SB2026102741 - Multiple vulnerabilities in macOS Golden Gate

Description

This security bulletin contains information about 263 vulnerabilities.

1) Out-of-bounds write (CVE-ID: CVE-2026-86971)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds write in Accelerate Framework. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.

2) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-113898)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into log files in the Accounts component of macOS when writing log entries. A local user can read sensitive data from these logs, if accessible, to obtain information that may otherwise be restricted.

3) Improper access control (CVE-ID: CVE-2026-112446)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in Accounts. A local application can access sensitive user data.

4) State issues (CVE-ID: CVE-2026-112551)

CWE-ID: CWE-371 - State Issues

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a state management issue in AirPort. A local application can read sensitive location information.

5) Out-of-bounds write (CVE-ID: CVE-2026-84496)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to an out-of-bounds write in the APFS component of Apple macOS when handling filesystem operations. A local user can trigger memory corruption to escalate privileges on the system.

6) Out-of-bounds write (CVE-ID: CVE-2026-112536)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to an out-of-bounds write in APFS. A local application can cause unexpected system termination or write kernel memory.

7) Memory corruption (CVE-ID: CVE-2026-112525)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in APFS. A local application can cause unexpected system termination or read kernel memory.

8) Improper access control (CVE-ID: CVE-2026-112467)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to bypass implemneted security restrictions.

The vulnerability exists due to improper access restrictions in App Store. A local application can bypass network restrictions.

9) Improper input validation (CVE-ID: CVE-2026-112690)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to insufficient input validation in App Store. A remote attacker can trick the victim into opening a specially crafted file and break out of the WebContent sandbox.

10) Out-of-bounds write (CVE-ID: CVE-2026-112696)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to an out-of-bounds write in Apple Neural Engine. A local application can cause unexpected system termination or corrupt kernel memory.

11) Out-of-bounds write (CVE-ID: CVE-2026-84494)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to an out-of-bounds write in Apple Neural Engine. A local application can cause unexpected system termination or write kernel memory.

12) Improper input validation (CVE-ID: CVE-2026-112704)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a privilege escalation weakness in AppleAVD when accessed by a local application. A local user can run a local application that exploits the component to escalate privileges on the system.

13) Out-of-bounds write (CVE-ID: CVE-2026-112416)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds write in AppleAVD. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.

14) Out-of-bounds write (CVE-ID: CVE-2026-112415)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to an out-of-bounds write in AppleAVD. A local application can cause unexpected system termination or corrupt process memory.

15) Memory corruption (CVE-ID: CVE-2026-112454)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error in AppleAVD. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination or corrupt process memory.

16) Permissions, privileges, and access controls (CVE-ID: CVE-2026-112539)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions in AppleMobileFileIntegrity. A local application can trick the victim into opening a specially crafted file and read or write to protected files.

17) Out-of-bounds write (CVE-ID: CVE-2026-112544)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in AppleRAID when processing input. A local user can supply crafted input to trigger a write outside the bounds of a memory buffer and cause a denial of service.

18) Use after free (CVE-ID: CVE-2026-112531)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error in AppleRAID. A local application can cause unexpected system termination.

19) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-86939)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper enforcement of permissions and privileges in Archive Utility when handling security-sensitive operations. A local user can exploit these insufficient restrictions to escalate privileges on the system.

20) State issues (CVE-ID: CVE-2026-86937)

CWE-ID: CWE-371 - State Issues

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a state management issue in ArchiveService. A local application can gain access to sensitive information.

21) Improper access control (CVE-ID: CVE-2026-112568)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in ArchiveService. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.

22) Memory corruption (CVE-ID: CVE-2026-112546)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in Audio. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.

23) Improper access control (CVE-ID: CVE-2026-112675)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in Audio. A local application can access sensitive user data.

24) Out-of-bounds write (CVE-ID: CVE-2026-112705)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds write in AVEVideoEncoder. A local application can cause unexpected system termination.

25) Out-of-bounds write (CVE-ID: CVE-2026-112689)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to an out-of-bounds write in AVEVideoEncoder. A local application can cause unexpected system termination or corrupt kernel memory.

26) Out-of-bounds write (CVE-ID: CVE-2026-112470)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to an out-of-bounds write in AVEVideoEncoder. A local application can cause unexpected system termination or corrupt kernel memory.

27) Out-of-bounds write (CVE-ID: CVE-2026-112469)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to an out-of-bounds write in AVEVideoEncoder. A local application can cause unexpected system termination or corrupt kernel memory.

28) Out-of-bounds write (CVE-ID: CVE-2026-112468)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to an out-of-bounds write in AVEVideoEncoder. A local application can cause unexpected system termination or corrupt kernel memory.

29) Improper input validation (CVE-ID: CVE-2026-112466)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation in AVEVideoEncoder. A local application can cause unexpected system termination or read kernel memory.

30) Improper input validation (CVE-ID: CVE-2026-112566)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to the system to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation in Bluetooth. An attacker with physical access to the system can cause a denial-of-service.

31) Improper access control (CVE-ID: CVE-2026-112672)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in the BOM component of Apple macOS when restricting access to sensitive information. A local user can bypass access restrictions to disclose sensitive information.

32) Out-of-bounds write (CVE-ID: CVE-2026-112670)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory, potentially causing a denial of service or arbitrary code execution.

The vulnerability exists due to an out-of-bounds write in the BOM component of Apple macOS when processing input. A remote attacker can provide specially crafted input to corrupt memory beyond an intended buffer boundary, potentially causing a crash or arbitrary code execution.

