Apple macOS vulnerabilities

CVE-2023-32380 [HIGH] CWE-787 CVE-2023-32380: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in mac An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.7.7, macOS Monterey 12.6.6, macOS Ventura 13.4. Processing a 3D model may lead to arbitrary code execution.

CVE-2025-43298 [HIGH] CWE-41 CVE-2025-43298: A parsing issue in the handling of directory paths was addressed with improved path validation. This A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to gain root privileges.

CVE-2025-24119 [HIGH] CWE-269 CVE-2025-24119: This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15. This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges.

CVE-2026-20610 [HIGH] CWE-59 CVE-2026-20610: This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Tahoe 26.3 This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Tahoe 26.3. An app may be able to gain root privileges.

CVE-2026-43698 [HIGH] CWE-88 CVE-2026-43698: An injection issue was addressed with improved validation. This issue is fixed in macOS Golden Gate An injection issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.7. An app may be able to gain root privileges.

CVE-2023-40396 [HIGH] CWE-77 CVE-2023-40396: The issue was addressed with improved memory handling. This issue is fixed in iOS 17 and iPadOS 17, The issue was addressed with improved memory handling. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14, watchOS 10, tvOS 17. An app may be able to execute arbitrary code with kernel privileges.

CVE-2026-64747 [HIGH] CWE-120 CVE-2026-64747: A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 18.7.10 an A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to execute arbitrary code with kernel privileges.

CVE-2026-43776 [HIGH] CWE-120 CVE-2026-43776: A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 an A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.

CVE-2025-46285 [HIGH] CWE-190 CVE-2025-46285: An integer overflow was addressed by adopting 64-bit timestamps. This issue is fixed in iOS 18.7.3 a An integer overflow was addressed by adopting 64-bit timestamps. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. An app may be able to gain root privileges.

CVE-2026-43723 [HIGH] CWE-22 CVE-2026-43723: A path handling issue was addressed with improved validation. This issue is fixed in iOS 18.7.10 and A path handling issue was addressed with improved validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to gain root privileges.

CVE-2026-20615 [HIGH] CWE-22 CVE-2026-20615: A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.3 and iP A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3, visionOS 26.3. An app may be able to gain root privileges.

CVE-2026-20614 [HIGH] CWE-22 CVE-2026-20614: A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 1 A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3. An app may be able to gain root privileges.

CVE-2026-64765 [HIGH] CWE-190 CVE-2026-64765: An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.10 An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.

CVE-2026-64766 [HIGH] CWE-190 CVE-2026-64766: An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.10 An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.

CVE-2026-43783 [HIGH] CWE-362 CVE-2026-43783: A race condition was addressed with improved locking. This issue is fixed in macOS Tahoe 26.6. A mal A race condition was addressed with improved locking. This issue is fixed in macOS Tahoe 26.6. A malicious app may be able to gain root privileges.

CVE-2025-24266 [CRITICAL] CWE-120 CVE-2025-24266: A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to cause unexpected system termination.

CVE-2025-43376 [HIGH] CVE-2025-43376: A logic issue was addressed with improved state management. This issue is fixed in Safari 26, iOS 18 A logic issue was addressed with improved state management. This issue is fixed in Safari 26, iOS 18.7.7 and iPadOS 18.7.7, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. A remote attacker may be able to view leaked DNS queries with Private Relay turned on.

CVE-2026-28865 [HIGH] CWE-285 CVE-2026-28865: An authentication issue was addressed with improved state management. This issue is fixed in iOS 18. An authentication issue was addressed with improved state management. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. An attacker in a privileged network position may be able to intercept network traffic.

CVE-2024-44195 [HIGH] CWE-22 CVE-2024-44195: A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.1. An A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.1. An app may be able to read arbitrary files.

CVE-2024-54465 [CRITICAL] CWE-281 CVE-2024-54465: A logic issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15. A logic issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.2. An app may be able to elevate privileges.