CVE-2025-43278

CVE-2025-43278 affects macOS Sequoia prior to 15.4; the issue arises from improper handling of symlinks and is addressed in macOS Sequoia 15.4. The description notes that an app may be able to access protected user data due to this flaw. According to the connected sources, the vulnerability is mi...

CVE-2025-43402

CVE-2025-43402 affects macOS Tahoe prior to version 26.1, with a memory mishandling flaw that can cause an app to terminate the system or corrupt process memory. Apple notes the fix is in macOS Tahoe 26.1. Connected feeds (CNVD, RH, NVD, etc.) consistently describe memory handling improvements as...

CVE-2025-43404

CVE-2025-43404 is a permissions/sandbox issue in macOS Tahoe that allowed an app to access sensitive user data due to insufficient sandbox restrictions. Multiple sources (NVD, Red Hat, CNVD, RH, etc.) describe a vulnerability resolved in macOS Tahoe 26.1 with the sandbox tightened. The NVD entry ...

CVE-2025-43473

CVE-2025-43473 affects macOS Tahoe 26.1 and earlier, where an issue with improved state management could allow an app to access sensitive user data. The vulnerability is fixed in macOS Tahoe 26.1. Impact is described as local access with high confidentiality impact and no integrity/availability i...

CVE-2025-43474

An out-of-bounds read issue was fixed by improved input validation in macOS components. Affected: macOS Sonoma 14.8.2, macOS Sequoia 15.7.2, macOS Tahoe 26.1. Impact (as stated): an app may terminate the system or read kernel memory. Remediation: apply the corresponding updates (Sonoma 14.8.2, Se...

CVE-2025-43527

CVE-2025-43527 is a permissions-related elevation-privilege issue affecting macOS Sequoia 15.7.3 and macOS Tahoe 26.2. The advisory notes that an app may be able to gain root privileges due to insufficient restrictions. Affected products/versions are fixed in Sequoia 15.7.3 and Tahoe 26.2. The av...

CVE-2025-43379

CVE-2025-43379 arises from insufficient validation of symlinks in Apple OS components. Affected products include tvOS, watchOS, macOS (Tahoe 26.1; Sequoia 15.7.2; Sonoma 14.8.2), iOS/iPadOS (26.1) and visionOS 26.1. The issue may allow an app to access protected user data due to improper symlink ...

CVE-2025-43471

CVE-2025-43471 affects macOS Tahoe before 26.1, with the issue described as an access to sensitive user data due to insufficient or improved checks. Apple’s security content for macOS Tahoe 26.1 attributes the fix to the Admin Framework and states: “The issue was addressed with improved checks” a...

CVE-2025-43446

CVE-2025-43446 affects macOS Sonoma 14.8.2, macOS Sequoia 15.7.2, and macOS Tahoe 26.1 (and related builds). The issue stems from insufficient validation of symbolic links, enabling an app to modify protected parts of the filesystem. The CVE is mitigated by patches in the listed OS versions (Sono...

CVE-2025-43288

The CVE-2025-43288 issue affects macOS Sequoia and is tied to Archive Utility’s handling of symlinks. The vulnerability could allow an app to bypass Privacy preferences due to insufficient validation of symbolic links. Apple states the flaw is addressed with improved validation of symlinks and is...

CVE-2025-43481

The CVE-2025-43481 entry affects macOS Sequoia (15.7.2) and macOS Tahoe (26.1). It describes a sandbox-bypass vulnerability in which an app may escape sandbox protections; Apple’s security notes indicate the issue was addressed with improved checks, with the fix shipped in Sequoia 15.7.2 and Taho...

CVE-2024-44286

CVE-2024-44286 affects macOS Sequoia 15.1 and earlier, where an attacker with physical access can inject keyboard events into apps running on a locked device. The root cause is described as improved state management. The issue is fixed in macOS Sequoia 15.1. Remediation: update to macOS 15.1 or l...

CVE-2024-44219

CVE-2024-44219 affects macOS Sequoia (15.1) where a permissions issue could allow a malicious application with root privileges to access private information. Public documents confirm the flaw and its fix in Sequoia 15.1; remediation is to upgrade to macOS 15.1 or later. The exact root cause is de...

CVE-2026-86869

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, macOS Golden Gate 27. Processing a maliciously crafted image may lead to unexpected app termination.

CVE-2026-64752

A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Processing a maliciously crafted image may lead to arbitrary code execution.

CVE-2026-84584

CVE-2026-84584 is a sandbox escape vulnerability in macOS Golden Gate 27 , caused by improper handling of symlinks . An app may be able to break out of its sandbox, with a CVSS 3.1 score of 8.4 (HIGH) reflecting local attack vector, low complexity, low privileges required, and changed scope with ...