33) Permissions, privileges, and access controls (CVE-ID: CVE-2026-112678)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improperly imposed security restrictions in Calendar. A local application can access sensitive user data.

34) Out-of-bounds write (CVE-ID: CVE-2026-112619)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory, potentially causing a denial of service or arbitrary code execution.

The vulnerability exists due to an out-of-bounds write in the Calendar component of Apple macOS when processing input. A remote attacker can supply crafted input to trigger a write outside the intended memory boundaries, potentially causing a denial of service or arbitrary code execution.

35) Improper access control (CVE-ID: CVE-2026-86941)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in Carbon Core. A local application can trick the victim into opening a specially crafted file and gain access to sensitive information.

36) Permissions, privileges, and access controls (CVE-ID: CVE-2026-86896)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions in CloudKit. A local application can gain root privileges.

37) Improper access control (CVE-ID: CVE-2026-86988)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in ColorSync. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.

38) Memory corruption (CVE-ID: CVE-2026-112429)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a boundary error in ColorSync. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.

39) Memory corruption (CVE-ID: CVE-2026-113910)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a boundary error in Compression. A local application can disclose kernel memory.

40) Improper limitation of a pathname to a restricted directory ('path traversal') (CVE-ID: CVE-2026-112545)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to incorrect handling of path names in configd. A local application can trick the victim into opening a specially crafted file and gain root privileges.

41) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-112462)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially bypass intended access restrictions.

The vulnerability exists due to improper management of permissions, privileges, or access controls in Control Center when handling interactions from a local application. A local user can use a local application to potentially gain unauthorized access.

42) Memory corruption (CVE-ID: CVE-2026-112471)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in Core Image. A remote attacker can trick the victim into opening a specially crafted file and perform unexpected process termination.

43) Memory corruption (CVE-ID: CVE-2026-113912)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error in CoreAudio. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination or corrupt process memory.

44) Memory corruption (CVE-ID: CVE-2026-113907)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error in CoreAudio. A local application can cause unexpected system termination or corrupt process memory.

45) Improper input validation (CVE-ID: CVE-2026-112708)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to an unspecified security weakness in CoreAudio when a local application interacts with the component. A local user can run a local application that exploits this weakness to escalate privileges on the system.

46) Buffer overflow (CVE-ID: CVE-2026-86972)

CWE-ID: CWE-120 - Buffer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to memory corruption in CoreAudio when processing crafted audio files. A remote attacker can trick the victim into opening a specially crafted file, trigger memory corruption and execute arbitrary code on the target system.

47) Out-of-bounds write (CVE-ID: CVE-2026-86969)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to an out-of-bounds write in CoreAudio. A local application can cause unexpected system termination or corrupt kernel memory.

48) Memory corruption (CVE-ID: CVE-2026-112638)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper restriction of operations within memory buffer bounds in CoreAudio when processing input. A local user can supply crafted input that triggers an invalid memory operation to cause a denial of service.

49) Out-of-bounds write (CVE-ID: CVE-2026-113950)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to an out-of-bounds write in CoreGraphics. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination or corrupt process memory.

50) Memory corruption (CVE-ID: CVE-2026-86992)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in CoreMedia. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.

51) Memory corruption (CVE-ID: CVE-2026-112688)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in CoreMedia. A local application can trick the victim into opening a specially crafted file and perform an unexpected app termination or arbitrary code execution.

52) Information disclosure (CVE-ID: CVE-2026-86990)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to insufficient protection of sensitive information in the CoreMedia component when accessed by a local application. A local user can use a local application to access sensitive information.

53) Out-of-bounds write (CVE-ID: CVE-2026-113946)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to an out-of-bounds write in CoreStorage. A local application can cause unexpected system termination or corrupt kernel memory.

54) Memory corruption (CVE-ID: CVE-2026-113945)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in CoreStorage. A local application can cause unexpected system termination.

55) Memory corruption (CVE-ID: CVE-2026-113940)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in CoreStorage. A local application can cause unexpected system termination.

56) Memory corruption (CVE-ID: CVE-2026-113938)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in CoreStorage. A local application can cause unexpected system termination.

57) Memory corruption (CVE-ID: CVE-2026-113937)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in CoreStorage. A local application can cause unexpected system termination.

58) Memory corruption (CVE-ID: CVE-2026-113936)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in CoreStorage. A local application can cause unexpected system termination.

59) Memory corruption (CVE-ID: CVE-2026-113935)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in CoreStorage. A local application can cause unexpected system termination.

60) Memory corruption (CVE-ID: CVE-2026-113944)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in CoreStorage. A local application can cause unexpected system termination or read kernel memory.

61) Memory corruption (CVE-ID: CVE-2026-113942)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in CoreStorage. A local application can cause unexpected system termination or read kernel memory.

62) Memory corruption (CVE-ID: CVE-2026-113941)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in CoreStorage. A local application can cause unexpected system termination or read kernel memory.

63) Out-of-bounds write (CVE-ID: CVE-2026-113943)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to an out-of-bounds write in the CoreStorage component of Apple macOS when processing input. A local user can supply crafted input to trigger memory corruption and escalate privileges on the system.

64) Out-of-bounds write (CVE-ID: CVE-2026-113939)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to an out-of-bounds write in CoreStorage when processing input. A local user can supply crafted input that causes a write outside the intended memory boundaries to escalate privileges on the system.

65) Memory corruption (CVE-ID: CVE-2026-113934)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error in CoreStorage. A local application can cause unexpected system termination or corrupt kernel memory.

