
checks.
CVE-2026-64708: Lance Cain - Offensive Security Engineer, SpecterOps
Inc.
Disk Images
Available for: macOS Tahoe
Impact: An app may be able to disclose kernel memory
Description: The issue was addressed with improved bounds checks.
CVE-2026-64776: Hyunwoo Kim (@v4bel)
Disk Images
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-64694: Gil Portnoy & Henry
Disk Images
Available for: macOS Tahoe
Impact: Parsing a maliciously crafted file may lead to an unexpected app
termination
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-43747: Anthony Laou Hine Tsuei (@anarcheuz)
Disk Images
Available for: macOS Tahoe
Impact: An app may be able to bypass network restrictions
Description: A permissions issue was addressed with additional sandbox
restrictions.
CVE-2026-28945: Ayaan Ahmad
DriverKit
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: An issue existed in the handling of environment variables.
This issue was addressed with improved validation.
CVE-2026-43793: erdene-och Byambabayar
DriverKit
Available for: macOS Tahoe
Impact: An attacker with physical access to a locked device may be able
to view sensitive user information
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-43753: Niels Hofmans
Foundation
Available for: macOS Tahoe
Impact: A malicious app may be able to access protected user data
Description: The issue was addressed with improved input sanitization.
CVE-2026-43714: an anonymous researcher
Game Center
Available for: macOS Tahoe
Impact: A malicious app may be able to break out of its sandbox
Description: A parsing issue in the handling of directory paths was
addressed with improved path validation.
CVE-2026-64740: Manuel Fernandez (Stackhopper Security)
Game Center
Available for: macOS Tahoe
Impact: An app may be ab
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apple | Macos Tahoe |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "Macos Tahoe",
"vendor": "Apple",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-07-27-2026-2 macOS Tahoe 26.6\n\nmacOS Tahoe 26.6 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/128067.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccounts\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: An access issue was addressed with additional sandbox\nrestrictions.\nCVE-2026-43819: Omar Cerrito\n\nAccounts\nAvailable for: macOS Tahoe\nImpact: An app may be able to gain root privileges\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-43749: Adam Franke, Ashish Kunwar, Trung Nguyen (@everping) of\nCyStack\n\nAccounts Framework\nAvailable for: macOS Tahoe\nImpact: An app may be able to fingerprint the user\nDescription: This issue was addressed with improved data protection.\nCVE-2026-64733: Rosyna Keller of Totally Not Malicious Software\n(paradisefacade.com)\n\nafpfs\nAvailable for: macOS Tahoe\nImpact: A remote attacker may be able to cause unexpected system\ntermination or corrupt kernel memory\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-64767: Dave G.\n\napache\nAvailable for: macOS Tahoe\nImpact: A remote attacker may be able to cause a denial-of-service\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-23918: \u042e\u043b\u0438\u044f \u041c\u0435\u0440\u0446\u0430\u043b\u043e\u0432\u0430\n\nAPFS\nAvailable for: macOS Tahoe\nImpact: A remote user may be able to cause unexpected system termination\nor corrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64695: Peter Malone\n\nApp Store\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved checks.\nCVE-2026-43801: Rahul Raj\n\nApple Account\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-43781: Pinak Oza\n\nApple Account\nAvailable for: macOS Tahoe\nImpact: A malicious app may be able to break out of its sandbox\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-64737: Robert Mindo\n\nApple Neural Engine\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43748: an anonymous researcher, tamdao, Franco Belman at\nBlackwing Intelligence\n\nApple Neural Engine\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28928: Dun\n\nAppleDouble\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination or arbitrary code execution\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-43776: Irvin Wang, Peter Malone, Nicolas Rabrenovic\n\nAppleRAID\nAvailable for: macOS Tahoe\nImpact: A local user may be able to read kernel memory\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-43681: impost0r (ret2plt), David Ige - Beryllium Security\n\nAssets\nAvailable for: macOS Tahoe\nImpact: A malicious application may be able to bypass Privacy\npreferences\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-43672: \uc774\uc7ac\uc601\n\nATS\nAvailable for: macOS Tahoe\nImpact: An app may be able to read files outside of its sandbox\nDescription: A permissions issue was addressed by removing the\nvulnerable code.