CVE-2026-84635

A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected process termination.

CVE-2026-84601

CVE-2026-84601 is a permissions issue in the Apple Intelligence component of macOS , addressed with improved state management. The vulnerability allows an app to bypass Apple Intelligence security prompts , resulting in a high integrity impact with no confidentiality or availability impact (CVSS ...

CVE-2026-86905

This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to delete credentials stored in Keychain.

CVE-2026-64753

A permissions issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may disclose sensitive user information.

CVE-2026-86898

A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting.

CVE-2026-65380

CVE-2026-65380 is a vulnerability in Apple macOS related to improper handling of snapshots , where insufficient permissions logic could allow an app to access protected user data . The issue is fixed in macOS Golden Gate 27 ; the connected NCSC advisory also lists Sequoia 15.8 and Tahoe 26.7 amon...

CVE-2026-65398

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination or corrupt kernel memory.

CVE-2026-84533

CVE-2026-84533 is a cryptographic issue in Apple's operating systems affecting iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, and watchOS 27 . The vulnerability was addressed through improved integrity checks. An attacker in a privileged network position may be able to modify network traffic, ...

CVE-2026-43688

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. Processing a maliciously crafted file may lead to unexpected app termination.

CVE-2026-65391

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Safari 26.6.1, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to memory corruption.

CVE-2026-84631

This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27. An app may be able to gain root privileges.

CVE-2026-84520

A buffer overflow was addressed with improved size validation. This issue is fixed in macOS Golden Gate 27. A local attacker may be able to cause unexpected system termination or corrupt kernel memory.

CVE-2026-84551

CVE-2026-84551 affects Apple's iOS 27 , iPadOS 27 , macOS Golden Gate 27 , visionOS 27 , and watchOS 27 . It stems from a logic issue addressed through improved validation, which may allow an app to bypass network restrictions . The NVD-assigned CVSS 3.1 score is 4.4 (Medium) with a local attack ...

CVE-2026-84569

CVE-2026-84569 is an access issue in macOS Golden Gate 27 involving the system pasteboards , resolved through additional sandbox restrictions . A malicious app could potentially access sensitive user data from other applications' pasteboard content. The NVD-assigned CVSS 3.1 score is 5.5 (MEDIUM)...

CVE-2026-84589

CVE-2026-84589 is a permissions issue in macOS Golden Gate 27 that could allow an app to modify Privacy preferences . Apple addressed the issue with additional restrictions. The NVD-assigned CVSS v3.1 score is 5.5 (Medium) , reflecting a local attack vector with low complexity, low privileges req...

CVE-2026-86884

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, watchOS 27. An app may be able to access sensitive user data.

CVE-2026-86901

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27. Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure.

CVE-2026-43783

A race condition was addressed with improved locking. This issue is fixed in macOS Tahoe 26.6. A malicious app may be able to gain root privileges.

CVE-2026-65354

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious app may be able to break out of its sandbox.

CVE-2026-65393

A permissions issue was addressed with improved validation. This issue is fixed in Xcode 27, macOS Golden Gate 27. An app may be able to access user-sensitive data.

CVE-2026-84577

An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27, macOS Tahoe 26.7. An app may be able to bypass sandbox restrictions.

CVE-2026-84586

An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, watchOS 27. A malicious application may be able to leak sensitive user information.

CVE-2026-86894

A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27. An app may be able to break out of its sandbox.

CVE-2026-86897

This issue was addressed with additional entitlement checks. This issue is fixed in Safari 27, iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to access sensitive user data.

CVE-2026-86903

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to disclose kernel memory.

CVE-2026-28937

This issue was addressed through improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to access sensitive user data.

CVE-2026-65415

A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. A local user may be able to cause unexpected system termination or read kernel memory.

CVE-2026-84518

This issue was addressed through improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious website may be able to determine what apps a user has installed.

CVE-2026-84558

CVE-2026-84558 is a double free memory management vulnerability in macOS Golden Gate 27 . A malicious app may cause unexpected system termination , representing a denial-of-service impact with no confidentiality or integrity loss. The NVD-assigned CVSS 3.1 score is 5.5 (Medium) with a vector of A...

CVE-2026-84560

An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An app may gain unauthorized access to Bluetooth.

CVE-2026-84588

A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory.

CVE-2026-84596

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted font may result in the disclosure of process memory.

CVE-2026-65352

An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 26.6.1. A website may be able to determine a user's IP address with Private Relay turned on.

CVE-2026-84491

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to access sensitive user data.