Apple macOS vulnerabilities

CVE-2025-46315 [HIGH] CWE-284 CVE-2025-46315: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 2 A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to access protected user data.

CVE-2026-20649 [HIGH] CWE-377 CVE-2026-20649: A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.3 and iPad A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, watchOS 26.3. A user may be able to view sensitive user information.

CVE-2025-24263 [CRITICAL] CWE-200 CVE-2025-24263: A privacy issue was addressed by moving sensitive data to a protected location. This issue is fixed A privacy issue was addressed by moving sensitive data to a protected location. This issue is fixed in macOS Sequoia 15.4. An app may be able to observe unprotected user data.

CVE-2026-43793 [CRITICAL] CWE-20 CVE-2026-43793: An issue existed in the handling of environment variables. This issue was addressed with improved va An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpected system termination.

CVE-2023-40436 [CRITICAL] CWE-125 CVE-2023-40436: The issue was addressed with improved bounds checks. This issue is fixed in macOS Sonoma 14. An atta The issue was addressed with improved bounds checks. This issue is fixed in macOS Sonoma 14. An attacker may be able to cause unexpected system termination or read kernel memory.

CVE-2026-64740 [CRITICAL] CWE-22 CVE-2026-64740: A parsing issue in the handling of directory paths was addressed with improved path validation. This A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6. A malicious app may be able to break out of its sandbox.

CVE-2020-36223 [HIGH] CWE-125 CVE-2020-36223: A flaw was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Values Return Filter A flaw was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Values Return Filter control handling, resulting in denial of service (double free and out-of-bounds read).

CVE-2020-36229 [HIGH] CWE-843 CVE-2020-36229: A flaw was discovered in ldap_X509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X. A flaw was discovered in ldap_X509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X.509 DN parsing in ad_keystring, resulting in denial of service.

CVE-2020-36226 [HIGH] CVE-2020-36226: A flaw was discovered in OpenLDAP before 2.4.57 leading to a memch->bv_len miscalculation and slapd A flaw was discovered in OpenLDAP before 2.4.57 leading to a memch->bv_len miscalculation and slapd crash in the saslAuthzTo processing, resulting in denial of service.

CVE-2023-32364 [HIGH] CVE-2023-32364: A logic issue was addressed with improved restrictions. This issue is fixed in macOS Ventura 13.5. A A logic issue was addressed with improved restrictions. This issue is fixed in macOS Ventura 13.5. A sandboxed process may be able to circumvent sandbox restrictions.

CVE-2020-9794 [HIGH] CWE-125 CVE-2020-9794: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.5 a An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. A malicious application may cause a denial of service or potentially disclose memory contents.

CVE-2024-54514 [HIGH] CVE-2024-54514: The issue was addressed with improved checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS The issue was addressed with improved checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2, tvOS 18.2, watchOS 11.2. An app may be able to break out of its sandbox.

CVE-2024-23299 [HIGH] CWE-250 CVE-2024-23299: The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.4, macOS So The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. An app may be able to break out of its sandbox.

CVE-2022-1720 [HIGH] CWE-126 CVE-2022-1720: Buffer Over-read in function grab_file_name in GitHub repository vim/vim prior to 8.2.4956. This vul Buffer Over-read in function grab_file_name in GitHub repository vim/vim prior to 8.2.4956. This vulnerability is capable of crashing the software, memory modification, and possible remote execution.

CVE-2020-9905 [HIGH] CWE-120 CVE-2020-9905: A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and i A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8. A remote attacker may be able to cause a denial of service.

CVE-2020-9941 [HIGH] CVE-2020-9941: This issue was addressed with improved checks. This issue is fixed in macOS Catalina 10.15.7, Securi This issue was addressed with improved checks. This issue is fixed in macOS Catalina 10.15.7, Security Update 2020-005 High Sierra, Security Update 2020-005 Mojave. A remote attacker may be able to unexpectedly alter application state.

CVE-2022-32798 [HIGH] CWE-787 CVE-2022-32798: An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in ma An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.5. An app may be able to gain elevated privileges.

CVE-2021-30684 [HIGH] CVE-2021-30684: A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11. A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina. A remote attacker may cause an unexpected application termination or arbitrary code execution.

CVE-2025-24137 [HIGH] CWE-843 CVE-2025-24137: A type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.3 and iPadO A type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3, tvOS 18.3, visionOS 2.3. An attacker on the local network may corrupt process memory.

CVE-2019-8549 [HIGH] CWE-20 CVE-2019-8549: Multiple input validation issues existed in MIG generated code. These issues were addressed with imp Multiple input validation issues existed in MIG generated code. These issues were addressed with improved validation. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. A malicious application may be able to execute arbitrary code with system privileges.