Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "APPLE-SA-02-11-2026-5 macOS Sonoma",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-02-11-2026-5 macOS Sonoma 14.8.4\n\nmacOS Sonoma 14.8.4 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/126350.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAppleMobileFileIntegrity\nAvailable for: macOS Sonoma\nImpact: An app may be able to access sensitive user data\nDescription: An injection issue was addressed with improved validation.\nCVE-2026-20624: Mickey Jin (@patch1t)\n\nAppleMobileFileIntegrity\nAvailable for: macOS Sonoma\nImpact: An app may be able to access sensitive user data\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-20625: Mickey Jin (@patch1t), Ryan Dowd (@_rdowd)\n\nCFNetwork\nAvailable for: macOS Sonoma\nImpact: A remote user may be able to write arbitrary files\nDescription: A path handling issue was addressed with improved logic.\nCVE-2026-20660: Amy (amys.website)\n\nCompression\nAvailable for: macOS Sonoma\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2025-43403: Mickey Jin (@patch1t)\n\nCoreAudio\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted media file may lead to\nunexpected app termination or corrupt process memory\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-20611: Anonymous working with Trend Micro Zero Day Initiative\n\nCoreMedia\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted file may lead to a denial-of-\nservice or potentially disclose memory contents\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-20609: Yi\u011fit Can YILMAZ (@yilmazcanyigit)\n\nCoreServices\nAvailable for: macOS Sonoma\nImpact: An app may be able to gain root privileges\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-20617: Gergely Kalman (@gergely_kalman), Csaba Fitzl\n(@theevilbit) of Iru\n\nCoreServices\nAvailable for: macOS Sonoma\nImpact: An app may be able to gain root privileges\nDescription: A path handling issue was addressed with improved\nvalidation.\nCVE-2026-20615: Csaba Fitzl (@theevilbit) of Iru and Gergely Kalman\n(@gergely_kalman)\n\nCoreServices\nAvailable for: macOS Sonoma\nImpact: An app may be able to access sensitive user data\nDescription: A logic issue was addressed with improved validation.\nCVE-2025-46283: an anonymous researcher\n\nCoreServices\nAvailable for: macOS Sonoma\nImpact: An app may be able to access sensitive user data\nDescription: An issue existed in the handling of environment variables.\nThis issue was addressed with improved validation.\nCVE-2026-20627: an anonymous researcher\n\nFile Bookmark\nAvailable for: macOS Sonoma\nImpact: An app may be able to access user-sensitive data\nDescription: A path handling issue was addressed with improved logic.\nCVE-2025-43417: Ron Elemans\n\nGPU Drivers\nAvailable for: macOS Sonoma\nImpact: An attacker may be able to cause unexpected system termination\nor read kernel memory\nDescription: An out-of-bounds read issue was addressed with improved\ninput validation.\nCVE-2026-20620: Murray Mike\n\nImageIO\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted media file may lead to\nunexpected app termination or corrupt process memory\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2025-43338: \uc774\ub3d9\ud558 (Lee Dong Ha) of SSA Lab\n\nImageIO\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted image may result in disclosure\nof process memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-20634: George Karchemsky (@gkarchemsky) working with Trend\nMicro Zero Day Initiative\n\nImageIO\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted image may lead to disclosure of\nuser information\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-20675: George Karchemsky (@gkarchemsky) working with Trend\nMicro Zero Day Initiative\n\nKernel\nAvailable for: macOS Sonoma\nImpact: An attacker in a privileged network position may be able to\nintercept network traffic\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-20671: Xin\u0027an Zhou, Juefei Pu, Zhutian Liu, Zhiyun Qian,\nZhaowei Tan, Srikanth V. Krishnamurthy, Mathy Vanhoef\n\nlibexpat\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted file may lead to a denial-of-\nservice\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2025-59375\n\nlibnetcore\nAvailable for: macOS Sonoma\nImpact: An attacker in a privileged network position may be able to\nintercept network traffic\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-20671: Xin\u0027an Zhou, Juefei Pu, Zhutian Liu, Zhiyun Qian,\nZhaowei Tan, Srikanth V. Krishnamurthy, Mathy Vanhoef\n\nlibxpc\nAvailable for: macOS Sonoma\nImpact: An app may be able to break out of its sandbox\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-20667: an anonymous researcher\n\nMail\nAvailable for: macOS Sonoma\nImpact: Turning off \"Load remote content in messages\u201d may not apply to\nall mail previews\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-20673: an anonymous researcher\n\nMessages\nAvailable for: macOS Sonoma\nImpact: A shortcut may be able to bypass sandbox restrictions\nDescription: A race condition was addressed with improved handling of\nsymbolic links.