\nCVE-2026-43763: Pavan Nallamothu, Jared Reyes\n\nAudio\nAvailable for: macOS Tahoe\nImpact: An app may be able to break out of its sandbox\nDescription: An access issue was addressed with additional sandbox\nrestrictions.\nCVE-2026-64702: John Lussier\n\nAudio\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\nAuthKit\nAvailable for: macOS Tahoe\nImpact: An app may be able to fingerprint the user\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-43730: David Strnadel\n\nAVEVideoEncoder\nAvailable for: macOS Tahoe\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges\nDescription: A buffer overflow was addressed with improved size\nvalidation.\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\nAVEVideoEncoder\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64762: Dun, Franco Belman at Blackwing Intelligence\n\nBackgroundAssets\nAvailable for: macOS Tahoe\nImpact: An app may be able to delete files for which it does not have\npermission\nDescription: A permissions issue was addressed with improved validation.\nCVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity\u0027s WeBin lab\n\ncd9660\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination or\nread kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64698: an anonymous researcher, Richard Zana, Nathaniel Oh\n(@calysteon), Peter Malone\n\nCloudAttestation\nAvailable for: macOS Tahoe\nImpact: A maliciously crafted app may be able to bypass code signing\nenforcement\nDescription: A validation issue was addressed with improved input\nsanitization.\nCVE-2026-43813: Anton Pakhunov\n\nContacts\nAvailable for: macOS Tahoe\nImpact: An app may be able to add contacts without user authorization\nDescription: An authorization issue was addressed with improved\nvalidation.\nCVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel\nFebrero\n\nContacts\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted contact may leak sensitive data\nDescription: The issue was addressed with improved checks.\nCVE-2026-64734: Daniel Williams\n\nContacts\nAvailable for: macOS Tahoe\nImpact: An app may be able to access information about a user\u0027s contacts\nDescription: This issue was addressed with improved checks.\nCVE-2026-43797: Arni Hardarson (Neonix Security)\n\nControl Center\nAvailable for: macOS Tahoe\nImpact: An app may be able to access user-sensitive data\nDescription: A logic issue was addressed with improved validation.\nCVE-2026-43756: \uc774\uc7ac\uc601\n\nCore Services\nAvailable for: macOS Tahoe\nImpact: An app may be able to gain root privileges\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-43693: Gergely Kalman (@gergely_kalman)\n\nCoreAudio\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted audio file may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\nCoreAudio\nAvailable for: macOS Tahoe\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43744: Mathis Mansi\u00e8re, an anonymous researcher\n\nCoreAudio\nAvailable for: macOS Tahoe\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43803: Rahul Raj\n\nCoreMedia\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-43775: Csaba Fitzl (@theevilbit) of Iru\nCVE-2026-43759: \uc774\uc7ac\uc601, Rajdip Dey Sarkar, Arni Hardarson (Neonix Security)\n\nCoreMedia\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\nCoreVideo\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43802: an anonymous researcher\n\nCrash Reporter\nAvailable for: macOS Tahoe\nImpact: An app may be able to leak sensitive user information\nDescription: A privacy issue was addressed by removing sensitive data.\nCVE-2026-64710: Matthew Schneider\n\nCUPS\nAvailable for: macOS Tahoe\nImpact: A malicious app may be able to gain root privileges\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-39875: Dallas Dubs, Aaron Grattafiori - NVIDIA AI Red Team,\nXBreach.ai, Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nCUPS\nAvailable for: macOS Tahoe\nImpact: An app may be able to gain root privileges\nDescription: An injection issue was addressed with improved validation.