GCVE-1988-2026-0218

Vulnerability from gna-1988 – Published: 2026-09-08 07:57 – Updated: 2026-09-11 11:11
VLAI
Title
APPLE-SA-02-11-2026-3 macOS Tahoe 26.3
Summary
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-02-11-2026-3 macOS Tahoe 26.3 macOS Tahoe 26.3 addresses the following issues. Information about the security content is also available at https://support.apple.com/126348. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Admin Framework Available for: macOS Tahoe Impact: An app may be able to access sensitive user data Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-20669: Mickey Jin (@patch1t) AppleMobileFileIntegrity Available for: macOS Tahoe Impact: An app may be able to access sensitive user data Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-20625: Mickey Jin (@patch1t), Ryan Dowd (@_rdowd) AppleMobileFileIntegrity Available for: macOS Tahoe Impact: An app may be able to access sensitive user data Description: An injection issue was addressed with improved validation. CVE-2026-20624: Mickey Jin (@patch1t) Bluetooth Available for: macOS Tahoe Impact: An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Bluetooth packets Description: A denial-of-service issue was addressed with improved validation. CVE-2026-20650: jioundai CFNetwork Available for: macOS Tahoe Impact: A remote user may be able to write arbitrary files Description: A path handling issue was addressed with improved logic. CVE-2026-20660: Amy (amys.website) Contacts Available for: macOS Tahoe Impact: An app may be able to access information about a user's contacts Description: A privacy issue was addressed with improved private data redaction for log entries. CVE-2026-20681: Kirin (@Pwnrin) and LFY (@secsys) from Fudan University CoreAudio Available for: macOS Tahoe Impact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory Description: An out-of-bounds access issue was addressed with improved bounds checking. CVE-2026-20611: Anonymous working with Trend Micro Zero Day Initiative CoreMedia Available for: macOS Tahoe Impact: Processing a maliciously crafted file may lead to a denial-of- service or potentially disclose memory contents Description: The issue was addressed with improved memory handling. CVE-2026-20609: Yiğit Can YILMAZ (@yilmazcanyigit) CoreServices Available for: macOS Tahoe Impact: An app may be able to gain root privileges Description: A race condition was addressed with improved state handling. CVE-2026-20617: Gergely Kalman (@gergely_kalman), Csaba Fitzl (@theevilbit) of Iru CoreServices Available for: macOS Tahoe Impact: An app may be able to gain root privileges Description: A path handling issue was addressed with improved validation. CVE-2026-20615: Csaba Fitzl (@theevilbit) of Iru and Gergely Kalman (@gergely_kalman) CoreServices Available for: macOS Tahoe Impact: An app may be able to access sensitive user data Description: An issue existed in the handling of environment variables. This issue was addressed with improved validation. CVE-2026-20627: an anonymous researcher dyld Available for: macOS Tahoe Impact: An attacker with memory write capability may be able to execute arbitrary code. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 and CVE-2025-43529 were also issued in response to this report. Description: A memory corruption issue was addressed with improved state management. CVE-2026-20700: Google Threat Analysis Group Foundation Available for: macOS Tahoe Impact: An app may be able to access user-sensitive data Description: A privacy issue was addressed with improved handling of temporary files. CVE-2026-20629: Asaf Cohen Foundation Available for: macOS Tahoe Impact: An app may be able to monitor keystrokes without user permission Description: A permissions issue was addressed with additional restrictions. CVE-2026-20601: an anonymous researcher Foundation Available for: macOS Tahoe Impact: An app may be able to access protected user data Description: A permissions issue was addressed by removing the vulnerable code. CVE-2026-20623: an anonymous researcher Game Center Available for: macOS Tahoe Impact: A user may be able to view sensitive user information Description: A logging issue was addressed with improved data redaction. CVE-2026-20649: Asaf Cohen GPU Drivers Available for: macOS Tahoe Impact: An attacker may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read issue was addressed with improved input validation. CVE-2026-20620: Murray Mike ImageIO Available for: macOS Tahoe Impact: Processing a maliciously crafted image may lead to disclosure of user information Description: The issue was addressed with improved bounds checks. CVE-2026-20675: George Karchemsky (@gkarchemsky) working with Trend Micro Zero Day Initiative ImageIO Available for: macOS Tahoe Impact: Processing a maliciously crafted image may result in disclosure of process memory Description: The issue was addressed with improved memory handling. CVE-2026-20634: George Karchemsky (@gkarchemsky) working with Trend Micro Zero Day Initiative Kernel Available for: macOS Tahoe Impact: An app may be able to cause unexpected system termination Description: The issue was addressed with improved memory handling. CVE-2026-20654: Jian Lee (@speedyfriend433) Kernel Available for: macOS Tahoe Impact: A malicious app