SB2026091502 - Multiple vulnerabilities in macOS Sequoia

Description

This security bulletin contains information about 154 vulnerabilities.

1) Out-of-bounds write (CVE-ID: CVE-2026-86882)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds write in Accelerate Framework. A remote attacker can trick the victim into opening a specially crafted file and perform unexpected process termination.

2) Exposure of sensitive information to an unauthorized actor (CVE-ID: CVE-2026-43664)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to excessive data output in Accessibility. A local application can access sensitive user data.

3) Improper input validation (CVE-ID: CVE-2026-86910)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to an unspecified flaw in APFS when a local application accesses filesystem data. A local user can exploit the flaw to gain access to sensitive information.

4) Out-of-bounds write (CVE-ID: CVE-2026-84523)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to an out-of-bounds write in APFS. A local application can cause unexpected system termination or write kernel memory.

5) Permissions, privileges, and access controls (CVE-ID: CVE-2026-84587)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improperly imposed security restrictions in AppKit. A local application can access protected user data.

6) State issues (CVE-ID: CVE-2026-20683)

CWE-ID: CWE-371 - State Issues

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a state management issue in Apple Account. A local application can use the Sign In With Apple authentication flow to access the user\'s Apple Account.

7) Improper input validation (CVE-ID: CVE-2026-65408)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation in Apple Neural Engine. A local application can cause unexpected system termination.

8) Use after free (CVE-ID: CVE-2026-65407)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error in AppleAVD. A local application can cause unexpected system termination.

9) Out-of-bounds write (CVE-ID: CVE-2026-84519)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds write in AppleDouble. A remote attacker can trick the victim into opening a specially crafted file and perform unexpected system termination.

10) Improper input validation (CVE-ID: CVE-2026-65381)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to insufficient input validation in AppleMobileFileIntegrity. A local application can break out of its sandbox.

11) Improper input validation (CVE-ID: CVE-2026-43763)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to insufficient input validation in ATS. A local application can trick the victim into opening a specially crafted file and read files outside of its sandbox.

12) Information exposure through log files (CVE-ID: CVE-2026-84525)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to inclusion of sensitive information into a log file in ATS. A local application can access user-sensitive data.

13) Improper input validation (CVE-ID: CVE-2026-65342)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to insufficient input validation in ATS. A local application can access sensitive user data.

14) Improper access control (CVE-ID: CVE-2026-65339)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper access control in Audio when handling local application access. A local user can access the vulnerable component to escalate privileges.

15) Permissions, privileges, and access controls (CVE-ID: CVE-2026-84583)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improperly imposed security restrictions in AuthKit. A local application can read a persistent account identifier.

16) Improper input validation (CVE-ID: CVE-2026-84568)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to an unspecified flaw in autofs when it is used. A local user can exploit the vulnerability to escalate privileges on the system.

17) Improper access control (CVE-ID: CVE-2026-84570)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in autofs. A local application can bypass Gatekeeper checks.

18) State issues (CVE-ID: CVE-2026-84535)

CWE-ID: CWE-371 - State Issues

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a state management issue in Automator. A local application can break out of its sandbox.

19) Memory corruption (CVE-ID: CVE-2026-84616)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in AVEVideoEncoder. A local application can cause unexpected system termination.

20) State issues (CVE-ID: CVE-2026-84607)

CWE-ID: CWE-371 - State Issues

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a state management issue in AVEVideoEncoder. A local application can execute arbitrary code with kernel privileges.

21) Improper input validation (CVE-ID: CVE-2026-65406)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to insufficient input validation in BackgroundAssets. A local application can access sensitive user data.

22) Out-of-bounds write (CVE-ID: CVE-2026-65414)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds write in Bluetooth. A remote attacker can trick the victim into opening a specially crafted file and cause unexpected app termination or arbitrary code execution.

23) Memory corruption (CVE-ID: CVE-2026-84567)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in cd9660. A local application can cause unexpected system termination.

24) Protection mechanism failure (CVE-ID: CVE-2026-65399)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to insufficient implementation of security measures in copyfile when copying data from an archive. A local user can bypass a file quarantine and bypass implemented security restrictions. 

25) State issues (CVE-ID: CVE-2026-86891)

CWE-ID: CWE-371 - State Issues

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a state management issue in Core Bluetooth. A local application can access Bluetooth device information.