\nCVE-2026-43698: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\ncurl\nAvailable for: macOS Tahoe\nImpact: Authentication credentials may be sent to a server on another\norigin\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-3784\nCVE-2026-3783\n\nData Detectors UI\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-43758: HvxyZLF\n\nDesktopServices\nAvailable for: macOS Tahoe\nImpact: An app may bypass Gatekeeper checks\nDescription: A file quarantine bypass was addressed with additional\nchecks.\nCVE-2026-64708: Lance Cain - Offensive Security Engineer, SpecterOps\nInc.\n\nDisk Images\nAvailable for: macOS Tahoe\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-64776: Hyunwoo Kim (@v4bel)\n\nDisk Images\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-64694: Gil Portnoy \u0026 Henry\n\nDisk Images\nAvailable for: macOS Tahoe\nImpact: Parsing a maliciously crafted file may lead to an unexpected app\ntermination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43747: Anthony Laou Hine Tsuei (@anarcheuz)\n\nDisk Images\nAvailable for: macOS Tahoe\nImpact: An app may be able to bypass network restrictions\nDescription: A permissions issue was addressed with additional sandbox\nrestrictions.\nCVE-2026-28945: Ayaan Ahmad\n\nDriverKit\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: An issue existed in the handling of environment variables.\nThis issue was addressed with improved validation.\nCVE-2026-43793: erdene-och Byambabayar\n\nDriverKit\nAvailable for: macOS Tahoe\nImpact: An attacker with physical access to a locked device may be able\nto view sensitive user information\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43753: Niels Hofmans\n\nFoundation\nAvailable for: macOS Tahoe\nImpact: A malicious app may be able to access protected user data\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43714: an anonymous researcher\n\nGame Center\nAvailable for: macOS Tahoe\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\nGame Center\nAvailable for: macOS Tahoe\nImpact: An app may be ab"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:47:08Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/17"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/17"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/downloads/"
},
{
"url": "https://support.apple.com/en-us/128067"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/17"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-07-27-2026-2 macOS Tahoe 26.6",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0040",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/17",
"automated": true,
"contentSha256": "b77e3bd23b7d5a05b59a0b0fb5b935fc5cdd5feabeb5315eef61d4ad5269540e",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/17",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-07-28T00:20:15Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:21Z",
"dateUpdated": "2026-09-11T11:47:08Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0040"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0280
Vulnerability from gna-1988 – Published: 2026-09-08 11:24 – Updated: 2026-09-11 11:37
VLAI
EPSS
VEX
Title
Cisco Catalyst SD-WAN C8000V Authenticated Heap Buffer Overflow
Summary
SUMMARY: an authenticated heap buffer overflow in cisco catalyst
c8000v sd-wan allows an attacker with low privileges to corrupt
process memory and achieve remote code execution by sending a crafted
message of type 0x0d (13) with device mode 5.
this was tested on 17.06.03 as it is the only image i had access to.
https://bst.cisco.com/quickview/bug/CSCwu48719
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-L4XfJg8S
===================== the vuln =====================
the core vuln is in vdaemon. vdaemon is the core control plane binary
used by catalyst to orchestrate stuff like secure tunneling and
joining new devices when they first are introduced to the sd-wan. thus
(again) its a juicy target to get initial access on.
the core vuln is at sub_2A4D0:
lea rdi, [r12+0F34h] ; peer struct
mov rbx, [rbp+src]
lea r15, [rbx+20h]
lea rsi, [rbx+24h]
mov edx, [rbx+20h]
call _memcpy
mov byte ptr [r14+rax+0F34h], 0 ; null term
the pseudocode, essenetially, is:
memcpy(&peer->f34h, msg->dat, msg->len);
peer->f34h[msg->len] = 0;
i assume you can see the major issue in here lol. we control the
length and src since we control the message. we get a heap buffer
overflow. in this case, we get two overflows:
; second overflow
lea rdi, [r12+0F86h]
lea rsi, [rbx+100h]
mov edx, [rbx+164h]
call _memcpy
mov byte ptr [r14+rax+0F86h], 0
this time to 0xf86 in peer.