66) Memory corruption (CVE-ID: CVE-2026-112604)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in CoreSymbolication. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.

67) Memory corruption (CVE-ID: CVE-2026-112656)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a boundary error in CoreText. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.

68) State issues (CVE-ID: CVE-2026-113900)

CWE-ID: CWE-371 - State Issues

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a state management issue in Crash Reporter. A local application can gain root privileges.

69) Improper access control (CVE-ID: CVE-2026-65327)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper access control in CUPS when enforcing privilege boundaries. A local user can bypass access restrictions to escalate privileges on the system.

70) Improper access control (CVE-ID: CVE-2026-112530)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improper access restrictions in CVMS. A local application can gain root privileges.

71) Improper access control (CVE-ID: CVE-2026-112444)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in DesktopServices. A local application can bypass Gatekeeper checks.

72) Improper access control (CVE-ID: CVE-2026-112428)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in DesktopServices. A local application can gain access to sensitive information.

73) Improper limitation of a pathname to a restricted directory ('path traversal') (CVE-ID: CVE-2026-112483)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to incorrect handling of path names in Directory Utility. A local application can modify protected parts of the file system.

74) Memory corruption (CVE-ID: CVE-2026-112502)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in Disk Images. A local application can cause a denial-of-service.

75) Improper access control (CVE-ID: CVE-2026-112570)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improper access restrictions in DiskArbitration. A local application can break out of its sandbox.

76) Protection mechanism failure (CVE-ID: CVE-2026-112534)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to improper enforcement of security restrictions in dyld when executing a local application. A local user can run a local application to bypass the affected security restrictions.

77) Information disclosure (CVE-ID: CVE-2026-113896)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to exposure of sensitive information in the FileProvider component of macOS when handling access from local applications. A local user can run a local application to gain access to sensitive information.

78) Improper input validation (CVE-ID: CVE-2026-86970)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient input validation in FontParser. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.

79) Out-of-bounds write (CVE-ID: CVE-2026-112683)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to an out-of-bounds write in FontParser. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination or corrupt process memory.

80) Memory corruption (CVE-ID: CVE-2026-112642)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a boundary error in FontParser. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.

81) Information exposure through log files (CVE-ID: CVE-2026-112432)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to inclusion of sensitive information into a log file in FontParser. A local application can access sensitive user data.

82) Improper input validation (CVE-ID: CVE-2026-113947)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an unspecified flaw in GPUTools when handling operations initiated by a local application. A local user can execute a local application that triggers the flaw to cause a denial of service.

83) Improper access control (CVE-ID: CVE-2026-112518)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially gain unauthorized access to restricted resources.

The vulnerability exists due to improper access control in the Heimdal component of Apple macOS when enforcing access restrictions. A local user can attempt operations on restricted resources to potentially bypass intended access controls.

84) Memory corruption (CVE-ID: CVE-2026-86943)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in Heimdal. A remote attacker can trick the victim into opening a specially crafted file and cause a denial-of-service.

85) Improper input validation (CVE-ID: CVE-2026-112410)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an unspecified error in the Heimdal component of Apple macOS when handling remotely supplied input. A remote attacker can trigger the error remotely to cause a denial of service.

86) Improper link resolution before file access ('link following') (CVE-ID: CVE-2026-112523)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to insecure symbolic link following in Help Viewer. A local application can access user-sensitive data.

87) Memory corruption (CVE-ID: CVE-2026-112424)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in HFS. A local application can cause unexpected system termination or read kernel memory.

88) Memory corruption (CVE-ID: CVE-2026-112475)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in HFS. A local application can cause unexpected system termination.

89) Out-of-bounds write (CVE-ID: CVE-2026-112456)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory, potentially causing a denial of service or arbitrary code execution.

The vulnerability exists due to an out-of-bounds write in the HFS component of Apple macOS when processing input. A remote attacker can supply specially crafted input to trigger a write outside the bounds of a memory buffer, potentially causing a denial of service or arbitrary code execution.

90) Improper access control (CVE-ID: CVE-2026-86978)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in HomeKit. A local application can access sensitive user data.

91) Memory corruption (CVE-ID: CVE-2026-112596)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in HomeKit. A remote attacker can trick the victim into opening a specially crafted file and perform unexpected system termination.

92) Improper access control (CVE-ID: CVE-2026-112647)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in iCloud. A local application can access sensitive user data.

93) Information disclosure (CVE-ID: CVE-2026-112617)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access sensitive information.

The vulnerability exists due to insufficient protection of sensitive information in the iCloud component of macOS when accessed by a local application. A local user can run a local application to access sensitive information.

94) Memory corruption (CVE-ID: CVE-2026-112571)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a boundary error in ImageIO. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.

95) Memory corruption (CVE-ID: CVE-2026-112561)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a boundary error in ImageIO. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.

96) Memory corruption (CVE-ID: CVE-2026-112627)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a boundary error in ImageIO. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.

97) Memory corruption (CVE-ID: CVE-2026-112488)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to a boundary error in ImageIO. A remote attacker can trick the victim into opening a specially crafted file and escalate privileges on the system.

98) Memory corruption (CVE-ID: CVE-2026-112634)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in ImageIO. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.

99) Memory corruption (CVE-ID: CVE-2026-112629)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in ImageIO. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.

100) Out-of-bounds write (CVE-ID: CVE-2026-112633)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds write in ImageIO. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.

101) Out-of-bounds write (CVE-ID: CVE-2026-112614)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds write in ImageIO. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.