may be able to gain root privileges Description: This issue was addressed with improved checks. CVE-2026-20626: Keisuke Hosoda Kernel Available for: macOS Tahoe Impact: An attacker in a privileged network position may be able to intercept network traffic Description: A logic issue was addressed with improved checks. CVE-2026-20671: Xin'an Zhou, Juefei Pu, Zhutian Liu, Zhiyun Qian, Zhaowei Tan, Srikanth V. Krishnamurthy, Mathy Vanhoef LaunchServices Available for: macOS Tahoe Impact: An app may be able to access protected user data Description: A permissions issue was addressed with additional restrictions. CVE-2026-20630: an anonymous researcher libexpat Available for: macOS Tahoe Impact: Processing a maliciously crafted file may lead to a denial-of- service Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2025-59375 libxpc Available for: macOS Tahoe Impact: An app may be able to break out of its sandbox Description: A logic issue was addressed with improved checks. CVE-2026-20667: an anonymous researcher Mail Available for: macOS Tahoe Impact: Turning off "Load remote content in messages” may not apply to all mail previews Description: A logic issue was addressed with improved checks. CVE-2026-20673: an anonymous researcher Messages Available for: macOS Tahoe Impact: A shortcut may be able to bypass sandbox restrictions Description: A race condition was addressed with improved handling of symbolic links. CVE-2026-20677: Ron Masas of BreakPoint.SH Model I/O Available for: macOS Tahoe Impact: Processing a maliciously crafted USD file may lead to unexpected app termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-20616: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative Notification Center Available for: macOS Tahoe Impact: An app with root privileges may be able to access private information Description: This issue was addressed with improved redaction of sensitive information. CVE-2026-20603: Kirin (@Pwnrin) and LFY (@secsys) from Fudan University NSOpenPanel Available for: macOS Tahoe Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-20666: an anonymous researcher Remote Management Available for: macOS Tahoe Impact: An app may be able to gain root privileges Description: A path handling issue was addressed with improved validation. CVE-2026-20614: Gergely Kalman (@gergely_kalman) Safari Available for: macOS Tahoe Impact: An app may be able to access a user's Safari history Description: A logic issue was addressed with improved validation. CVE-2026-20656: Mickey Jin (@patch1t) Sandbox Available for: macOS Tahoe Impact: An app may be able to break out of its sandbox Description: A permissions issue was addressed with additional restrictions. CVE-2026-20628: Noah Gregory (wts.dev) Security Available for: macOS Tahoe Impact: An app may be able to gain root privileges Description: A package validation issue was addressed by blocking the vulnerable package. CVE-2026-20658: Pwn2car Setup Assistant Available for: macOS Tahoe Impact: An app may be able to gain root privileges Description: This issue was addressed with improved handling of symlinks. CVE-2026-20610: Gergely Kalman (@gergely_kalman) Shortcuts Available for: macOS Tahoe Impact: An app may be able to access sensitive user data Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-20653: Enis Maholli (enismaholli.com) Siri Available for: macOS Tahoe Impact: A malicious app may be able to access notifications from other iCloud devices Description: A privacy issue was addressed by moving sensitive data to a protected location. CVE-2026-20648: Morris Richman (@morrisinlife) Siri Available for: macOS Tahoe Impact: An attacker with physical access to a locked device may be able to view sensitive user information Description: An authorization issue was addressed with improved state management. CVE-2026-20662: Vivek Dhar, ASI (RM) in Border Security Force, FTR HQ BSF Kashmir Siri Available for: macOS Tahoe Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved data protection. CVE-2026-20647: Kirin (@Pwnrin) Spotlight Available for: macOS Tahoe Impact: A sandboxed app may be able to access sensitive user data Description: The issue was addressed with additional restrictions on the observability of app states. CVE-2026-20680: an anonymous researcher Spotlight Available for: macOS Tahoe Impact: An app may be able to access sensitive user data Description: A privacy issue was addressed with improved checks. CVE-2026-20612: Mickey Jin (@patch1t) StoreKit Available for: macOS Tahoe Impact: An app may be able to identify what other apps a user has installed Description: A privacy issue was addressed with improved checks. CVE-2026-20641: Gongyu Ma (@Mezone0) System Settings Available for: macOS Tahoe Impact: An app may be able to access sensitive user data Description: A logging issue was addressed with improved data redaction. CVE-2026-20619: Asaf Cohen System Settings Available for: macOS Tahoe Impact: An app may be able to access user-sensitive data Description: An issue was addressed with improved handling of temporary files. CVE-2026-20618: Asaf Cohen UIKit Available for: macOS Tahoe Impact: An app may be able to bypass certain Privacy preferences Description: This issue was addressed by removing the vulnerable code. CVE-2026-20606: LeminLimez Voice Control Available for: macOS Tahoe Impact: An app may be able to crash a system process Description: The issue was addressed with improved memory handling. CVE-2026-20605: @cloudlldb of @pixiepointsec Weather Available for: macOS Tahoe Impact: A malicious app may be able to read sensitive location information Description: A logging issue was addressed with improved data redaction. CVE-2026-20646: Morris Richman (@morrisinlife) WebKit Available for: macOS Tahoe Impact: A remote attacker may be able to cause a denial-of-service Description: The issue was
