Apple macOS vulnerabilities

CVE-2025-43496 [HIGH] CWE-359 CVE-2025-43496: The issue was addressed by adding additional logic. This issue is fixed in iOS 18.7.2 and iPadOS 18. The issue was addressed by adding additional logic. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. Remote content may be loaded even when the 'Load Remote Images' setting is turned off.

CVE-2025-43500 [HIGH] CWE-359 CVE-2025-43500: A privacy issue was addressed with improved handling of user preferences. This issue is fixed in iOS A privacy issue was addressed with improved handling of user preferences. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. An app may be able to access sensitive user data.

CVE-2025-43232 [CRITICAL] CWE-284 CVE-2025-43232: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to bypass certain Privacy preferences.

CVE-2025-24269 [CRITICAL] CWE-400 CVE-2025-24269: The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4. An The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4. An app may be able to cause unexpected system termination.

CVE-2025-43233 [CRITICAL] CWE-284 CVE-2025-43233: This issue was addressed with improved access restrictions. This issue is fixed in macOS Sequoia 15. This issue was addressed with improved access restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. A malicious app acting as a HTTPS proxy could get access to sensitive user data.

CVE-2025-30460 [HIGH] CWE-284 CVE-2025-30460: A permissions issue was addressed by removing vulnerable code and adding additional checks. This iss A permissions issue was addressed by removing vulnerable code and adding additional checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to access protected user data.

CVE-2026-28969 [HIGH] CWE-416 CVE-2026-28969: A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18. A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination.

CVE-2026-28906 [HIGH] CWE-359 CVE-2026-28906: This issue was addressed through improved state management. This issue is fixed in iOS 18.7.9 and iP This issue was addressed through improved state management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, visionOS 26.5. An attacker may be able to track users through their IP address.

CVE-2026-20701 [HIGH] CWE-693 CVE-2026-20701: An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Seq An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to connect to a network share without user consent.

CVE-2026-28860 [HIGH] CWE-20 CVE-2026-28860: The issue was addressed with improved input validation. This issue is fixed in iOS 18.7.7 and iPadOS The issue was addressed with improved input validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. A local attacker may be able to modify the state of the Keychain.

CVE-2026-43654 [HIGH] CWE-497 CVE-2026-43654: The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to disclose kernel memory.

CVE-2026-28837 [HIGH] CWE-284 CVE-2026-28837: A logic issue was addressed with improved checks. This issue is fixed in macOS Tahoe 26.4. An app ma A logic issue was addressed with improved checks. This issue is fixed in macOS Tahoe 26.4. An app may be able to access sensitive user data.

CVE-2026-28990 [HIGH] CWE-119 CVE-2026-28990: The issue was addressed with improved memory handling. This issue is fixed in iOS 26.5 and iPadOS 26 The issue was addressed with improved memory handling. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing a maliciously crafted image may corrupt process memory.

CVE-2024-44286 [HIGH] CWE-288 CVE-2024-44286: This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15. This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.1. An attacker with physical access can input keyboard events to apps running on a locked device.

CVE-2026-20622 [HIGH] CWE-284 CVE-2026-20622: A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macO A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sequoia 15.7.4, macOS Tahoe 26.3. An app may be able to capture a user's screen.

CVE-2026-43728 [HIGH] CWE-362 CVE-2026-43728: This issue was addressed through improved state management. This issue is fixed in macOS Tahoe 26.6. This issue was addressed through improved state management. This issue is fixed in macOS Tahoe 26.6. An attacker may be able to modify the state of the Keychain.

CVE-2026-64738 [CRITICAL] CWE-284 CVE-2026-64738: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious app may be able to break out of its sandbox.

CVE-2026-28827 [CRITICAL] CWE-22 CVE-2026-28827: A parsing issue in the handling of directory paths was addressed with improved path validation. This A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to break out of its sandbox.

CVE-2026-20688 [CRITICAL] CWE-22 CVE-2026-20688: A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.4 and iP A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, visionOS 26.4. An app may be able to break out of its sandbox.

CVE-2025-31263 [CRITICAL] CWE-119 CVE-2025-31263: The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4. An The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4. An app may be able to corrupt coprocessor memory.