peer is allocated in sub_21B20 once you xref it:
peer = (unsigned int *)((__int64 (__fastcall *)(__int64))g_mem)(0x1298);
so the peer struct is 4760 bytes large.
the peer struct looks like:
struct peer {
void *list_next;
void *list_prev;
uint8_t pad_10[16];
uint32_t peer_state;
uint32_t field_24;
uint8_t pad_28[14];
uint8_t flag_36;
uint8_t pad_37[101];
uint32_t msg_counter;
uint8_t pad_A0[232];
uint8_t addr_info[16];
uint8_t pad_198[161];
uint8_t tlv_block[128];
uint8_t pad_2B9[167];
uint8_t addr_data[56];
uint8_t field_398[24];
uint8_t pad_3B0[256];
void *conn_ptr;
struct timespec last_seen;
uint8_t pad_4C8[2668];
uint8_t vuln_buf_1[82]; // where we hit
uint8_t vuln_buf_2[106]; // where we hit again
uint8_t field_FF0[8];
char str_FF8[58];
uint8_t field_1032;
uint8_t pad_1033[12];
uint8_t field_103F;
uint8_t flag_1040;
uint8_t pad_1041[3];
uint32_t field_1044;
uint32_t field_1048;
uint8_t pad_104C[28];
void (*bev_ssl)(...); // funcptr HIT THIS HIT THIS
uint8_t pad_1070[48];
uint8_t field_10A0[128];
uint8_t field_1120[128];
char name1[41];
char name2[41];
uint8_t pad_11F2[14];
void *sub_obj;
uint8_t field_1208[144];
};
ideally, we could probably overflow the buffers to hit the function
ptr; put a stack pivot gadget then start ropping in the heap. later
versions of c8000v have pie + aslr obviously, so that would make
exploitation significantly harder but not impossible.
unforutnately the requirements to reach this heap bof mean that it
isnt preauth rce. youd still need a valid cert; but you could send a
message of type 13 (0x0D), or a REGISTER_TO_VMANAGE type, make the
device mode 5 (vManage device mode), then include your payload to hit
the sink.
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cisco | Catalyst SD-WAN |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0280 (this record)
- possibly related CVE-2022-20775
{
"containers": {
"cna": {
"affected": [
{
"product": "Catalyst SD-WAN",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "evan"
}
],
"descriptions": [
{
"lang": "en",
"value": "SUMMARY: an authenticated heap buffer overflow in cisco catalyst\nc8000v sd-wan allows an attacker with low privileges to corrupt\nprocess memory and achieve remote code execution by sending a crafted\nmessage of type 0x0d (13) with device mode 5.\nthis was tested on 17.06.03 as it is the only image i had access to.\n\nhttps://bst.cisco.com/quickview/bug/CSCwu48719\n\nhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-L4XfJg8S\n\n===================== the vuln =====================\n\nthe core vuln is in vdaemon. vdaemon is the core control plane binary\nused by catalyst to orchestrate stuff like secure tunneling and\njoining new devices when they first are introduced to the sd-wan. thus\n(again) its a juicy target to get initial access on.\n\nthe core vuln is at sub_2A4D0:\n\nlea rdi, [r12+0F34h] ; peer struct\nmov rbx, [rbp+src]\nlea r15, [rbx+20h]\nlea rsi, [rbx+24h]\nmov edx, [rbx+20h]\ncall _memcpy\nmov byte ptr [r14+rax+0F34h], 0 ; null term\n\n\nthe pseudocode, essenetially, is:\n\nmemcpy(\u0026peer-\u003ef34h, msg-\u003edat, msg-\u003elen);\npeer-\u003ef34h[msg-\u003elen] = 0;\n\ni assume you can see the major issue in here lol. we control the\nlength and src since we control the message. we get a heap buffer\noverflow. in this case, we get two overflows:\n\n; second overflow\nlea rdi, [r12+0F86h]\nlea rsi, [rbx+100h]\nmov edx, [rbx+164h]\ncall _memcpy\nmov byte ptr [r14+rax+0F86h], 0\n\nthis time to 0xf86 in peer.\n\npeer is allocated in sub_21B20 once you xref it:\n\n peer = (unsigned int *)((__int64 (__fastcall *)(__int64))g_mem)(0x1298);\n\nso the peer struct is 4760 bytes large.