102) Memory corruption (CVE-ID: CVE-2026-112632)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a boundary error in ImageIO. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.

103) Memory corruption (CVE-ID: CVE-2026-112630)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a boundary error in ImageIO. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.

104) Improper input validation (CVE-ID: CVE-2026-112625)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially disrupt normal application behavior through improperly validated input.

The vulnerability exists due to improper input validation in ImageIO when processing input. A remote attacker can supply malformed input to potentially cause unexpected application behavior.

105) State issues (CVE-ID: CVE-2026-112533)

CWE-ID: CWE-371 - State Issues

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a state management issue in IOGPUFamily. A local application can access sensitive user data.

106) Memory corruption (CVE-ID: CVE-2026-112515)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper restriction of operations within the bounds of a memory buffer in IOHIDFamily when processing input. A local user can supply crafted input that triggers an invalid memory access to cause a denial of service.

107) Improper input validation (CVE-ID: CVE-2026-112478)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation in IOKit. A local application can cause unexpected system termination or read kernel memory.

108) State issues (CVE-ID: CVE-2026-112459)

CWE-ID: CWE-371 - State Issues

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a state management issue in IOMobileFrameBuffer. A local application can cause unexpected system termination or corrupt kernel memory.

109) Memory corruption (CVE-ID: CVE-2026-112554)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in IOStorageFamily. A local application can cause unexpected system termination or read kernel memory.

110) Improper privilege management (CVE-ID: CVE-2026-112477)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper privilege management in the IOSurface component when handling operations initiated by a local application. A local user can run an application that exploits the component to escalate privileges on the system.

111) Improper input validation (CVE-ID: CVE-2026-112576)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause unintended kernel behavior through malformed input.

The vulnerability exists due to improper input validation in the macOS kernel when processing input from a local application. A local user can supply malformed input through a local application to potentially trigger unintended kernel behavior.

112) Improper input validation (CVE-ID: CVE-2026-112543)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to an unspecified security weakness in the macOS kernel when running a local application. A local user can run an application that exploits this weakness to escalate privileges on the system.

113) Memory corruption (CVE-ID: CVE-2026-112606)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in Kernel. A local application can cause unexpected system termination.

114) Use after free (CVE-ID: CVE-2026-65350)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in Kernel. A local application can cause unexpected system termination or corrupt kernel memory.

115) Use after free (CVE-ID: CVE-2026-112679)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in Kernel. A local application can cause unexpected system termination or corrupt kernel memory.

116) Memory corruption (CVE-ID: CVE-2026-112532)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error in Kernel. A local application can cause unexpected system termination or corrupt kernel memory.

117) Use after free (CVE-ID: CVE-2026-112517)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in Kernel. A local application can cause unexpected system termination or corrupt kernel memory.

118) Use after free (CVE-ID: CVE-2026-112516)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error in Kernel. A local application can cause unexpected system termination.

119) Use-after-free (CVE-ID: CVE-2026-112514)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to use-after-free in the macOS kernel when accessing previously freed memory. A local user can exploit references to freed memory to escalate privileges on the system.

120) Use after free (CVE-ID: CVE-2026-84495)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in Kernel. A local application can cause unexpected system termination or write kernel memory.

121) Use after free (CVE-ID: CVE-2026-112474)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in Kernel. A local application can cause unexpected system termination or write kernel memory.

122) Memory corruption (CVE-ID: CVE-2026-112698)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in Kernel. A local application can cause unexpected system termination.

123) State issues (CVE-ID: CVE-2026-112501)

CWE-ID: CWE-371 - State Issues

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a state management issue in Kernel. A local application can cause unexpected system termination.

124) Memory corruption (CVE-ID: CVE-2026-112476)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in Kernel. A local application can cause unexpected system termination.

125) State Issues (CVE-ID: CVE-2026-112665)

CWE-ID: CWE-371 - State Issues

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause incorrect kernel behavior.

The vulnerability exists due to improper state management in the macOS kernel when handling operations initiated by a local application. A local user can run a local application that exercises the affected functionality to potentially cause incorrect kernel behavior.

126) Improper access control (CVE-ID: CVE-2026-112624)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially gain unauthorized access to protected resources.

The vulnerability exists due to improper access control in the macOS kernel when handling operations initiated by a local application. A local user can run a local application that attempts operations without appropriate authorization checks to potentially access protected resources.

127) State Issues (CVE-ID: CVE-2026-112438)

CWE-ID: CWE-371 - State Issues

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper management of internal state in the macOS kernel when handling state-dependent operations. A local user can exploit incorrectly maintained kernel state to escalate privileges on the system.

128) Improper access control (CVE-ID: CVE-2026-112494)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in LaunchServices. A local application can trick the victim into opening a specially crafted file and gain access to sensitive information.

129) Out-of-bounds write (CVE-ID: CVE-2026-112522)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds write in libarchive. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.

130) Improper access control (CVE-ID: CVE-2026-86945)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass access restrictions, potentially gaining unauthorized access to protected resources.

The vulnerability exists due to improper access control in the libcryptex component of Apple macOS when handling operations initiated by a local application. A local user can use a local application to attempt restricted operations, potentially gaining unauthorized access to protected resources.

131) Improper input validation (CVE-ID: CVE-2026-112497)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to an unspecified weakness in libxpc when accessed by a local application. A local user can exploit the weakness through a local application to escalate privileges on the system.

132) Out-of-bounds write (CVE-ID: CVE-2026-112621)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory, potentially causing a denial of service or arbitrary code execution.

