CVE-2026-65374
published 2026-09-14CVE-2026-65374: A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Connecting…
PriorityP351high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.53%
43.9th percentile
A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Connecting to a malicious WebDAV server may result in code execution.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | macos | < 15.8 | 15.8 |
| apple | macos | < 26.7 | 26.7 |
| apple | macos | < 27 | 27 |
| apple | macos | >= 15.0 < 15.8 | 15.8 |
| apple | macos | >= 26.0 < 26.7 | 26.7 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apple macOS up to 15.7/26/26.6 WebDAV memory corruption
vuldb·2026-09-20·CVSS 8.8
CVE-2026-65374 [HIGH] Apple macOS up to 15.7/26/26.6 WebDAV memory corruption
A vulnerability was found in Apple macOS up to 15.7/26/26.6. It has been classified as very critical. The affected element is an unknown function of the component WebDAV Handler. This manipulation causes memory corruption.
The identification of this vulnerability is CVE-2026-65374. It is possible to initiate the attack remotely. There is no exploit available.
Upgrading the affected component is recommended.
GHSA
A memory corruption issue was addressed with improved validation.
ghsa_unreviewed·2026-09-14
CVE-2026-65374 [HIGH] CWE-787 A memory corruption issue was addressed with improved validation.
A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Connecting to a malicious WebDAV server may result in code execution.
No detection rules found.
No public exploits indexed.
2026-09-14
Published