GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

GCVE-1988-2026-0334

Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 11:28
VLAI
Title
APPLE-SA-05-11-2026-7 macOS Sequoia 15.7.7
Summary
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-05-11-2026-7 macOS Sequoia 15.7.7 macOS Sequoia 15.7.7 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/127116. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. APFS Available for: macOS Sequoia Impact: An app may be able to cause unexpected system termination Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-28959: Dave G. AppleJPEG Available for: macOS Sequoia Impact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory Description: A memory corruption issue was addressed with improved input validation. CVE-2026-28956: impost0r (ret2plt) Audio Available for: macOS Sequoia Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: The issue was addressed with improved memory handling. CVE-2026-39869: David Ige of Beryllium Security CoreMedia Available for: macOS Sequoia Impact: An app may be able to access private information Description: This issue was addressed through improved state management. CVE-2026-28922: Arni Hardarson Crash Reporter Available for: macOS Sequoia Impact: An app may be able to enumerate a user's installed apps Description: A privacy issue was addressed by removing sensitive data. CVE-2026-28878: Zhongcheng Li from IES Red Team CUPS Available for: macOS Sequoia Impact: An app may be able to gain root privileges Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-28915: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs FileProvider Available for: macOS Sequoia Impact: An app may be able to access sensitive user data Description: A race condition was addressed with additional validation. CVE-2026-43659: Alex Radocea GPU Drivers Available for: macOS Sequoia Impact: A malicious app may be able to break out of its sandbox Description: A logging issue was addressed with improved data redaction. CVE-2026-28923: Kun Peeks (@SwayZGl1tZyyy) HFS Available for: macOS Sequoia Impact: An app may be able to cause unexpected system termination or write kernel memory Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-28925: Dave G., Aswin Kumar Gokula Kannan Icons Available for: macOS Sequoia Impact: An app may be able to break out of its sandbox Description: An access issue was addressed with additional sandbox restrictions. CVE-2025-43524: Csaba Fitzl (@theevilbit) of Iru ImageIO Available for: macOS Sequoia Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: The issue was addressed with improved bounds checks. CVE-2026-28977: Suresh Sundaram ImageIO Available for: macOS Sequoia Impact: Processing a maliciously crafted image may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-28990: Jiri Ha, Arni Hardarson Installer Available for: macOS Sequoia Impact: A malicious app may be able to break out of its sandbox Description: A permissions issue was addressed with additional restrictions. CVE-2026-28978: wdszzml and Atuin Automated Vulnerability Discovery Engine IOHIDFamily Available for: macOS Sequoia Impact: An attacker may be able to cause unexpected app termination Description: A memory corruption vulnerability was addressed with improved locking. CVE-2026-28992: Johnny Franks (@zeroxjf) IOHIDFamily Available for: macOS Sequoia Impact: An app may be able to determine kernel memory layout Description: A logging issue was addressed with improved data redaction. CVE-2026-28943: Google Threat Analysis Group IOKit Available for: macOS Sequoia Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-28969: Mihalis Haatainen, Ari Hawking, Ashish Kunwar Kernel Available for: macOS Sequoia Impact: An app may be able to disclose kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-43654: Vaagn Vardanian, Nathaniel Oh (@calysteon) Kernel Available for: macOS Sequoia Impact: A maliciously crafted disk image may bypass Gatekeeper checks Description: A file quarantine bypass was addressed with additional checks. CVE-2026-28954: Yiğit Can YILMAZ (@yilmazcanyigit) Kernel Available for: macOS Sequoia Impact: A local user may be able to cause unexpected system termination or read kernel memory Description: A buffer overflow was addressed with improved input validation. CVE-2026-28897: Robert Tran, popku1337, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Aswin kumar Gokulakannan Kernel Available for: macOS Sequoia Impact: An app may be able to cause unexpected system termination Description: An integer overflow was addressed with improved input validation. CVE-2026-28952: Calif.io in collaboration with Claude and Anthropic Research Kernel Available for: macOS Sequoia Impact: An app may be able to modify protected parts of the file system Description: A denial of service issue was addressed by removing the vulnerable code. CVE-2026-28908: beist Kernel Available for: macOS Sequoia Impact: An app may be able to gain root privileges Description: An authorization issue was addressed with improved state management. CVE-2026-28951: Csaba Fitzl (@theevilbit) of Iru Kernel Available for: macOS Sequoia Impact: An app may be able to cause unexpected system termination or write kernel memory Description: An out-of-bounds write issue was addressed with improved