26) Memory corruption (CVE-ID: CVE-2026-43683)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in CoreDrag. A local application can cause unexpected process termination or disclose process memory.

27) Improper access control (CVE-ID: CVE-2026-43789)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in CoreMedia. A local application can access user-sensitive data.

28) Out-of-bounds write (CVE-ID: CVE-2026-65344)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds write in CoreMedia. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.

29) Out-of-bounds write (CVE-ID: CVE-2026-86876)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to an out-of-bounds write in CoreMedia when processing media content. A local user can trigger the out-of-bounds write to bypass implemented security restrictions.

30) Memory corruption (CVE-ID: CVE-2026-43702)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error in CoreMedia Video Toolbox. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination or corrupt process memory.

31) Improper input validation (CVE-ID: CVE-2026-84624)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to an unspecified flaw in CoreML when a local application interacts with the component. A local user can use a local application to escalate privileges on the system.

32) Improper input validation (CVE-ID: CVE-2026-43737)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to insufficient input validation in CoreMotion. A local application can access motion data from headphones without user consent.

33) Protection mechanism failure (CVE-ID: CVE-2026-84574)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to bypass privacy preferences.

The vulnerability exists due to insufficient implementation of security measures in CoreServices. A local application can bypass privacy preferences.

34) Improper input validation (CVE-ID: CVE-2026-84559)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to insufficient input validation in CoreServices. A local application can trick the victim into opening a specially crafted file and access restricted files.

35) Improper access control (CVE-ID: CVE-2026-43786)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improper access restrictions in CoreServices. A local application can gain root privileges.

36) Improper input validation (CVE-ID: CVE-2026-65412)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation in CoreText. A remote attacker can trick the victim into opening a specially crafted file and perform a denial-of-service.

37) Out-of-bounds write (CVE-ID: CVE-2026-84575)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds write in CoreUI. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.

38) Out-of-bounds write (CVE-ID: CVE-2026-84511)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds write in CoreUI. A remote attacker can trick the victim into opening a specially crafted file and perform unexpected process termination.

39) Improper access control (CVE-ID: CVE-2026-84563)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to improper access restrictions in CUPS. A local application can cause unexpected system termination.

40) State issues (CVE-ID: CVE-2026-84540)

CWE-ID: CWE-371 - State Issues

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a state management issue in CUPS. A local application can access sensitive user data.

41) Improper input validation (CVE-ID: CVE-2026-84554)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in CUPS when processing input. A remote attacker can provide crafted input to cause a denial of service.

42) Improper input validation (CVE-ID: CVE-2026-43692)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an unspecified flaw in CUPS when interacting with CUPS from a local application. A local user can execute a local application to cause a denial of service.

43) Improper limitation of a pathname to a restricted directory ('path traversal') (CVE-ID: CVE-2026-64790)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to incorrect handling of path names in CUPS. A local application can gain elevated privileges.

44) Improper limitation of a pathname to a restricted directory ('path traversal') (CVE-ID: CVE-2026-43691)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to incorrect handling of path names in CUPS. A local application can gain root privileges.

45) Memory corruption (CVE-ID: CVE-2026-84516)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in CUPS. A local application can trick the victim into opening a specially crafted file and perform a denial of service (DoS) attack.

46) Improper input validation (CVE-ID: CVE-2026-84541)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to insufficient input validation in CUPS. A local application can trick the victim into opening a specially crafted file and access restricted files.

47) Information disclosure (CVE-ID: CVE-2026-84612)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to an unspecified flaw in DeviceCheck when used by a local application. A local user can use a local application to gain access to sensitive information.

48) Out-of-bounds write (CVE-ID: CVE-2026-84505)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to an out-of-bounds write in Directory Utility. A local application can gain root privileges.

49) Memory corruption (CVE-ID: CVE-2026-84565)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in Disk Images. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.

50) Memory corruption (CVE-ID: CVE-2026-84552)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in Disk Images. A local application can cause unexpected system termination.

51) Improper input validation (CVE-ID: CVE-2026-84550)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service (DoS).

The vulnerability exists due to an unspecified flaw in Disk Images when a local application interacts with Disk Images. A local user can use a local application to cause a denial of service (DoS).

52) Improper access control (CVE-ID: CVE-2026-65362)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improper access restrictions in Disk Images. A local application can gain root privileges.

53) Memory corruption (CVE-ID: CVE-2026-84512)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper restriction of operations within the bounds of a memory buffer in Disk Images when processing disk images. A local user can cause the vulnerable component to process a disk image to escalate privileges on the system.