The vulnerability exists due to an out-of-bounds write in the LinkPresentation component of Apple macOS when processing input. A remote attacker can supply crafted input to cause writes outside the intended memory boundaries, potentially causing a denial of service or arbitrary code execution.

133) Improper access control (CVE-ID: CVE-2026-112500)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass access restrictions, potentially gaining unauthorized access to protected resources.

The vulnerability exists due to improper access control in the Mail component of macOS when enforcing access restrictions. A local user can attempt operations that are not properly authorized to bypass intended access controls.

134) Improper input validation (CVE-ID: CVE-2026-112671)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation in Mail. A remote attacker can trick the victim into opening a specially crafted file and cause a denial-of-service.

135) Improper input validation (CVE-ID: CVE-2026-112414)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation in Mail. A remote attacker can trick the victim into opening a specially crafted file and perform a denial-of-service.

136) Memory corruption (CVE-ID: CVE-2026-112607)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially corrupt memory and cause a denial of service.

The vulnerability exists due to improper restriction of operations within memory buffer boundaries in mDNSResponder when handling input. A remote attacker can supply specially crafted input to potentially trigger out-of-bounds memory access and disrupt the service.

137) Information disclosure (CVE-ID: CVE-2026-113915)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to an information disclosure weakness in the MediaAnalysis component when accessed by a local application. A local user can use a local application to obtain sensitive information.

138) Improper input validation (CVE-ID: CVE-2026-112682)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation in Messages. A remote attacker can trick the victim into opening a specially crafted file and cause unexpected app termination.

139) Improper input validation (CVE-ID: CVE-2026-112565)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially interfere with normal application behavior through improperly validated input.

The vulnerability exists due to improper input validation in the Model I/O component of macOS when processing input. A remote attacker can supply malformed input to potentially bypass expected input restrictions or trigger unintended processing behavior.

140) Improper input validation (CVE-ID: CVE-2026-112449)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass expected input constraints, potentially causing unintended application behavior.

The vulnerability exists due to improper input validation in Model I/O when processing input. A remote attacker can supply malformed input to bypass expected input constraints and potentially interfere with normal processing.

141) Out-of-bounds write (CVE-ID: CVE-2026-112563)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds write in Model I/O. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.

142) Out-of-bounds write (CVE-ID: CVE-2026-112553)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds write in Model I/O. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.

143) Memory corruption (CVE-ID: CVE-2026-112413)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in Model I/O. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.

144) Memory corruption (CVE-ID: CVE-2026-112485)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption that may lead to a denial of service or arbitrary code execution.

The vulnerability exists due to improper restriction of operations within memory buffer boundaries in the Model I/O component of Apple macOS when processing input. A remote attacker can supply specially crafted input to potentially trigger out-of-bounds memory access, which may cause a crash or arbitrary code execution.

145) Out-of-bounds write (CVE-ID: CVE-2026-112461)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory, potentially causing a denial of service or arbitrary code execution.

The vulnerability exists due to an out-of-bounds write in Model I/O when processing input. A remote attacker can supply crafted input to potentially write outside the bounds of an allocated memory region and cause memory corruption.

146) Out-of-bounds write (CVE-ID: CVE-2026-112486)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds write in Model I/O. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.

147) Memory corruption (CVE-ID: CVE-2026-112550)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in ncurses. A local application can cause a denial-of-service.

148) Improper input validation (CVE-ID: CVE-2026-112421)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to insufficient input validation in PackageKit. A local application can modify protected parts of the file system.

149) Permissions, privileges, and access controls (CVE-ID: CVE-2026-113948)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions in PackageKit. A local application can modify protected parts of the file system.

150) Improper input validation (CVE-ID: CVE-2026-112442)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to an unspecified flaw in PackageKit when handling operations initiated by a local application. A local user can run an application that exploits the flaw to escalate privileges on the system.

151) State issues (CVE-ID: CVE-2026-65397)

CWE-ID: CWE-371 - State Issues

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a state management issue in Photos Storage. A local application can access sensitive user data.

152) Improper access control (CVE-ID: CVE-2026-112676)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in Photos Storage. A local application can access a user's Photos Library.

153) State Issues (CVE-ID: CVE-2026-112660)

CWE-ID: CWE-371 - State Issues

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially disrupt intended application behavior through improper state handling.

The vulnerability exists due to improper state management in Photos Storage when interacting with a local application. A local user can use a local application to exercise affected state-handling behavior, potentially causing the component to behave unexpectedly.

154) Improper access control (CVE-ID: CVE-2026-113899)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to improper access restrictions in ppp. A local application can cause unexpected system termination.

155) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-112542)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially bypass access restrictions and gain unauthorized access to resources or operations.

The vulnerability exists due to improper management of permissions, privileges, or access controls in the ppp component of Apple macOS when handling operations initiated by a local application. A local user can use a local application to potentially access resources or perform operations without appropriate authorization.

156) Improper limitation of a pathname to a restricted directory ('path traversal') (CVE-ID: CVE-2026-112562)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to incorrect handling of path names in Printing. A local application can trick the victim into opening a specially crafted file and break out of its sandbox.

157) Improper link resolution before file access ('link following') (CVE-ID: CVE-2026-112513)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to insecure symbolic link following in Printing. A local application can break out of its sandbox.

158) Improper access control (CVE-ID: CVE-2026-112569)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improper access restrictions in quarantine. A local application can break out of its sandbox.

159) Improper access control (CVE-ID: CVE-2026-112498)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improper access restrictions in quarantine. A local application can break out of its sandbox.