input validation. CVE-2026-28972: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io) Kernel Available for: macOS Sequoia Impact: An app may be able to cause unexpected system termination Description: A race condition was addressed with additional validation. CVE-2026-28986: Tristan Madani (@TristanInSec) from Talence Security, Ryan Hileman via Xint Code (xint.io), Chris Betz Kernel Available for: macOS Sequoia Impact: An app may be able to leak sensitive kernel state Description: A logging issue was addressed with improved data redaction. CVE-2026-28987: Dhiyanesh Selvaraj (@redroot97) Mail Drafts Available for: macOS Sequoia Impact: Replying to an email could display remote images in Mail in Lockdown Mode Description: A logic issue was addressed with improved checks. CVE-2026-28929: Yiğit Can YILMAZ (@yilmazcanyigit) mDNSResponder Available for: macOS Sequoia Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2026-43668: Ricardo Prado, Anton Pakhunov mDNSResponder Available for: macOS Sequoia Impact: An attacker on the local network may be able to cause a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43666: Ian van der Wurff (ian.nl) Model I/O Available for: macOS Sequoia Impact: Processing a maliciously crafted image may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-28940: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative Model I/O Available for: macOS Sequoia Impact: Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents Description: The issue was addressed with improved checks. CVE-2026-28941: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative Networking Available for: macOS Sequoia Impact: An attacker may be able to track users through their IP address Description: This issue was addressed through improved state management. CVE-2026-28906: Ilya Sc. Jowell A. PackageKit Available for: macOS Sequoia Impact: An app may be able to gain root privileges Description: A permissions issue was addressed with additional restrictions. CVE-2026-28840: Morris Richman (@morrisinlife), Andrei Dodu Quick Look Available for: macOS Sequoia Impact: Parsing a maliciously crafted file may lead to an unexpected app termination Description: An out-of-bounds write issue was addressed with improved input validation. CVE-2026-43656: Peter Malone SceneKit Available for: macOS Sequoia Impact: Processing a maliciously crafted image may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-39870: Peter Malone SceneKit Available for: macOS Sequoia Impact: A remote attacker may be able to cause unexpected app termination Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-28846: Peter Malone Shortcuts Available for: macOS Sequoia Impact: An app may be able to access user-sensitive data Description: This issue was addressed by adding an additional prompt for user consent. CVE-2026-28993: Doron Assness SMB Available for: macOS Sequoia Impact: A remote attacker may be able to cause unexpected system termination Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-28848: Peter Malone, Dave G. and Alex Radocea of Supernetworks Spotlight Available for: macOS Sequoia Impact: An app may be able to cause a denial-of-service Description: This issue was addressed with improved checks to prevent unauthorized actions. CVE-2026-28974: Andy Koo (@andykoo) of Hexens Storage Available for: macOS Sequoia Impact: An app may be able to access sensitive user data Description: A race condition was addressed with additional validation. CVE-2026-28996: Alex Radocea StorageKit Available for: macOS Sequoia Impact: An app may be able to gain root privileges Description: A consistency issue was addressed with improved state handling. CVE-2026-28919: Amy (amys.website) Sync Services Available for: macOS Sequoia Impact: An app may be able to access Contacts without user consent Description: A race condition was addressed with improved handling of symbolic links. CVE-2026-28924: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs TV App Available for: macOS Sequoia Impact: An app may be able to observe unprotected user data Description: A path handling issue was addressed with improved logic. CVE-2026-39871: an anonymous researcher Wi-Fi Available for: macOS Sequoia Impact: An app may be able to execute arbitrary code with kernel privileges Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-28819: Wang Yu Wi-Fi Available for: macOS Sequoia Impact: An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets Description: A use after free issue was addressed with improved memory management. CVE-2026-28994: Alex Radocea zlib Available for: macOS Sequoia Impact: Visiting a maliciously crafted website may leak sensitive data Description: An information leakage was addressed with additional validation. CVE-2026-28920: Brendon Tiszka of Google Project Zero Additional recognition Kernel We would like to acknowledge Ryan Hileman via Xint Code (xint.io) for their assistance. Location We would like to acknowledge Kun Peeks (@SwayZGl1tZyyy) for their assistance. OpenSSH We would like to acknowledge Anand Patil for their assistance. macOS Sequoia 15.7.7 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNw
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Apple Macos Sequoia Affected: unknown
guessed Create a notification for this product.
