SB2026021189 - Multiple vulnerabilities in macOS Sequoia
Published: February 11, 2026 Updated: March 25, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 37 secuirty vulnerabilities.
1) Information exposure through log files (CVE-ID: CVE-2026-20619)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to inclusion of sensitive information into a log file in System Settings. A local application can access sensitive user data.
2) Permissions, privileges, and access controls (CVE-ID: CVE-2026-20628)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to improperly imposed security restrictions in Sandbox. A local application can break out of its sandbox.
3) Improper access control (CVE-ID: CVE-2025-46290)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper access restrictions in Security. A remote attacker can trick the victim into opening a specially crafted file and cause a denial-of-service.
4) Improper limitation of a pathname to a restricted directory ('path traversal') (CVE-ID: CVE-2026-20653)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to incorrect handling of path names in Shortcuts. A local application can trick the victim into opening a specially crafted file and access sensitive user data.
5) State issues (CVE-ID: CVE-2026-20662)
The vulnerability allows an attacker with physical access to the system to gain access to sensitive information.
The vulnerability exists due to a state management issue in Siri. An attacker with physical access to the system can view sensitive user information.
6) Information disclosure (CVE-ID: CVE-2026-20680)
The vulnerability allows a local application to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output in Spotlight. A local application can access sensitive user data.
7) Improper access control (CVE-ID: CVE-2026-20612)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in Spotlight. A local application can access sensitive user data.
8) Information disclosure (CVE-ID: CVE-2026-20641)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to excessive data output by StoreKit. A local application can identify what other apps a user has installed.
9) Protection Mechanism Failure (CVE-ID: CVE-2026-20606)
The vulnerability allows a local application to bypass privacy preferences.
The vulnerability exists due to insufficient implementation of security measures in UIKit. A local application can bypass certain Privacy preferences.
10) State Issues (CVE-ID: CVE-2025-46310)
The vulnerability allows a local user to delete protected system files.
The vulnerability exists due to a state issue in PackageKit. A local user with root privileges can delete protected system files.
11) Memory corruption (CVE-ID: CVE-2026-20605)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in Voice Control. A local application can crash a system process.
12) Memory corruption (CVE-ID: CVE-2026-20621)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error in Wi-Fi. A local application can cause unexpected system termination or corrupt kernel memory.
13) Memory corruption (CVE-ID: CVE-2025-43402)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error in WindowServer. A local application can cause unexpected system termination or corrupt process memory.
14) Improper input validation (CVE-ID: CVE-2026-20602)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation in WindowServer. A local application can cause a denial-of-service.
15) Improper limitation of a pathname to a restricted directory ('path traversal') (CVE-ID: CVE-2026-20614)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to incorrect handling of path names in Remote Management. A local application can gain root privileges.
16) Buffer overflow (CVE-ID: CVE-2025-46305)
The vulnerability allows an attacker to perform a denial of service attack.
The vulnerability exists due to a boundary error in Multi-Touch. An attacker with physical access to device can attach a malicious HID device to the system, trigger memory corruption and perform a denial of service attack.
17) Improper input validation (CVE-ID: CVE-2026-20624)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to insufficient input validation in AppleMobileFileIntegrity. A local application can access sensitive user data.
18) Man-in-the-Middle (MitM) attack (CVE-ID: CVE-2026-20671)
The vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists due to a logic issue in the OS kernel. A remote attacker on the local network can intercept network traffic.
19) Improper limitation of a pathname to a restricted directory ('path traversal') (CVE-ID: CVE-2026-20625)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to incorrect handling of path names in AppleMobileFileIntegrity. A local application can trick the victim into opening a specially crafted file and access sensitive user data.
20) State issues (CVE-ID: CVE-2025-43403)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a state management issue in Compression. A local application can access sensitive user data.
21) Out-of-bounds write (CVE-ID: CVE-2026-20611)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error when decoding audio APAC frames. A remote attacker can create a specially crafted audio file, trick the victim into opening it using the affected software, trigger an out-of-bounds write and execute arbitrary code on the target system.
22) Memory corruption (CVE-ID: CVE-2026-20609)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in CoreMedia. A remote attacker can trick the victim into opening a specially crafted file and perform a denial-of-service or potentially disclose memory contents.
23) Out-of-bounds read (CVE-ID: CVE-2026-20620)
The vulnerability allows a local aplication to gain access to potentially sensitive information or crash the system.
The vulnerability exists due to a boundary condition in GPU drivers. A local application can trigger an out-of-bounds read error and read contents of kernel memory or crash the system.
24) Out-of-bounds read (CVE-ID: CVE-2026-20634)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition when parsing SGI images within the ImageIO framework. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.
25) Integer overflow (CVE-ID: CVE-2026-20675)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to integer overflow when parsing SGI files. A remote attacker can trick the victim into opening a specially crafted file, trigger an integer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
26) Improper access control (CVE-ID: CVE-2026-20626)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to improper access restrictions in Kernel. A local application can gain root privileges.
27) Buffer overflow (CVE-ID: CVE-2025-46304)
The vulnerability allows an attacker to perform a denial of service attack.
The vulnerability exists due to a boundary error in Multi-Touch. An attacker with physical access to device can attach a malicious HID device to the system, trigger memory corruption and perform a denial of service attack.
28) Resource exhaustion (CVE-ID: CVE-2025-59375)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger large dynamic memory allocations via a small document and perform a denial of service (DoS) attack.
29) Improper access control (CVE-ID: CVE-2026-20667)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to improper access restrictions in libxpc. A local application can break out of its sandbox.
30) Protection Mechanism Failure (CVE-ID: CVE-2026-20673)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient implementation of security measures in Mail. Turning off the "Load remote content in messages" may not apply to all mail previews, leading to information exposure.
31) Buffer overflow (CVE-ID: CVE-2025-43533)
The vulnerability allows an attacker to perform a denial of service attack.
The vulnerability exists due to a boundary error in Multi-Touch. An attacker with physical access to device can attach a malicious HID device to the system, trigger memory corruption and perform a denial of service attack.
32) Buffer overflow (CVE-ID: CVE-2025-46300)
The vulnerability allows an attacker to perform a denial of service attack.
The vulnerability exists due to a boundary error in Multi-Touch. An attacker with physical access to device can attach a malicious HID device to the system, trigger memory corruption and perform a denial of service attack.
33) Buffer overflow (CVE-ID: CVE-2025-46301)
The vulnerability allows an attacker to perform a denial of service attack.
The vulnerability exists due to a boundary error in Multi-Touch. An attacker with physical access to device can attach a malicious HID device to the system, trigger memory corruption and perform a denial of service attack.
34) Buffer overflow (CVE-ID: CVE-2025-46302)
The vulnerability allows an attacker to perform a denial of service attack.
The vulnerability exists due to a boundary error in Multi-Touch. An attacker with physical access to device can attach a malicious HID device to the system, trigger memory corruption and perform a denial of service attack.
35) Buffer overflow (CVE-ID: CVE-2025-46303)
The vulnerability allows an attacker to perform a denial of service attack.
The vulnerability exists due to a boundary error in Multi-Touch. An attacker with physical access to device can attach a malicious HID device to the system, trigger memory corruption and perform a denial of service attack.
36) Improper link resolution before file access ('link following') (CVE-ID: CVE-2026-20694)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to insecure symbolic link following in MigrationKit. A local application can access user-sensitive data.
37) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-20622)
The vulnerability allows a local application to capture user's screen
The vulnerability exists due to incorrect handling of temporary files in Shortcuts. A local application can capture user's screen.
Remediation
Install update from vendor's website.