Threat database

A buffer overflow was addressed with improved size validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination.

The issue was addressed with improved handling of secure input state. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data.

A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A malicious application may be able to bypass Privacy preferences.

An access issue was addressed with improved access controls. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data.

CVE-2026-28854 is a vulnerability in Apple macOS where a maliciously modified app may not be prevented from launching due to insufficient app bundle integrity checks. This issue has been addressed and fixed in macOS Golden Gate 27.

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to elevate privileges.

An authorization issue was addressed with improved state management. This issue is fixed in visionOS 27. An app may be able to access sensitive user data.

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

CVE-2026-65388 is a vulnerability in Apple's containerization software that allows a remote attacker controlling a container registry to redirect a client's token request to an attacker-chosen host, potentially exposing the victim's registry credentials. This issue affects versions prior to 0.41.0 and has been addressed in version 0.41.0.

CVE-2026-65409 is a type confusion vulnerability in Apple iOS and iPadOS that could allow an app to cause a denial of service. The issue was addressed with improved memory handling and fixed in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and related Apple operating systems. The vulnerability does not impact confidentiality or integrity but can disrupt availability by causing a crash or denial of service.

CVE-2026-84559 is a medium severity vulnerability in Apple macOS where a permissions issue could allow a malicious application to access restricted files. The issue was addressed by improved validation and fixed in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7.

CVE-2026-28960 is a denial-of-service vulnerability in Apple iOS and iPadOS that allows a remote attacker to cause a denial-of-service condition. The issue was addressed by improved validation and is fixed in iOS and iPadOS version 18.7.10.

CVE-2026-43741 is a logic issue in Apple macOS that could allow an app to access protected user data. The vulnerability was addressed by improved state management and is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. The issue has a medium severity rating with a CVSS score of 5.5.

This issue was addressed through improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to access sensitive user data.

CVE-2026-86876 is a medium severity vulnerability in Apple iOS and iPadOS involving an out-of-bounds write that could allow a sandboxed process to bypass sandbox restrictions. The issue was fixed by improved bounds checking in iOS 26.7 and iPadOS 26.7, as well as other Apple operating systems. Exploitation requires local privileges and no user interaction is needed. The vulnerability impacts confidentiality and integrity but not availability.

CVE-2026-84518 is a medium severity vulnerability in Apple Safari that could allow a malicious website to determine which apps a user has installed. This issue was addressed through improved state management and fixed in Safari 27, iOS 27, iPadOS 27, and macOS Golden Gate 27.

CVE-2026-84631 is a high-severity vulnerability in Apple macOS that could allow an application to gain root privileges. The issue was addressed by adding additional entitlement checks and is fixed in macOS Golden Gate 27. This vulnerability affects versions prior to 27.

A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination.

A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. Extracting a maliciously crafted archive may allow an attacker to write arbitrary files.

CVE-2026-43690 is a medium severity vulnerability in Apple macOS where a local user may read kernel memory due to a race condition. The issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7 by improved locking mechanisms.