54) Memory corruption (CVE-ID: CVE-2026-84510)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 2.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper restriction of operations within the bounds of a memory buffer in exFAT when processing exFAT file systems. A remote attacker can trigger the vulnerability to cause a denial of service.

55) Permissions, privileges, and access controls (CVE-ID: CVE-2026-43785)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions in File Bookmark. A local application can trick the victim into opening a specially crafted file and modify a file it only had permission to read.

56) Improper limitation of a pathname to a restricted directory ('path traversal') (CVE-ID: CVE-2026-84534)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to incorrect handling of path names in file_cmds. A remote attacker can trick the victim into opening a specially crafted file and escalate privileges on the system.

57) Memory corruption (CVE-ID: CVE-2026-84524)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in FontParser. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.

58) Memory corruption (CVE-ID: CVE-2026-65409)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in Foundation. A local application can cause a denial of service.

59) Improper input validation (CVE-ID: CVE-2026-84618)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to insufficient input validation in Game Center. A local application can access sensitive user data.

60) State issues (CVE-ID: CVE-2026-84492)

CWE-ID: CWE-371 - State Issues

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a state management issue in Graphics. A local application can cause unexpected system termination.

61) Heap-based buffer overflow (CVE-ID: CVE-2022-3437)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal. A remote user can send specially crafted data to the application, trigger a heap-based buffer overflow and perform a denial of service (DoS) attack.

62) Memory corruption (CVE-ID: CVE-2026-28934)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper restriction of operations within the bounds of a memory buffer in HFS when handling HFS filesystem operations. A local user can trigger the flaw through HFS filesystem operations to cause a denial of service.

63) Memory corruption (CVE-ID: CVE-2026-84581)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper restriction of operations within the bounds of a memory buffer in HFS when interacting with the HFS component. A local user can exploit the flaw to escalate privileges on the system.

64) Improper limitation of a pathname to a restricted directory ('path traversal') (CVE-ID: CVE-2026-64756)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to incorrect handling of path names in Image Capture. A local application can access user-sensitive data.

65) Improper input validation (CVE-ID: CVE-2026-84564)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to access sensitive information.

The vulnerability exists due to an unspecified flaw in ImageIO when processing input. A remote attacker can cause ImageIO to process input to access sensitive information.

66) Memory corruption (CVE-ID: CVE-2026-64758)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in ImageIO. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.

67) Improper input validation (CVE-ID: CVE-2026-65346)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to insufficient input validation in ImageIO. A remote attacker can trick the victim into opening a specially crafted file and perform arbitrary code execution.

68) Out-of-bounds write (CVE-ID: CVE-2026-65395)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to write data outside of intended memory bounds.

The vulnerability exists due to an out-of-bounds write in ImageIO when processing input. A remote attacker can send specially crafted input to the affected component to write data outside of intended memory bounds.

69) Use after free (CVE-ID: CVE-2026-28969)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error in IOKit. A local application can cause unexpected system termination.

70) Out-of-bounds read (CVE-ID: CVE-2026-64736)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service attack.

The vulnerability exists due to a boundary condition in IOMobileFrameBuffer. A local application can trigger an out-of-bounds read error and crash the system.

71) Memory corruption (CVE-ID: CVE-2026-84566)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper restriction of operations within the bounds of a memory buffer in the kernel when vulnerable kernel code is executed. A local user can trigger the flaw to escalate privileges on the system.

72) Out-of-bounds write (CVE-ID: CVE-2026-28968)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to an out-of-bounds write in Kernel. A local application can cause unexpected system termination or corrupt kernel memory.

73) Out-of-bounds write (CVE-ID: CVE-2026-84619)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to an out-of-bounds write in Kernel. A local application can cause unexpected system termination or write kernel memory.

74) Memory corruption (CVE-ID: CVE-2026-84549)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper restriction of operations within bounds of a memory buffer in the kernel when performing affected kernel operations. A local user can trigger the vulnerability to escalate privileges on the system.

75) Memory corruption (CVE-ID: CVE-2026-43790)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to a boundary error in Kernel. A remote attacker can trick the victim into opening a specially crafted file and cause unexpected system termination or corrupt kernel memory.

76) Memory corruption (CVE-ID: CVE-2026-84622)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error in Kernel. A local application can read uninitialized kernel memory.