\nCVE-2026-20677: Ron Masas of BreakPoint.SH\n\nModel I/O\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted USD file may lead to unexpected\napp termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-20616: Michael DePlante (@izobashi) of Trend Micro Zero Day\nInitiative\n\nMulti-Touch\nAvailable for: macOS Sonoma\nImpact: A malicious HID device may cause an unexpected process crash\nDescription: The issue was addressed with improved bounds checks.\nCVE-2025-43533: Google Threat Analysis Group\nCVE-2025-46300: Google Threat Analysis Group\nCVE-2025-46301: Google Threat Analysis Group\nCVE-2025-46302: Google Threat Analysis Group\nCVE-2025-46303: Google Threat Analysis Group\nCVE-2025-46304: Google Threat Analysis Group\nCVE-2025-46305: Google Threat Analysis Group\n\nPackageKit\nAvailable for: macOS Sonoma\nImpact: An attacker with root privileges may be able to delete protected\nsystem files\nDescription: This issue was addressed through improved state management.\nCVE-2025-46310: Mickey Jin (@patch1t)\n\nRemote Management\nAvailable for: macOS Sonoma\nImpact: An app may be able to gain root privileges\nDescription: A path handling issue was addressed with improved\nvalidation.\nCVE-2026-20614: Gergely Kalman (@gergely_kalman)\n\nSandbox\nAvailable for: macOS Sonoma\nImpact: An app may be able to break out of its sandbox\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-20628: Noah Gregory (wts.dev)\n\nSecurity\nAvailable for: macOS Sonoma\nImpact: A remote attacker may be able to cause a denial-of-service\nDescription: A logic issue was addressed with improved checks.\nCVE-2025-46290: Bing Shi, Wenchao Li and Xiaolong Bai of Alibaba Group,\nand Luyi Xing of Indiana University Bloomington\n\nShortcuts\nAvailable for: macOS Sonoma\nImpact: An app may be able to access sensitive user data\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-20653: Enis Maholli (enismaholli.com)\n\nSpotlight\nAvailable for: macOS Sonoma\nImpact: A sandboxed app may be able to access sensitive user data\nDescription: The issue was addressed with additional restrictions on the\nobservability of app states.\nCVE-2026-20680: an anonymous researcher\n\nSpotlight\nAvailable for: macOS Sonoma\nImpact: An app may be able to access sensitive user data\nDescription: A privacy issue was addressed with improved checks.\nCVE-2026-20612: Mickey Jin (@patch1t)\n\nStoreKit\nAvailable for: macOS Sonoma\nImpact: An app may be able to identify what other apps a user has\ninstalled\nDescription: A privacy issue was addressed with improved checks.\nCVE-2026-20641: Gongyu Ma (@Mezone0)\n\nUIKit\nAvailable for: macOS Sonoma\nImpact: An app may be able to bypass certain Privacy preferences\nDescription: This issue was addressed by removing the vulnerable code.\nCVE-2026-20606: LeminLimez\n\nVoice Control\nAvailable for: macOS Sonoma\nImpact: An app may be able to crash a system process\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-20605: @cloudlldb of @pixiepointsec\n\nWi-Fi\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-20621: Wang Yu of Cyberserval\n\nWindowServer\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause unexpected system termination or\ncorrupt process memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2025-43402: @cloudlldb of @pixiepointsec\n\nWindowServer\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause a denial-of-service\nDescription: The issue was addressed with improved handling of caches.\nCVE-2026-20602: @cloudlldb of @pixiepointsec\n\nAdditional recognition\n\nCoreServices\nWe would like to acknowledge Golden Helm Securities, YingQi Shi\n(@Mas0nShi) of DBAppSecurity\u0027s WeBin lab, Csaba Fitzl (@theevilbit) of\nIru and Gergely Kalman (@gergely_kalman) for their assistance.\n\nKernel\nWe would like to acknowledge Xinru Chi of Pangu Lab for their\nassistance.\n\nlibpthread\nWe would like to acknowledge Fabiano Anemone for their assistance.\n\nWindowServer\nWe would like to acknowledge @cloudlldb of @pixiepointsec for their\nassistance.