About the security content of visionOS 26.5

About the security content of visionOS 26.5 This document describes the security content of visionOS 26.5. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...

PT-2026-39850

Name of the Vulnerable Software and Affected Versions barebox versions prior to 2026.04.0 Description An out-of-bounds read exists in the ext4 extent parsing process due to missing validation of the eh entries field against buffer capacity within the fs/ext4/ext4 common.c file. An attacker can...

PT-2026-39663

Name of the Vulnerable Software and Affected Versions BentoML versions prior to 1.4.39 Description BentoML is a Python library used for building online serving systems optimized for AI applications and model inference. The issue occurs because the template src/bentoml/...

PT-2026-39825

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.5 iPadOS versions prior to 26.5 macOS Sequoia versions prior to 15.7.7 macOS Sonoma versions prior to 14.8.7 macOS Tahoe versions prior to 26.5 tvOS versions prior to 26.5 visionOS versions prior to 26.5 watchOS versio...

PT-2026-39846

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.5 iPadOS versions prior to 26.5 macOS Tahoe versions prior to 26.5 tvOS versions prior to 26.5 watchOS versions prior to 26.5 Description A buffer overflow occurs when a program writes more data to a memory buffer than...

Unity Linux 20.1060e / 20.1070e Security Update: ImageMagick (UTSA-2026-017538)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017538 advisory. A flaw was found in ImageMagick in coders/jp2.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form...

Unity Linux 20.1060e / 20.1070e Security Update: exiv2 (UTSA-2026-017629)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017629 advisory. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-pillow (UTSA-2026-017483)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017483 advisory. Pillow before 8.1.2 allows attackers to cause a denial of service memory consumption because the reported size of a contained image is not properly checked for an IC...

Unity Linux 20.1060e / 20.1070e Security Update: exiv2 (UTSA-2026-017410)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017410 advisory. A flaw was found in Exiv2 in versions before and including 0.27.4-RC1. Improper input validation of the rawData.size property in Jp2Image::readMetadata in jp2image.c...

Unity Linux 20.1060e / 20.1070e Security Update: ImageMagick (UTSA-2026-017560)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017560 advisory. in SetImageExtent of /MagickCore/image.c, an incorrect image depth size can cause a memory leak because the code which checks for the proper image depth size does no...

Unity Linux 20.1060e / 20.1070e Security Update: ImageMagick (UTSA-2026-017646)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017646 advisory. A flaw was found in ImageMagick in versions 7.0.11, where an integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c may trigger undefined behavior via a craft...

Unity Linux 20.1060e / 20.1070e Security Update: ImageMagick (UTSA-2026-017623)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017623 advisory. In RestoreMSCWarning of /coders/pdf.c there are several areas where calls to GetPixelIndex could result in values outside the range of representable for the unsigned...

Unity Linux 20.1060e / 20.1070e Security Update: ImageMagick (UTSA-2026-017557)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017557 advisory. A flaw was found in ImageMagick in MagickCore/resize.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in t...

PT-2026-39834

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. Processing a maliciously crafted image may corrupt process memory...

Barebox 缓冲区错误漏洞

Barebox is a versatile and flexible bootloader developed by Barebox Open Source. Versions of Barebox prior to 2026.04.0 contained a buffer error vulnerability. This vulnerability stemmed from the lack of verification of the ehentry fields and buffer capacity during ext4 extent parsing. It could...

Wagtail 安全漏洞

Wagtail is an open-source content management system CMS developed by Wagtail. Versions of Wagtail prior to 7.0.7, 7.3.2, and 7.4 contained security vulnerabilities. These vulnerabilities stemmed from the document and image APIs incorrectly listing items within private collections, potentially...

Grav 跨站脚本漏洞

Grav is a scalable content management system CMS developed by the Grav open-source community, suitable for use in personal blogs, small content publishing platforms, and single-page product displays. Versions of Grav prior to 2.0.0-beta.2 contained a cross-site scripting vulnerability. This...

Unity Linux 20.1060e / 20.1070e Security Update: exiv2 (UTSA-2026-017638)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017638 advisory. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A heap buffer overflow was found in Exiv2...

Unity Linux 20.1060e / 20.1070e Security Update: exiv2 (UTSA-2026-017659)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017659 advisory. Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A read of uninitialized memory was found ...

Unity Linux 20.1060e / 20.1070e Security Update: ImageMagick (UTSA-2026-017650)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017650 advisory. A flaw was found in ImageMagick in MagickCore/quantum-private.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger a heap buffer...