77) Memory corruption (CVE-ID: CVE-2026-65377)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in Kernel. A local application can cause unexpected system termination.

78) State issues (CVE-ID: CVE-2026-65369)

CWE-ID: CWE-371 - State Issues

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a state management issue in Kernel. A local application can gain access to sensitive information.

79) Improper input validation (CVE-ID: CVE-2026-84544)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper input validation in the kernel when handling input. A local user can provide crafted input to escalate privileges on the system.

80) Permissions, privileges, and access controls (CVE-ID: CVE-2026-86917)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions in Kernel. A local application can gain root privileges.

81) Use-after-free (CVE-ID: CVE-2026-43684)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service attack.

The vulnerability exists due to a use-after-free error within the OS kernel. A local application can trigger memory corruption and crash the OS kernel. 

82) Use-after-free (CVE-ID: CVE-2026-43686)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in OS kernel when handling responses from an NFS server. A remote attacker can trick the victim into connecting to a malicious NFS server, trigger a use-after-free error and execute arbitrary code on the system.

83) Improper input validation (CVE-ID: CVE-2026-84538)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation in Kernel. A remote attacker can trick the victim into opening a specially crafted file and cause a denial-of-service.

84) Memory corruption (CVE-ID: CVE-2026-65364)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in Kernel. A remote attacker can trick the victim into opening a specially crafted file and cause unexpected system termination.

85) Improper initialization (CVE-ID: CVE-2026-65405)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper initialization within the OS kernel. A local local application can determine kernel memory layout.

86) State issues (CVE-ID: CVE-2026-84630)

CWE-ID: CWE-371 - State Issues

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a state management issue in Kernel. A local application can cause unexpected system termination.

87) State issues (CVE-ID: CVE-2026-65360)

CWE-ID: CWE-371 - State Issues

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a state management issue in Kernel. A local application can cause unexpected system termination.

88) State issues (CVE-ID: CVE-2026-65358)

CWE-ID: CWE-371 - State Issues

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a state management issue in Kernel. A local application can cause unexpected system termination.

89) Improper access control (CVE-ID: CVE-2026-84602)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to improper access restrictions in Kernel. A local application can cause unexpected system termination.

90) Improper input validation (CVE-ID: CVE-2026-65349)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation in Kernel. A local application can cause unexpected system termination or read kernel memory.

91) Memory corruption (CVE-ID: CVE-2026-65330)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error in Kernel. A local application can cause unexpected system termination or corrupt kernel memory.

92) Buffer overflow (CVE-ID: CVE-2026-28935)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service attack.

The vulnerability exists due to a boundary error within the OS kernel. A local application can trigger memory corruption and crash the system.

93) Use after free (CVE-ID: CVE-2026-65402)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error in Kernel. A local application can cause unexpected system termination.

94) Use after free (CVE-ID: CVE-2026-84521)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error in Kernel. A local application can cause unexpected system termination.

95) State issues (CVE-ID: CVE-2026-84507)

CWE-ID: CWE-371 - State Issues

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a state management issue in Kernel. A local application can cause unexpected system termination or corrupt kernel memory.

96) Improper input validation (CVE-ID: CVE-2026-84517)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation in Kernel. A local application can cause unexpected system termination.

97) Improper input validation (CVE-ID: CVE-2026-84561)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to an unspecified flaw in the kernel when executing a local application. A local user can execute a local application to escalate privileges on the system.

98) Memory corruption (CVE-ID: CVE-2026-65359)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in Kernel. A local user can cause unexpected system termination or read kernel memory.

99) Information disclosure (CVE-ID: CVE-2026-65371)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to excessive data output by the OS kernel. A local application can gain access to kernel memory.

100) Improper access control (CVE-ID: CVE-2026-84514)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improper access restrictions in Kext Management. A local application can modify protected parts of the file system.

101) Improper input validation (CVE-ID: CVE-2026-84556)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to an unspecified flaw in Keychain Access when a local application interacts with it. A local user can use a local application to interact with Keychain Access to gain access to sensitive information.

102) Improper limitation of a pathname to a restricted directory ('path traversal') (CVE-ID: CVE-2026-65382)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to incorrect handling of path names in LaunchServices. A local application can trick the victim into opening a specially crafted file and access sensitive user data.

103) Improper access control (CVE-ID: CVE-2026-84573)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in Mail. A local application can access sensitive user data.