\n\nthe peer struct looks like:\n\nstruct peer {\n void *list_next;\n void *list_prev;\n uint8_t pad_10[16];\n uint32_t peer_state;\n uint32_t field_24;\n uint8_t pad_28[14];\n uint8_t flag_36;\n uint8_t pad_37[101];\n uint32_t msg_counter;\n uint8_t pad_A0[232];\n uint8_t addr_info[16];\n uint8_t pad_198[161];\n uint8_t tlv_block[128];\n uint8_t pad_2B9[167];\n uint8_t addr_data[56];\n uint8_t field_398[24];\n uint8_t pad_3B0[256];\n void *conn_ptr;\n struct timespec last_seen;\n uint8_t pad_4C8[2668];\n uint8_t vuln_buf_1[82]; // where we hit\n uint8_t vuln_buf_2[106]; // where we hit again\n uint8_t field_FF0[8];\n char str_FF8[58];\n uint8_t field_1032;\n uint8_t pad_1033[12];\n uint8_t field_103F;\n uint8_t flag_1040;\n uint8_t pad_1041[3];\n uint32_t field_1044;\n uint32_t field_1048;\n uint8_t pad_104C[28];\n void (*bev_ssl)(...); // funcptr HIT THIS HIT THIS\n uint8_t pad_1070[48];\n uint8_t field_10A0[128];\n uint8_t field_1120[128];\n char name1[41];\n char name2[41];\n uint8_t pad_11F2[14];\n void *sub_obj;\n uint8_t field_1208[144];\n};\n\nideally, we could probably overflow the buffers to hit the function\nptr; put a stack pivot gadget then start ropping in the heap. later\nversions of c8000v have pie + aslr obviously, so that would make\nexploitation significantly harder but not impossible.\n\nunforutnately the requirements to reach this heap bof mean that it\nisnt preauth rce. youd still need a valid cert; but you could send a\nmessage of type 13 (0x0D), or a REGISTER_TO_VMANAGE type, make the\ndevice mode 5 (vManage device mode), then include your payload to hit\nthe sink.\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:37:29Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/15"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/15"
},
{
"url": "https://bst.cisco.com/quickview/bug/CSCwu48719"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-L4XfJg8S"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/15"
],
"discovery": "EXTERNAL"
},
"title": "Cisco Catalyst SD-WAN C8000V Authenticated Heap Buffer Overflow",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2022-20775",
"type": "possibly_related"
}
],
"vulnId": "GCVE-1988-2026-0280",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/15",
"automated": true,
"contentSha256": "e5d5de9ca8d757d30bf04212990ac358c4d7b81fddaf34f8dc4596c3adf41025",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/15",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-06T14:08:27Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0280"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T11:24:56Z",
"dateUpdated": "2026-09-11T11:37:29Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0280"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0028
Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:37
VLAI
EPSS
VEX
Title
Cisco Catalyst SD-WAN C8000V Authenticated Heap Buffer Overflow
Summary
SUMMARY: an authenticated heap buffer overflow in cisco catalyst
c8000v sd-wan allows an attacker with low privileges to corrupt
process memory and achieve remote code execution by sending a crafted
message of type 0x0d (13) with device mode 5.
this was tested on 17.06.03 as it is the only image i had access to.
https://bst.cisco.com/quickview/bug/CSCwu48719
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-L4XfJg8S
===================== the vuln =====================
the core vuln is in vdaemon. vdaemon is the core control plane binary
used by catalyst to orchestrate stuff like secure tunneling and
joining new devices when they first are introduced to the sd-wan. thus
(again) its a juicy target to get initial access on.