Severity
No CVSS data available.
Assigner
VULNARCHIVE GNA GNA-1988
GNA scorecard E 38/100 over 445 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Apple Macos Tahoe Affected: unknown
guessed Create a notification for this product.
Credits
Apple Product Security via Fulldisclosure
Relationships
reference GCVE-1988-2026-0218 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Macos Tahoe",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-02-11-2026-3 macOS Tahoe 26.3\n\nmacOS Tahoe 26.3 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/126348.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAdmin Framework\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-20669: Mickey Jin (@patch1t)\n\nAppleMobileFileIntegrity\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-20625: Mickey Jin (@patch1t), Ryan Dowd (@_rdowd)\n\nAppleMobileFileIntegrity\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: An injection issue was addressed with improved validation.\nCVE-2026-20624: Mickey Jin (@patch1t)\n\nBluetooth\nAvailable for: macOS Tahoe\nImpact: An attacker in a privileged network position may be able to\nperform denial-of-service attack using crafted Bluetooth packets\nDescription: A denial-of-service issue was addressed with improved\nvalidation.\nCVE-2026-20650: jioundai\n\nCFNetwork\nAvailable for: macOS Tahoe\nImpact: A remote user may be able to write arbitrary files\nDescription: A path handling issue was addressed with improved logic.\nCVE-2026-20660: Amy (amys.website)\n\nContacts\nAvailable for: macOS Tahoe\nImpact: An app may be able to access information about a user\u0027s contacts\nDescription: A privacy issue was addressed with improved private data\nredaction for log entries.\nCVE-2026-20681: Kirin (@Pwnrin) and LFY (@secsys) from Fudan University\n\nCoreAudio\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted media file may lead to\nunexpected app termination or corrupt process memory\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-20611: Anonymous working with Trend Micro Zero Day Initiative\n\nCoreMedia\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted file may lead to a denial-of-\nservice or potentially disclose memory contents\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-20609: Yi\u011fit Can YILMAZ (@yilmazcanyigit)\n\nCoreServices\nAvailable for: macOS Tahoe\nImpact: An app may be able to gain root privileges\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-20617: Gergely Kalman (@gergely_kalman), Csaba Fitzl\n(@theevilbit) of Iru\n\nCoreServices\nAvailable for: macOS Tahoe\nImpact: An app may be able to gain root privileges\nDescription: A path handling issue was addressed with improved\nvalidation.\nCVE-2026-20615: Csaba Fitzl (@theevilbit) of Iru and Gergely Kalman\n(@gergely_kalman)\n\nCoreServices\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: An issue existed in the handling of environment variables.\nThis issue was addressed with improved validation.\nCVE-2026-20627: an anonymous researcher\n\ndyld\nAvailable for: macOS Tahoe\nImpact: An attacker with memory write capability may be able to execute\narbitrary code. Apple is aware of a report that this issue may have been\nexploited in an extremely sophisticated attack against specific targeted\nindividuals on versions of iOS before iOS 26. CVE-2025-14174 and\nCVE-2025-43529 were also issued in response to this report.\nDescription: A memory corruption issue was addressed with improved state\nmanagement.\nCVE-2026-20700: Google Threat Analysis Group\n\nFoundation\nAvailable for: macOS Tahoe\nImpact: An app may be able to access user-sensitive data\nDescription: A privacy issue was addressed with improved handling of\ntemporary files.\nCVE-2026-20629: Asaf Cohen\n\nFoundation\nAvailable for: macOS Tahoe\nImpact: An app may be able to monitor keystrokes without user permission\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-20601: an anonymous researcher\n\nFoundation\nAvailable for: macOS Tahoe\nImpact: An app may be able to access protected user data\nDescription: A permissions issue was addressed by removing the\nvulnerable code.\nCVE-2026-20623: an anonymous researcher\n\nGame Center\nAvailable for: macOS Tahoe\nImpact: A user may be able to view sensitive user information\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-20649: Asaf Cohen\n\nGPU Drivers\nAvailable for: macOS Tahoe\nImpact: An attacker may be able to cause unexpected system termination\nor read kernel memory\nDescription: An out-of-bounds read issue was addressed with improved\ninput validation.