104) Information disclosure (CVE-ID: CVE-2026-43787)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a logic issue in Mail. A remote attacker with access to the local network can send a specially crafted email to the victim and obtain sensitive user information. 

105) State issues (CVE-ID: CVE-2026-43741)

CWE-ID: CWE-371 - State Issues

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a state management issue in Messages. A local application can access protected user data.

106) Improper input validation (CVE-ID: CVE-2026-84497)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an unspecified flaw in Model I/O when handling remote input. A remote attacker can interact with the vulnerable component remotely to cause a denial of service.

107) Information disclosure (CVE-ID: CVE-2026-84626)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output in NetworkExtension. A local application can identify, which other applications were installed by the user. 

108) State issues (CVE-ID: CVE-2026-43695)

CWE-ID: CWE-371 - State Issues

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a state management issue in NetworkExtension. A local application can access sensitive user data.

109) Improper access control (CVE-ID: CVE-2026-64712)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improper access restrictions in odproxyd. A local application can gain root privileges.

110) Improper access control (CVE-ID: CVE-2026-84580)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improper access restrictions in quarantine. A local application can break out of its sandbox.

111) Improper access control (CVE-ID: CVE-2026-84578)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improper access restrictions in quarantine. A local application can break out of its sandbox.

112) Improper access control (CVE-ID: CVE-2026-84576)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in QuartzCore. A local application can access sensitive user data.

113) Improper input validation (CVE-ID: CVE-2026-84548)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient input validation in Quick Look. A remote attacker can trick the victim into opening a specially crafted file and perform an out-of-bounds read.

114) Improper input validation (CVE-ID: CVE-2026-84532)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation in RealityKit. A remote attacker can trick the victim into opening a specially crafted file and perform a denial of service (DoS) attack.

115) Out-of-bounds write (CVE-ID: CVE-2026-28966)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds write in RealityKit. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.

116) Improper access control (CVE-ID: CVE-2026-65403)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in Reminders. A local application can access sensitive user data.

117) Improper authorization (CVE-ID: CVE-2026-84555)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to bypass implemented security restrictions.

The vulnerability exists due to an error in Sandbox. A local application can gain access to sensitive user data.

118) Buffer overflow (CVE-ID: CVE-2026-84632)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in SceneKit when processing 3D models. A remote attacker can trick the victim into opening a specially crafted file, trigger memory corruption and execute arbitrary code on the target system.

119) Improper input validation (CVE-ID: CVE-2026-84487)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient input validation in SceneKit. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.

120) Improper input validation (CVE-ID: CVE-2026-65413)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation in SceneKit. A local application can cause a denial of service.

121) Integer overflow (CVE-ID: CVE-2026-84620)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in SceneKit when processing 3D models. A remote attacker can trick the victim into opening a specially crafted file, trigger an integer overflow and execute arbitrary code on the target system.

122) Out-of-bounds write (CVE-ID: CVE-2026-84546)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in SceneKit when processing remote input. A remote attacker can provide crafted input to cause memory corruption.

123) Out-of-bounds write (CVE-ID: CVE-2026-84611)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an out-of-bounds write.

The vulnerability exists due to an out-of-bounds write in SceneKit when processing remote input. A remote attacker can provide input to the affected component to cause an out-of-bounds write.

124) Memory corruption (CVE-ID: CVE-2026-43697)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a boundary error in SceneKit. A remote attacker can trick the victim into opening a specially crafted file and perform an out-of-bounds read.

125) Out-of-bounds write (CVE-ID: CVE-2026-84526)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds write in SceneKit. A remote attacker can trick the victim into opening a specially crafted file and perform unexpected process termination.

126) Improper certificate validation (CVE-ID: CVE-2026-86889)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 8.6 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to improper certificate validation in Security component. A remote attacker on the local network can intercept network traffic.

127) Improper certificate validation (CVE-ID: CVE-2026-86881)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to improper certificate validation in Security component. A remote attacker with a compromised intermediate certificate authority can issue certificates with arbitrary extended key usages.

128) Use-after-free (CVE-ID: CVE-2026-43719)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in SMB when handling SMB requests. A remote attacker can send SMB requests to cause a denial of service.

129) Improper input validation (CVE-ID: CVE-2026-43690)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an unspecified flaw in SMB when accessing the system locally. A local user can exploit the vulnerability to disclose sensitive information.

