Apple macOS vulnerabilities

CVE-2026-20658 [HIGH] CVE-2026-20658: A package validation issue was addressed by blocking the vulnerable package. This issue is fixed in A package validation issue was addressed by blocking the vulnerable package. This issue is fixed in macOS Tahoe 26.3. An app may be able to gain root privileges.

CVE-2026-43711 [HIGH] CWE-119 CVE-2026-43711: A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 26 A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted video file may lead to unexpected app termination.

CVE-2026-20626 [HIGH] CWE-862 CVE-2026-20626: This issue was addressed with improved checks. This issue is fixed in iOS 26.3 and iPadOS 26.3, macO This issue was addressed with improved checks. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Tahoe 26.3, visionOS 26.3. A malicious app may be able to gain root privileges.

CVE-2025-31272 [HIGH] CWE-269 CVE-2025-31272: The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. An app may The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. An app may be able to bypass launch constraint protections and execute malicious code with elevated privileges.

CVE-2026-39874 [HIGH] CWE-276 CVE-2026-39874: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious app may be able to gain root privileges.

CVE-2025-46290 [HIGH] CWE-693 CVE-2025-46290: A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.3 and iPadOS 18.7. A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.2, visionOS 26.2, watchOS 26.2. A remote attacker may be able to cause a denial-of-service.

CVE-2019-8767 [CRITICAL] CWE-787 CVE-2019-8767: A memory consumption issue was addressed with improved memory handling. This issue is fixed in macOS A memory consumption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006, macOS Catalina 10.15. Processing a maliciously crafted string may lead to heap corruption.

CVE-2025-31213 [HIGH] CWE-532 CVE-2025-31213: A logging issue was addressed with improved data redaction. This issue is fixed in iPadOS 17.7.7, ma A logging issue was addressed with improved data redaction. This issue is fixed in iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An app may be able to access associated usernames and websites in a user's iCloud Keychain.

CVE-2026-28865 [HIGH] CWE-285 CVE-2026-28865: An authentication issue was addressed with improved state management. This issue is fixed in iOS 18. An authentication issue was addressed with improved state management. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. An attacker in a privileged network position may be able to intercept network traffic.

CVE-2025-24250 [CRITICAL] CWE-200 CVE-2025-24250: This issue was addressed with improved access restrictions. This issue is fixed in macOS Sequoia 15. This issue was addressed with improved access restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicious app acting as a HTTPS proxy could get access to sensitive user data.

CVE-2025-24246 [CRITICAL] CWE-200 CVE-2025-24246: An injection issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.4 An injection issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to access user-sensitive data.

CVE-2026-28896 [HIGH] CWE-119 CVE-2026-28896: The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. An attacker may be able to cause unexpected system termination or read kernel memory.

CVE-2026-43661 [HIGH] CWE-121 CVE-2026-43661: A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 26.5 A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. Processing a maliciously crafted image may corrupt process memory.

CVE-2026-28959 [HIGH] CWE-120 CVE-2026-28959: A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination.

CVE-2026-20639 [HIGH] CWE-190 CVE-2026-20639: An integer overflow was addressed with improved input validation. This issue is fixed in macOS Sequo An integer overflow was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.3. Processing a maliciously crafted string may lead to heap corruption.

CVE-2025-24260 [CRITICAL] CWE-400 CVE-2025-24260: The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4, ma The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An attacker in a privileged position may be able to perform a denial-of-service.

CVE-2023-40393 [HIGH] CWE-306 CVE-2023-40393: An authentication issue was addressed with improved state management. This issue is fixed in iOS 17 An authentication issue was addressed with improved state management. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. Photos in the Hidden Photos Album may be viewed without authentication.

CVE-2025-30462 [CRITICAL] CWE-284 CVE-2025-30462: A library injection issue was addressed with additional restrictions. This issue is fixed in macOS S A library injection issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. Apps that appear to use App Sandbox may be able to launch without restrictions.

CVE-2026-43777 [HIGH] CWE-20 CVE-2026-43777: This issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.8 This issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A remote attacker may be able to cause a denial of service.

CVE-2025-43222 [CRITICAL] CWE-416 CVE-2025-43222: A use-after-free issue was addressed by removing the vulnerable code. This issue is fixed in iPadOS A use-after-free issue was addressed by removing the vulnerable code. This issue is fixed in iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An attacker may be able to cause unexpected app termination.