\nCVE-2026-20620: Murray Mike\n\nImageIO\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted image may lead to disclosure of\nuser information\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-20675: George Karchemsky (@gkarchemsky) working with Trend\nMicro Zero Day Initiative\n\nImageIO\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted image may result in disclosure\nof process memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-20634: George Karchemsky (@gkarchemsky) working with Trend\nMicro Zero Day Initiative\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-20654: Jian Lee (@speedyfriend433)\n\nKernel\nAvailable for: macOS Tahoe\nImpact: A malicious app may be able to gain root privileges\nDescription: This issue was addressed with improved checks.\nCVE-2026-20626: Keisuke Hosoda\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An attacker in a privileged network position may be able to\nintercept network traffic\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-20671: Xin\u0027an Zhou, Juefei Pu, Zhutian Liu, Zhiyun Qian,\nZhaowei Tan, Srikanth V. Krishnamurthy, Mathy Vanhoef\n\nLaunchServices\nAvailable for: macOS Tahoe\nImpact: An app may be able to access protected user data\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-20630: an anonymous researcher\n\nlibexpat\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted file may lead to a denial-of-\nservice\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2025-59375\n\nlibxpc\nAvailable for: macOS Tahoe\nImpact: An app may be able to break out of its sandbox\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-20667: an anonymous researcher\n\nMail\nAvailable for: macOS Tahoe\nImpact: Turning off \"Load remote content in messages\u201d may not apply to\nall mail previews\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-20673: an anonymous researcher\n\nMessages\nAvailable for: macOS Tahoe\nImpact: A shortcut may be able to bypass sandbox restrictions\nDescription: A race condition was addressed with improved handling of\nsymbolic links.\nCVE-2026-20677: Ron Masas of BreakPoint.SH\n\nModel I/O\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted USD file may lead to unexpected\napp termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-20616: Michael DePlante (@izobashi) of Trend Micro Zero Day\nInitiative\n\nNotification Center\nAvailable for: macOS Tahoe\nImpact: An app with root privileges may be able to access private\ninformation\nDescription: This issue was addressed with improved redaction of\nsensitive information.\nCVE-2026-20603: Kirin (@Pwnrin) and LFY (@secsys) from Fudan University\n\nNSOpenPanel\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-20666: an anonymous researcher\n\nRemote Management\nAvailable for: macOS Tahoe\nImpact: An app may be able to gain root privileges\nDescription: A path handling issue was addressed with improved\nvalidation.\nCVE-2026-20614: Gergely Kalman (@gergely_kalman)\n\nSafari\nAvailable for: macOS Tahoe\nImpact: An app may be able to access a user\u0027s Safari history\nDescription: A logic issue was addressed with improved validation.\nCVE-2026-20656: Mickey Jin (@patch1t)\n\nSandbox\nAvailable for: macOS Tahoe\nImpact: An app may be able to break out of its sandbox\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-20628: Noah Gregory (wts.dev)\n\nSecurity\nAvailable for: macOS Tahoe\nImpact: An app may be able to gain root privileges\nDescription: A package validation issue was addressed by blocking the\nvulnerable package.\nCVE-2026-20658: Pwn2car\n\nSetup Assistant\nAvailable for: macOS Tahoe\nImpact: An app may be able to gain root privileges\nDescription: This issue was addressed with improved handling of\nsymlinks.\nCVE-2026-20610: Gergely Kalman (@gergely_kalman)\n\nShortcuts\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-20653: Enis Maholli (enismaholli.com)\n\nSiri\nAvailable for: macOS Tahoe\nImpact: A malicious app may be able to access notifications from other\niCloud devices\nDescription: A privacy issue was addressed by moving sensitive data to a\nprotected location.\nCVE-2026-20648: Morris Richman (@morrisinlife)\n\nSiri\nAvailable for: macOS Tahoe\nImpact: An attacker with physical access to a locked device may be able\nto view sensitive user information\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-20662: Vivek Dhar, ASI (RM) in Border Security Force, FTR HQ\nBSF Kashmir\n\nSiri\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nCVE-2026-20647: Kirin (@Pwnrin)\n\nSpotlight\nAvailable for: macOS Tahoe\nImpact: A sandboxed app may be able to access sensitive user data\nDescription: The issue was addressed with additional restrictions on the\nobservability of app states.\nCVE-2026-20680: an anonymous researcher\n\nSpotlight\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: A privacy issue was addressed with improved checks.\nCVE-2026-20612: Mickey Jin (@patch1t)\n\nStoreKit\nAvailable for: macOS Tahoe\nImpact: An app may be able to identify what other apps a user has\ninstalled\nDescription: A privacy issue was addressed with improved checks.\nCVE-2026-20641: Gongyu Ma (@Mezone0)\n\nSystem Settings\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-20619: Asaf Cohen\n\nSystem Settings\nAvailable for: macOS Tahoe\nImpact: An app may be able to access user-sensitive data\nDescription: An issue was addressed with improved handling of temporary\nfiles.