160) State issues (CVE-ID: CVE-2026-86925)

CWE-ID: CWE-371 - State Issues

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a state management issue in Quick Look. A local application can access sensitive user data.

161) Memory corruption (CVE-ID: CVE-2026-112491)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in RealityKit. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.

162) Permissions, privileges, and access controls (CVE-ID: CVE-2026-112480)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to improperly imposed security restrictions in Remote Management. A local user can view another user's screen.

163) Improper privilege management (CVE-ID: CVE-2026-112457)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to escalate privileges on the system.

The vulnerability exists due to improper privilege management in the macOS Remote Management component when accessed from the local network. A remote attacker on the local network can exploit the component over the local network to escalate privileges on the system.

164) State issues (CVE-ID: CVE-2026-112427)

CWE-ID: CWE-371 - State Issues

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a state management issue in Remote Management. A remote attacker can trick the victim into opening a specially crafted file and cause arbitrary code execution.

165) Improper input validation (CVE-ID: CVE-2026-112677)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a privilege-escalation weakness in the RemoteManagement component when accessed by a local application. A local user can use a local application to exploit this weakness to gain elevated privileges on the system.

166) Memory corruption (CVE-ID: CVE-2026-112425)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a boundary error in SceneKit. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.

167) Memory corruption (CVE-ID: CVE-2026-112423)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in SceneKit. A remote attacker can trick the victim into opening a specially crafted file and perform a denial-of-service or potentially disclose memory contents.

168) Improper input validation (CVE-ID: CVE-2026-112540)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation in SceneKit. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.

169) Out-of-bounds write (CVE-ID: CVE-2026-112464)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory, potentially causing a denial of service or arbitrary code execution.

The vulnerability exists due to an out-of-bounds write in SceneKit when processing input. A remote attacker can supply crafted input that triggers a write outside the bounds of a memory buffer to corrupt memory, potentially causing a crash or arbitrary code execution.

170) Memory corruption (CVE-ID: CVE-2026-86991)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in SceneKit. A remote attacker can trick the victim into opening a specially crafted file and perform unexpected process termination.

171) Improper input validation (CVE-ID: CVE-2026-112519)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the Screen Sharing component of Apple macOS when processing input. A remote attacker can supply specially crafted input to cause a denial of service.

172) Out-of-bounds write (CVE-ID: CVE-2026-84590)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds write in Screen Sharing Server. A remote attacker can trick the victim into opening a specially crafted file and cause unexpected app termination or heap corruption.

173) Path traversal (CVE-ID: CVE-2026-112511)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to path traversal in the macOS Screen Sharing Server when processing file paths. A local user can supply a crafted path that escapes an intended directory to escalate privileges on the system.

174) Improper input validation (CVE-ID: CVE-2026-65384)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation in Screen Sharing Server. A remote attacker can trick the victim into opening a specially crafted file and perform a denial of service (DoS) attack.

175) Improper input validation (CVE-ID: CVE-2026-112484)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to an unspecified security flaw in the macOS Screen Sharing Server when accessed by a local application. A local user can use a local application to exploit the flaw to escalate privileges on the system.

176) Out-of-bounds write (CVE-ID: CVE-2026-112482)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to escalate privileges on the system.

The vulnerability exists due to an out-of-bounds write in Screen Sharing Server. A remote attacker on the local network can corrupt process memory.

177) State Issues (CVE-ID: CVE-2026-112473)

CWE-ID: CWE-371 - State Issues

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially bypass intended security restrictions.

The vulnerability exists due to improper management of application state in the Screen Sharing Server when handling state-dependent operations. A remote attacker can interact with the server in an unexpected state to potentially bypass intended security restrictions.

178) Memory corruption (CVE-ID: CVE-2026-112481)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in Screen Sharing Server. A remote attacker on the local network can cause unexpected process termination or disclose process memory.

179) Information disclosure (CVE-ID: CVE-2026-112616)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access sensitive information.

The vulnerability exists due to insufficient protection of sensitive information in Screen Time when accessed by a local application. A local user can use a local application to gain access to sensitive information.

180) Improper input validation (CVE-ID: CVE-2026-113913)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient input validation in Security. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.

181) Memory corruption (CVE-ID: CVE-2026-112521)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to improper restriction of memory operations in the Security component of Apple macOS when processing input. A local user can trigger memory operations outside intended buffer boundaries to potentially bypass implemented security restrictions.

182) Improper input validation (CVE-ID: CVE-2026-112506)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to insufficient input validation in Security. A local application can access sensitive user data.

183) Improper access control (CVE-ID: CVE-2026-112668)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improper access restrictions in Security. A local application can gain root privileges.

184) Improper access control (CVE-ID: CVE-2026-112437)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improper access restrictions in Security. A local application can gain root privileges.

185) Improper access control (CVE-ID: CVE-2026-86936)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improper access restrictions in Security. A local application can gain root privileges.

186) Improper access control (CVE-ID: CVE-2026-112434)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improper access restrictions in Security. A local application can gain root privileges.

187) State Issues (CVE-ID: CVE-2026-112652)

CWE-ID: CWE-371 - State Issues

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially bypass security restrictions.

The vulnerability exists due to improper state management in the macOS Security component when handling interactions from a local application. A local user can use a local application to exploit state-handling weaknesses to potentially bypass security restrictions.

188) Improper input validation (CVE-ID: CVE-2026-112430)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to insufficient input validation in Security. A local application can gain root privileges.

189) Improper access control (CVE-ID: CVE-2026-112493)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improper access restrictions in SecurityAgent. A local application can gain root privileges.