Credits
Apple Product Security via Fulldisclosure
Relationships
reference GCVE-1988-2026-0334 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Macos Sequoia",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-05-11-2026-7 macOS Sequoia 15.7.7\n\nmacOS Sequoia 15.7.7 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/127116.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAPFS\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28959: Dave G.\n\nAppleJPEG\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted media file may lead to\nunexpected app termination or corrupt process memory\nDescription: A memory corruption issue was addressed with improved input\nvalidation.\nCVE-2026-28956: impost0r (ret2plt)\n\nAudio\nAvailable for: macOS Sequoia\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-39869: David Ige of Beryllium Security\n\nCoreMedia\nAvailable for: macOS Sequoia\nImpact: An app may be able to access private information\nDescription: This issue was addressed through improved state management.\nCVE-2026-28922: Arni Hardarson\n\nCrash Reporter\nAvailable for: macOS Sequoia\nImpact: An app may be able to enumerate a user\u0027s installed apps\nDescription: A privacy issue was addressed by removing sensitive data.\nCVE-2026-28878: Zhongcheng Li from IES Red Team\n\nCUPS\nAvailable for: macOS Sequoia\nImpact: An app may be able to gain root privileges\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-28915: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nFileProvider\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with additional validation.\nCVE-2026-43659: Alex Radocea\n\nGPU Drivers\nAvailable for: macOS Sequoia\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28923: Kun Peeks (@SwayZGl1tZyyy)\n\nHFS\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28925: Dave G., Aswin Kumar Gokula Kannan\n\nIcons\nAvailable for: macOS Sequoia\nImpact: An app may be able to break out of its sandbox\nDescription: An access issue was addressed with additional sandbox\nrestrictions.\nCVE-2025-43524: Csaba Fitzl (@theevilbit) of Iru\n\nImageIO\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-28977: Suresh Sundaram\n\nImageIO\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-28990: Jiri Ha, Arni Hardarson\n\nInstaller\nAvailable for: macOS Sequoia\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28978: wdszzml and Atuin Automated Vulnerability Discovery\nEngine\n\nIOHIDFamily\nAvailable for: macOS Sequoia\nImpact: An attacker may be able to cause unexpected app termination\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nCVE-2026-28992: Johnny Franks (@zeroxjf)\n\nIOHIDFamily\nAvailable for: macOS Sequoia\nImpact: An app may be able to determine kernel memory layout\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28943: Google Threat Analysis Group\n\nIOKit\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28969: Mihalis Haatainen, Ari Hawking, Ashish Kunwar\n\nKernel\nAvailable for: macOS Sequoia\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43654: Vaagn Vardanian, Nathaniel Oh (@calysteon)\n\nKernel\nAvailable for: macOS Sequoia\nImpact: A maliciously crafted disk image may bypass Gatekeeper checks\nDescription: A file quarantine bypass was addressed with additional\nchecks.\nCVE-2026-28954: Yi\u011fit Can YILMAZ (@yilmazcanyigit)\n\nKernel\nAvailable for: macOS Sequoia\nImpact: A local user may be able to cause unexpected system termination\nor read kernel memory\nDescription: A buffer overflow was addressed with improved input\nvalidation.\nCVE-2026-28897: Robert Tran, popku1337, Billy Jheng Bing Jhong and Pan\nZhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Aswin kumar\nGokulakannan\n\nKernel\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-28952: Calif.io in collaboration with Claude and Anthropic\nResearch\n\nKernel\nAvailable for: macOS Sequoia\nImpact: An app may be able to modify protected parts of the file system\nDescription: A denial of service issue was addressed by removing the\nvulnerable code.\nCVE-2026-28908: beist\n\nKernel\nAvailable for: macOS Sequoia\nImpact: An app may be able to gain root privileges\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-28951: Csaba Fitzl (@theevilbit) of Iru\n\nKernel\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\ninput validation.\nCVE-2026-28972: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with additional validation.\nCVE-2026-28986: Tristan Madani (@TristanInSec) from Talence Security,\nRyan Hileman via Xint Code (xint.io), Chris Betz\n\nKernel\nAvailable for: macOS Sequoia\nImpact: An app may be able to leak sensitive kernel state\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28987: Dhiyanesh Selvaraj (@redroot97)\n\nMail Drafts\nAvailable for: macOS Sequoia\nImpact: Replying to an email could display remote images in Mail in\nLockdown Mode\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-28929: Yi\u011fit Can YILMAZ (@yilmazcanyigit)\n\nmDNSResponder\nAvailable for: macOS Sequoia\nImpact: A remote attacker may be able to cause unexpected system\ntermination or corrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43668: Ricardo Prado, Anton Pakhunov\n\nmDNSResponder\nAvailable for: macOS Sequoia\nImpact: An attacker on the local network may be able to cause a\ndenial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43666: Ian van der Wurff (ian.nl)\n\nModel I/O\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-28940: Michael DePlante (@izobashi) of TrendAI Zero Day\nInitiative\n\nModel I/O\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted file may lead to a\ndenial-of-service or potentially disclose memory contents\nDescription: The issue was addressed with improved checks.\nCVE-2026-28941: Michael DePlante (@izobashi) of TrendAI Zero Day\nInitiative\n\nNetworking\nAvailable for: macOS Sequoia\nImpact: An attacker may be able to track users through their IP address\nDescription: This issue was addressed through improved state management.\nCVE-2026-28906: Ilya Sc. Jowell A.\n\nPackageKit\nAvailable for: macOS Sequoia\nImpact: An app may be able to gain root privileges\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28840: Morris Richman (@morrisinlife), Andrei Dodu\n\nQuick Look\nAvailable for: macOS Sequoia\nImpact: Parsing a maliciously crafted file may lead to an unexpected app\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\ninput validation.