\nCVE-2026-20618: Asaf Cohen\n\nUIKit\nAvailable for: macOS Tahoe\nImpact: An app may be able to bypass certain Privacy preferences\nDescription: This issue was addressed by removing the vulnerable code.\nCVE-2026-20606: LeminLimez\n\nVoice Control\nAvailable for: macOS Tahoe\nImpact: An app may be able to crash a system process\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-20605: @cloudlldb of @pixiepointsec\n\nWeather\nAvailable for: macOS Tahoe\nImpact: A malicious app may be able to read sensitive location\ninformation\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-20646: Morris Richman (@morrisinlife)\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: A remote attacker may be able to cause a denial-of-service\nDescription: The issue was"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:11:20Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/23"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/23"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/126348"
        },
        {
          "url": "https://support.apple.com/downloads/"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/23"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-02-11-2026-3 macOS Tahoe 26.3",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-14174",
              "type": "related"
            },
            {
              "destId": "CVE-2025-43529",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59375",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20601",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20602",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20603",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20605",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20606",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20608",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20609",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20610",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20611",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20612",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20614",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20615",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20616",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20617",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20618",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20619",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20620",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20621",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20623",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20624",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20625",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20626",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20627",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20628",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20629",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20630",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20634",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20635",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20636",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20641",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20644",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20646",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20647",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20648",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20649",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20650",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20652",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20653",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20654",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20656",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20658",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20660",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20662",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20666",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20667",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20669",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20671",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20673",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20675",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20676",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20677",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20680",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20681",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20700",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0218",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/23",
            "automated": true,
            "contentSha256": "9044969055b12933aa8ccac76d23cf394ce351b231113c3a0d75ce3a01d324bc",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/23",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-12T00:03:50Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0218"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:42Z",
    "dateUpdated": "2026-09-11T11:11:20Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0218"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.