the core vuln is at sub_2A4D0:
lea rdi, [r12+0F34h] ; peer struct
mov rbx, [rbp+src]
lea r15, [rbx+20h]
lea rsi, [rbx+24h]
mov edx, [rbx+20h]
call _memcpy
mov byte ptr [r14+rax+0F34h], 0 ; null term
the pseudocode, essenetially, is:
memcpy(&peer->f34h, msg->dat, msg->len);
peer->f34h[msg->len] = 0;
i assume you can see the major issue in here lol. we control the
length and src since we control the message. we get a heap buffer
overflow. in this case, we get two overflows:
; second overflow
lea rdi, [r12+0F86h]
lea rsi, [rbx+100h]
mov edx, [rbx+164h]
call _memcpy
mov byte ptr [r14+rax+0F86h], 0
this time to 0xf86 in peer.
peer is allocated in sub_21B20 once you xref it:
peer = (unsigned int *)((__int64 (__fastcall *)(__int64))g_mem)(0x1298);
so the peer struct is 4760 bytes large.
the peer struct looks like:
struct peer {
void *list_next;
void *list_prev;
uint8_t pad_10[16];
uint32_t peer_state;
uint32_t field_24;
uint8_t pad_28[14];
uint8_t flag_36;
uint8_t pad_37[101];
uint32_t msg_counter;
uint8_t pad_A0[232];
uint8_t addr_info[16];
uint8_t pad_198[161];
uint8_t tlv_block[128];
uint8_t pad_2B9[167];
uint8_t addr_data[56];
uint8_t field_398[24];
uint8_t pad_3B0[256];
void *conn_ptr;
struct timespec last_seen;
uint8_t pad_4C8[2668];
uint8_t vuln_buf_1[82]; // where we hit
uint8_t vuln_buf_2[106]; // where we hit again
uint8_t field_FF0[8];
char str_FF8[58];
uint8_t field_1032;
uint8_t pad_1033[12];
uint8_t field_103F;
uint8_t flag_1040;
uint8_t pad_1041[3];
uint32_t field_1044;
uint32_t field_1048;
uint8_t pad_104C[28];
void (*bev_ssl)(...); // funcptr HIT THIS HIT THIS
uint8_t pad_1070[48];
uint8_t field_10A0[128];
uint8_t field_1120[128];
char name1[41];
char name2[41];
uint8_t pad_11F2[14];
void *sub_obj;
uint8_t field_1208[144];
};
ideally, we could probably overflow the buffers to hit the function
ptr; put a stack pivot gadget then start ropping in the heap. later
versions of c8000v have pie + aslr obviously, so that would make
exploitation significantly harder but not impossible.
unforutnately the requirements to reach this heap bof mean that it
isnt preauth rce. youd still need a valid cert; but you could send a
message of type 13 (0x0D), or a REGISTER_TO_VMANAGE type, make the
device mode 5 (vManage device mode), then include your payload to hit
the sink.