130) Memory corruption (CVE-ID: CVE-2026-65376)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in SMB. A local application can cause unexpected system termination.

131) Memory corruption (CVE-ID: CVE-2026-84543)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper restriction of operations within the bounds of a memory buffer in SMB when handling SMB operations. A local user can exploit the flaw to escalate privileges on the system.

132) Improper input validation (CVE-ID: CVE-2026-84536)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in SMB when handling SMB requests. A remote attacker can send a specially crafted SMB request to cause a denial of service.

133) Memory corruption (CVE-ID: CVE-2026-84537)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error in SMB. A local application can cause unexpected system termination or corrupt kernel memory.

134) Memory corruption (CVE-ID: CVE-2026-65365)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an unspecified flaw in SMB when handling SMB requests. A remote attacker can send an SMB request to disclose sensitive information.

135) Out-of-bounds write (CVE-ID: CVE-2026-84515)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input in SMB server. A remote attacker can trick the victim into connecting to a malicious SBM server, trigger an out-of-bounds write and execute arbitrary code on the target system.

136) Memory corruption (CVE-ID: CVE-2026-84509)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper restriction of operations within the bounds of a memory buffer in SMB when handling SMB requests. A remote attacker can send a specially crafted SMB request to cause a denial of service.

137) Improper input validation (CVE-ID: CVE-2026-84553)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation in smbx. A remote attacker can trick the victim into opening a specially crafted file and cause a denial-of-service.

138) Improper input validation (CVE-ID: CVE-2026-84609)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to an unspecified flaw in Software Update when a local application interacts with it. A local user can exploit the flaw to escalate privileges on the system.

139) Improper access control (CVE-ID: CVE-2026-65361)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in SoftwareUpdate. A local application can access sensitive user data.

140) Permissions, privileges, and access controls (CVE-ID: CVE-2026-28930)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improperly imposed security restrictions in Spotlight. A local application can access protected user data.

141) State issues (CVE-ID: CVE-2026-65378)

CWE-ID: CWE-371 - State Issues

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a state management issue in Spotlight. A local application can access sensitive user data.

142) Information disclosure (CVE-ID: CVE-2026-84621)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an unspecified flaw in Spotlight when used by a local application. A local user can exploit the flaw to disclose sensitive information.

143) Permissions, privileges, and access controls (CVE-ID: CVE-2026-65345)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improperly imposed security restrictions in Storage. A local application can access user-sensitive data.

144) Permissions, privileges, and access controls (CVE-ID: CVE-2026-65348)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions in Storage. A local application can modify protected parts of the file system.

145) Information disclosure (CVE-ID: CVE-2026-43791)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to an unspecified flaw in StorageKit when used by a local application. A local user can use a local application to gain access to sensitive information.

146) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-84513)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into log files in the Symptom Framework when used by a local application. A local user can use a local application to disclose sensitive information.

147) Information exposure through log files (CVE-ID: CVE-2026-84527)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to inclusion of sensitive information into a log file in TCC. A local application can access sensitive user data.

148) Memory corruption (CVE-ID: CVE-2026-84572)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in udf. A local application can cause unexpected system termination or read kernel memory.

149) Use after free (CVE-ID: CVE-2026-84506)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in udf. A local application can execute arbitrary code with kernel privileges.

150) Out-of-bounds write (CVE-ID: CVE-2026-43677)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds write in WebDAV. A local application can perform unexpected app termination.

151) Improper authorization (CVE-ID: CVE-2026-65375)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service attack.

The vulnerability exists due to improper authorization checks in WebDAV. A local application can crash the system.

152) Buffer overflow (CVE-ID: CVE-2026-65374)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing WebDav responses. A remote attacker can trick the victim into connecting to a malicious WebDav server, trigger memory corruption and execute arbitrary code on the target system.

153) Improper access control (CVE-ID: CVE-2026-28899)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in CoreServices. A local application can gain access to sensitive information.

154) State issues (CVE-ID: CVE-2026-84617)

CWE-ID: CWE-371 - State Issues

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a state management issue in XPC. A local application can access sensitive user data.

Remediation

Install update from vendor's website.

References

• https://support.apple.com/en-us/149042
• https://support.apple.com/en-us/128067
• https://support.apple.com/en-us/148281
• https://www.samba.org/samba/security/CVE-2022-3437.html
• https://support.apple.com/en-us/127115
• https://support.apple.com/en-us/149043