Threat database

An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, tvOS 27, visionOS 27. An app may be able to access sensitive user data.

CVE-2026-43677 is an out-of-bounds write vulnerability in Apple macOS that could cause unexpected application termination when connecting to a malicious WebDAV server. The issue was addressed by removing the vulnerable code and is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. The vulnerability has a medium severity rating with a CVSS score of 6.5.

This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Golden Gate 27. An app may be able to break out of its sandbox.

A permissions issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data.

A heap buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Mounting a maliciously crafted volume may lead to unexpected system termination.

CVE-2026-86891 is an authorization issue in Apple macOS that could allow an app to access Bluetooth device information without proper permission. The issue was addressed by improved state management and fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and watchOS 27. The vulnerability has a low severity rating and a CVSS score of 3.5.

CVE-2026-28968 is an out-of-bounds write vulnerability in Apple iOS and iPadOS that could allow an app to cause unexpected system termination or corrupt kernel memory. The issue was addressed by improved bounds checking and fixed in iOS 26.7 and later, iPadOS 26.7 and later, and other Apple operating systems. The vulnerability has a medium severity rating with a CVSS score of 5.5.

A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A malicious app may be able to break out of its sandbox.

A logic issue in Apple iOS and iPadOS allows an app to potentially bypass network restrictions. This vulnerability has been addressed with improved validation and fixed in iOS 27 and iPadOS 27. The issue affects versions prior to 27. The CVSS score is 4.4, indicating a medium severity level.

CVE-2026-65401 is a medium severity vulnerability in Apple macOS involving a race condition that could allow an application to cause unexpected system termination. The issue is addressed with improved state handling and fixed in macOS Golden Gate 27 and macOS Tahoe 26.7. It does not impact confidentiality or integrity but affects system availability.

CVE-2026-65378 is an authorization issue in Apple macOS that could allow an app to access sensitive user data. The vulnerability was addressed with improved state management and fixed in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. It has a medium severity rating with a CVSS score of 5.5.

CVE-2026-84506 is a use-after-free vulnerability in Apple macOS that could allow an application to cause unexpected system termination or corrupt kernel memory. The issue is addressed by improved memory management and fixed in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. The vulnerability has a high severity rating with a CVSS score of 7.8.

CVE-2026-64752 is a high-severity memory corruption vulnerability in Apple iOS and iPadOS that could allow arbitrary code execution when processing a maliciously crafted image. The issue was addressed by removing the vulnerable code and is fixed in iOS 27 and iPadOS 27. Versions prior to 27 are affected.

A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, visionOS 27. An app may be able to bypass certain Privacy preferences.

CVE-2026-43790 is a critical vulnerability in Apple macOS that allows a remote attacker to cause unexpected system termination or corrupt kernel memory. The issue is related to improper memory handling in the kernel. Apple has fixed this vulnerability in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7.

CVE-2026-65358 is a medium severity vulnerability in Apple iOS, iPadOS, and related operating systems caused by a race condition that may allow an app to cause unexpected system termination. The issue affects versions prior to iOS 27, iPadOS 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Apple has fixed the vulnerability in these versions by improving state handling to address the race condition.

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may lead to unexpected app termination.