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cisco | Catalyst SD-WAN |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "Catalyst SD-WAN",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "evan"
}
],
"descriptions": [
{
"lang": "en",
"value": "SUMMARY: an authenticated heap buffer overflow in cisco catalyst\nc8000v sd-wan allows an attacker with low privileges to corrupt\nprocess memory and achieve remote code execution by sending a crafted\nmessage of type 0x0d (13) with device mode 5.\nthis was tested on 17.06.03 as it is the only image i had access to.\n\nhttps://bst.cisco.com/quickview/bug/CSCwu48719\n\nhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-L4XfJg8S\n\n===================== the vuln =====================\n\nthe core vuln is in vdaemon. vdaemon is the core control plane binary\nused by catalyst to orchestrate stuff like secure tunneling and\njoining new devices when they first are introduced to the sd-wan. thus\n(again) its a juicy target to get initial access on.\n\nthe core vuln is at sub_2A4D0:\n\nlea rdi, [r12+0F34h] ; peer struct\nmov rbx, [rbp+src]\nlea r15, [rbx+20h]\nlea rsi, [rbx+24h]\nmov edx, [rbx+20h]\ncall _memcpy\nmov byte ptr [r14+rax+0F34h], 0 ; null term\n\n\nthe pseudocode, essenetially, is:\n\nmemcpy(\u0026peer-\u003ef34h, msg-\u003edat, msg-\u003elen);\npeer-\u003ef34h[msg-\u003elen] = 0;\n\ni assume you can see the major issue in here lol. we control the\nlength and src since we control the message. we get a heap buffer\noverflow. in this case, we get two overflows:\n\n; second overflow\nlea rdi, [r12+0F86h]\nlea rsi, [rbx+100h]\nmov edx, [rbx+164h]\ncall _memcpy\nmov byte ptr [r14+rax+0F86h], 0\n\nthis time to 0xf86 in peer.\n\npeer is allocated in sub_21B20 once you xref it:\n\n peer = (unsigned int *)((__int64 (__fastcall *)(__int64))g_mem)(0x1298);\n\nso the peer struct is 4760 bytes large.\n\nthe peer struct looks like:\n\nstruct peer {\n void *list_next;\n void *list_prev;\n uint8_t pad_10[16];\n uint32_t peer_state;\n uint32_t field_24;\n uint8_t pad_28[14];\n uint8_t flag_36;\n uint8_t pad_37[101];\n uint32_t msg_counter;\n uint8_t pad_A0[232];\n uint8_t addr_info[16];\n uint8_t pad_198[161];\n uint8_t tlv_block[128];\n uint8_t pad_2B9[167];\n uint8_t addr_data[56];\n uint8_t field_398[24];\n uint8_t pad_3B0[256];\n void *conn_ptr;\n struct timespec last_seen;\n uint8_t pad_4C8[2668];\n uint8_t vuln_buf_1[82]; // where we hit\n uint8_t vuln_buf_2[106]; // where we hit again\n uint8_t field_FF0[8];\n char str_FF8[58];\n uint8_t field_1032;\n uint8_t pad_1033[12];\n uint8_t field_103F;\n uint8_t flag_1040;\n uint8_t pad_1041[3];\n uint32_t field_1044;\n uint32_t field_1048;\n uint8_t pad_104C[28];\n void (*bev_ssl)(...); // funcptr HIT THIS HIT THIS\n uint8_t pad_1070[48];\n uint8_t field_10A0[128];\n uint8_t field_1120[128];\n char name1[41];\n char name2[41];\n uint8_t pad_11F2[14];\n void *sub_obj;\n uint8_t field_1208[144];\n};\n\nideally, we could probably overflow the buffers to hit the function\nptr; put a stack pivot gadget then start ropping in the heap. later\nversions of c8000v have pie + aslr obviously, so that would make\nexploitation significantly harder but not impossible.\n\nunforutnately the requirements to reach this heap bof mean that it\nisnt preauth rce. youd still need a valid cert; but you could send a\nmessage of type 13 (0x0D), or a REGISTER_TO_VMANAGE type, make the\ndevice mode 5 (vManage device mode), then include your payload to hit\nthe sink.\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:37:29Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/15"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/15"
},
{
"url": "https://bst.cisco.com/quickview/bug/CSCwu48719"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-L4XfJg8S"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/15"
],
"discovery": "EXTERNAL"
},
"title": "Cisco Catalyst SD-WAN C8000V Authenticated Heap Buffer Overflow",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0028",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/15",
"automated": true,
"contentSha256": "e5d5de9ca8d757d30bf04212990ac358c4d7b81fddaf34f8dc4596c3adf41025",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/15",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-06T14:08:27Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:20Z",
"dateUpdated": "2026-09-11T11:37:29Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0028"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
displaying 71 - 80 publications in total 387