\n\nmacOS Sonoma 14.8.4 may be obtained from the Mac App Store or\nApple\u0027s Software Downloads web site:\nhttps://support.apple.com/downloads/\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmmNDuMACgkQ4Ifiq8DH\n7PUmMxAAq8it0sd0gK1w9S2xoe38FkzhkMJuHadqwCu330uZde5QELWM5FyMxzjD\nXQIScVmW3bUoliku+JMOlTzbt1E8fOAId1BDtanLYBlCCvLf42s8Atl3yeqSn5nb\nXl2WkYp9krNHTLT2okP3e5wKV26WKaEKyzNDjf/3zgPcPO23O/RXtALB69eKUH1i\ncjFk5yBRQQLG6eNq89nkJS3xheGhnRhotI5RVg+xWDXIEMDz+ohiu9BqGZtBPelZ\n28fUO1ifND/3Vx8GmMJYKQtJYCrsEHup4VlPEGtw36tj9wUsFtBA3vf9gtYLqrCR\nHlVjpatTuoXYmhfcVMrtKEKf+VYzP163PM0kUmpJw8cOT+RAdPUaKBsozRIZSjDJ\nrIjxuea87IdvCF7v7NRi6fjLh9kfuYKZnoPTlZHytbenYFXqpyccvIIfgv43AJTG\n9phCTDSx0PFSIVwHbN5EpDEHhNw77k+dFlk47GcUUDPdakGS+QR9aZ9L1sQri8E/\nB14npkcwBq4b7gg57SK6+XvMiSXNHKTIMLsG7twTt6/7TKcS6NWgR3pbPxtjLOOB\nEJVipxm5iMzW9iHXsyhAayE/suUbJp8HYDCx3XoROPdq+qs9uaMS9qTxyupJ5U8H\nlftrbN0qKdNA0lpRx6F9Jo6sAZP1d940aSD/LnDLMF9vhOcxR6Q=\n=HT2I\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:07:43Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/25"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/25"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/126350"
        },
        {
          "url": "https://support.apple.com/downloads/"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/25"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-02-11-2026-5 macOS Sonoma 14.8.4",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-43338",
              "type": "related"
            },
            {
              "destId": "CVE-2025-43402",
              "type": "related"
            },
            {
              "destId": "CVE-2025-43403",
              "type": "related"
            },
            {
              "destId": "CVE-2025-43417",
              "type": "related"
            },
            {
              "destId": "CVE-2025-43533",
              "type": "related"
            },
            {
              "destId": "CVE-2025-46283",
              "type": "related"
            },
            {
              "destId": "CVE-2025-46290",
              "type": "related"
            },
            {
              "destId": "CVE-2025-46300",
              "type": "related"
            },
            {
              "destId": "CVE-2025-46301",
              "type": "related"
            },
            {
              "destId": "CVE-2025-46302",
              "type": "related"
            },
            {
              "destId": "CVE-2025-46303",
              "type": "related"
            },
            {
              "destId": "CVE-2025-46304",
              "type": "related"
            },
            {
              "destId": "CVE-2025-46305",
              "type": "related"
            },
            {
              "destId": "CVE-2025-46310",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59375",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20602",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20605",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20606",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20609",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20611",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20612",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20614",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20615",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20616",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20617",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20620",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20621",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20624",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20625",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20627",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20628",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20634",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20641",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20653",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20660",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20667",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20671",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20673",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20675",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20677",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20680",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0220",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/25",
            "automated": true,
            "contentSha256": "79e2a5781a7939fdaa4084081e401a3637424868d9ae5bd55a8ae15638907e8b",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/25",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-12T00:04:38Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0220"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:43Z",
    "dateUpdated": "2026-09-09T10:07:43Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0220"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}