190) State issues (CVE-ID: CVE-2026-112559)

CWE-ID: CWE-371 - State Issues

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a state management issue in Shortcuts. A local application can access sensitive user data.

191) State issues (CVE-ID: CVE-2026-112455)

CWE-ID: CWE-371 - State Issues

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a state management issue in Shortcuts. A local application can access sensitive user data.

192) Information disclosure (CVE-ID: CVE-2026-86984)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to exposure of sensitive information in Siri when accessed by a local application. A local user can use a local application to obtain sensitive information.

193) State issues (CVE-ID: CVE-2026-112685)

CWE-ID: CWE-371 - State Issues

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a state management issue in Siri. A local application can access sensitive user data.

194) Improper input validation (CVE-ID: CVE-2026-112658)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to insufficient input validation in Siri. A local application can access sensitive user data.

195) Use after free (CVE-ID: CVE-2026-86946)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in SMB. A local application can cause unexpected system termination or corrupt kernel memory.

196) Out-of-bounds write (CVE-ID: CVE-2026-112552)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds write in SMB. A remote attacker can trick the victim into opening a specially crafted file and cause unexpected system termination.

197) Memory corruption (CVE-ID: CVE-2026-112526)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in smbx. A remote attacker can trick the victim into opening a specially crafted file and cause unexpected app termination.

198) Out-of-bounds write (CVE-ID: CVE-2026-112510)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds write in smbx. A remote attacker can trick the victim into opening a specially crafted file and cause a denial-of-service.

199) Memory corruption (CVE-ID: CVE-2026-112451)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in smbx. A remote attacker can trick the victim into opening a specially crafted file and cause a denial-of-service or disclose process memory.

200) Out-of-bounds write (CVE-ID: CVE-2026-112505)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to an out-of-bounds write in the smbx component of macOS when processing input. A local user can supply crafted input that triggers writes outside intended memory boundaries to escalate privileges on the system.

201) Memory corruption (CVE-ID: CVE-2026-112495)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in SoftRAID. A local application can cause unexpected system termination or read kernel memory.

202) UNIX symbolic link following (CVE-ID: CVE-2022-26704)

CWE-ID: CWE-61 - UNIX Symbolic Link (Symlink) Following

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a symlink following issue in Spotlight. A local user can create a specially crafted symbolic link to a critical file on the system and overwrite it with privileges of the application.

Successful exploitation of this vulnerability may result in privilege escalation.

203) Improper access control (CVE-ID: CVE-2026-112567)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass access restrictions, potentially gaining unauthorized access to protected resources.

The vulnerability exists due to improper access control in Spotlight when interacting with a local application. A local user can use a local application to bypass access restrictions, potentially gaining unauthorized access to protected resources.

204) Improper access control (CVE-ID: CVE-2026-112558)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in Spotlight. A local application can access sensitive user data.

205) Improper access control (CVE-ID: CVE-2026-112557)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass access restrictions and potentially gain unauthorized access to protected resources.

The vulnerability exists due to improper access control in Spotlight when handling requests from a local application. A local user can use a local application to attempt operations without adequate access checks, potentially gaining unauthorized access to protected resources.

206) Improper input validation (CVE-ID: CVE-2026-112441)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to insufficient input validation in Spotlight. A local application can access sensitive user data.

207) Information disclosure (CVE-ID: CVE-2026-112628)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to insufficient protection of sensitive information in Spotlight when handling access from a local application. A local user can use a local application to gain access to sensitive information.

208) Improper limitation of a pathname to a restricted directory ('path traversal') (CVE-ID: CVE-2026-112487)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to incorrect handling of path names in Storage. A local application can gain root privileges.

209) Use after free (CVE-ID: CVE-2026-112548)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in StorageKit. A local application can gain root privileges.

210) Improper limitation of a pathname to a restricted directory ('path traversal') (CVE-ID: CVE-2026-112541)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to incorrect handling of path names in StorageKit. A local application can trick the victim into opening a specially crafted file and gain root privileges.

211) Improper input validation (CVE-ID: CVE-2026-112535)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to insufficient input validation in StorageKit. A local application can modify protected parts of the file system.

212) Improper limitation of a pathname to a restricted directory ('path traversal') (CVE-ID: CVE-2026-112504)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to incorrect handling of path names in StorageKit. A local application can trick the victim into opening a specially crafted file and modify protected parts of the file system.

213) Improper privilege management (CVE-ID: CVE-2026-112492)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper privilege management in StorageKit when handling operations initiated by a local application. A local user can use a local application to escalate privileges on the system.

214) Information disclosure (CVE-ID: CVE-2026-86968)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to insufficient protection of sensitive information in System Preferences when accessed by a local application. A local user can use a local application to obtain sensitive information.

215) Improper input validation (CVE-ID: CVE-2026-112556)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to an unspecified flaw in System Settings when accessed by a local application. A local user can exploit the flaw through a local application to execute arbitrary code.

216) Improper limitation of a pathname to a restricted directory ('path traversal') (CVE-ID: CVE-2026-112512)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to incorrect handling of path names in System Settings. A local application can bypass Gatekeeper checks.

217) Improper limitation of a pathname to a restricted directory ('path traversal') (CVE-ID: CVE-2026-112453)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to incorrect handling of path names in System Settings. A local application can break out of its sandbox.

218) Improper access control (CVE-ID: CVE-2026-112577)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain unauthorized access to sensitive information.