\nCVE-2026-43656: Peter Malone\n\nSceneKit\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-39870: Peter Malone\n\nSceneKit\nAvailable for: macOS Sequoia\nImpact: A remote attacker may be able to cause unexpected app\ntermination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28846: Peter Malone\n\nShortcuts\nAvailable for: macOS Sequoia\nImpact: An app may be able to access user-sensitive data\nDescription: This issue was addressed by adding an additional prompt for\nuser consent.\nCVE-2026-28993: Doron Assness\n\nSMB\nAvailable for: macOS Sequoia\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28848: Peter Malone, Dave G. and Alex Radocea of Supernetworks\n\nSpotlight\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause a denial-of-service\nDescription: This issue was addressed with improved checks to prevent\nunauthorized actions.\nCVE-2026-28974: Andy Koo (@andykoo) of Hexens\n\nStorage\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with additional validation.\nCVE-2026-28996: Alex Radocea\n\nStorageKit\nAvailable for: macOS Sequoia\nImpact: An app may be able to gain root privileges\nDescription: A consistency issue was addressed with improved state\nhandling.\nCVE-2026-28919: Amy (amys.website)\n\nSync Services\nAvailable for: macOS Sequoia\nImpact: An app may be able to access Contacts without user consent\nDescription: A race condition was addressed with improved handling of\nsymbolic links.\nCVE-2026-28924: YingQi Shi (@Mas0nShi) of DBAppSecurity\u0027s WeBin lab,\nAndreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nTV App\nAvailable for: macOS Sequoia\nImpact: An app may be able to observe unprotected user data\nDescription: A path handling issue was addressed with improved logic.\nCVE-2026-39871: an anonymous researcher\n\nWi-Fi\nAvailable for: macOS Sequoia\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-28819: Wang Yu\n\nWi-Fi\nAvailable for: macOS Sequoia\nImpact: An attacker in a privileged network position may be able to\nperform denial-of-service attack using crafted Wi-Fi packets\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28994: Alex Radocea\n\nzlib\nAvailable for: macOS Sequoia\nImpact: Visiting a maliciously crafted website may leak sensitive data\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-28920: Brendon Tiszka of Google Project Zero\n\nAdditional recognition\n\nKernel\nWe would like to acknowledge Ryan Hileman via Xint Code (xint.io) for\ntheir assistance.\n\nLocation\nWe would like to acknowledge Kun Peeks (@SwayZGl1tZyyy) for their\nassistance.\n\nOpenSSH\nWe would like to acknowledge Anand Patil for their assistance.\n\nmacOS Sequoia 15.7.7 may be obtained from the Mac App Store or Apple\u0027s\nSoftware Downloads web site: https://support.apple.com/downloads/\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNw"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:28:25Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/12"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/12"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/downloads/"
        },
        {
          "url": "https://support.apple.com/en-us/127116"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/12"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-05-11-2026-7 macOS Sequoia 15.7.7",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-43524",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28819",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28840",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28846",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28848",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28878",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28897",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28906",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28908",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28915",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28919",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28920",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28922",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28923",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28924",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28925",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28929",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28940",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28941",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28943",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28951",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28952",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28954",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28956",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28959",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28969",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28972",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28974",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28977",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28978",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28986",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28987",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28990",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28992",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28993",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28994",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28996",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39869",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39870",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39871",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43654",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43656",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43659",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43666",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43668",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0334",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/12",
            "automated": true,
            "contentSha256": "8afb0d0534235069df9276cbbd4a90e94f80c6d1a3ed2096a6f25f0738e7a3fb",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/12",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-11T22:33:20Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0334"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:56Z",
    "dateUpdated": "2026-09-11T11:28:25Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0334"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.