The vulnerability exists due to improper access control in the macOS TCC component when a local application accesses sensitive information. A local user can run a local application to access information that should be restricted.

219) Information disclosure (CVE-ID: CVE-2026-112595)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to system to gain access to sensitive information.

The vulnerability exists due to an unspecified weakness in the Thread component of Apple macOS when the system is accessed physically. An attacker with physical access to system can exploit this weakness through physical access to obtain sensitive information.

220) State Issues (CVE-ID: CVE-2026-112447)

CWE-ID: CWE-371 - State Issues

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially interfere with intended Time Machine behavior.

The vulnerability exists due to improper state management in Time Machine when handling interactions with local applications. A local user can use a local application to exercise the state-handling weakness, potentially causing behavior inconsistent with the component's intended operation.

221) Memory corruption (CVE-ID: CVE-2026-112529)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in udf. A local application can cause unexpected system termination.

222) Use after free (CVE-ID: CVE-2026-112524)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in udf. A local application can cause unexpected system termination or corrupt kernel memory.

223) Memory corruption (CVE-ID: CVE-2026-112508)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in udf. A local application can cause unexpected system termination or read kernel memory.

224) Memory corruption (CVE-ID: CVE-2026-112479)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper restriction of memory operations in the USB component of Apple macOS when processing input. A local user can supply input that triggers an invalid memory operation to cause a denial of service.

225) Use-after-free (CVE-ID: CVE-2026-113904)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.

226) Use-after-free (CVE-ID: CVE-2026-112599)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.

227) Type confusion (CVE-ID: CVE-2026-86974)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a type confusion error and execute arbitrary code on the target system.

228) Use-after-free (CVE-ID: CVE-2026-86986)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.

229) Use-after-free (CVE-ID: CVE-2026-112693)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.

230) Input validation error (CVE-ID: CVE-2026-86985)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page and crash the browser. 

231) Out-of-bounds read (CVE-ID: CVE-2026-112699)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and read contents of memory on the system.

232) Out-of-bounds read (CVE-ID: CVE-2026-112680)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in WebKit. A remote attacker can trick the victim into visiting a specially crafted website, trigger an out-of-bounds read error and read contents of memory on the system.

233) Use-after-free (CVE-ID: CVE-2026-112697)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page and execute arbitrary code on the system.

234) Use-after-free (CVE-ID: CVE-2026-112655)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page and execute arbitrary code on the system.

235) Use-after-free (CVE-ID: CVE-2026-112651)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page and execute arbitrary code on the system.

236) Use-after-free (CVE-ID: CVE-2026-112623)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page and execute arbitrary code on the system.

237) Race condition (CVE-ID: CVE-2026-112686)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to a race condition in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page and crash the browser.

238) Input validation error (CVE-ID: CVE-2026-112684)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page and crash the browser. 

239) Type confusion (CVE-ID: CVE-2026-112673)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser

The vulnerability exists due to a type confusion error in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.

240) Race condition (CVE-ID: CVE-2026-112669)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to a race condition in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page and crash the browser.

241) Use-after-free (CVE-ID: CVE-2026-112695)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.

242) Use-after-free (CVE-ID: CVE-2026-112666)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.

243) Use-after-free (CVE-ID: CVE-2026-112654)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.

244) Use-after-free (CVE-ID: CVE-2026-112653)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.

245) Use-after-free (CVE-ID: CVE-2026-112615)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.

246) Type confusion (CVE-ID: CVE-2026-112659)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a type confusion error and execute arbitrary code on the target system.

247) Use-after-free (CVE-ID: CVE-2026-112640)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and execute arbitrary code on the system.

248) Protection mechanism failure (CVE-ID: CVE-2026-113952)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient implementation of security measures in WebKit. A remote attacker can force the browser to use a media format that should be restricted in Lockdown Mode.

249) Type confusion (CVE-ID: CVE-2026-113949)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error in WebKit. A remote attacker can trick the victim into visiting a specially crafted website, trigger a type confusion error and execute arbitrary code on the target system.

250) Use-after-free (CVE-ID: CVE-2026-113903)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and execute arbitrary code on the system.

251) Use-after-free (CVE-ID: CVE-2026-112637)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing HTML content in WebKit Canvas. A remote attacker can trick the victim into visiting a specially crafted website and execute arbitrary code on the system.

252) Use-after-free (CVE-ID: CVE-2026-112626)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing web content in WebKit JavaScript Bindings. A remote attacker can trick the victim into visiting a specially crafted website and execute arbitrary code on the system.

253) Protection mechanism failure (CVE-ID: CVE-2026-113897)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient implementation of security measures in WebKit Process Model. A remote attacker can trick the victim into visiting a specially crafted website and break out of the web content sandbox. 

254) Use-after-free (CVE-ID: CVE-2026-112639)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing HTML content in WebKit Process Model. A remote attacker can trick the victim into visiting a specially crafted website and execute arbitrary code on the system.

255) Use after free (CVE-ID: CVE-2026-113901)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error in WebRTC. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected process crash.

256) Memory corruption (CVE-ID: CVE-2026-86973)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in WebRTC. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected process crash.

257) Improper input validation (CVE-ID: CVE-2026-113909)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to the system to escalate privileges on the system.

The vulnerability exists due to insufficient input validation in Wi-Fi. An attacker with physical access to the system can corrupt process memory.

258) Exposure of sensitive information to an unauthorized actor (CVE-ID: CVE-2026-112537)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to excessive data output in Wi-Fi. A local application can read sensitive location information.

259) Memory corruption (CVE-ID: CVE-2026-112443)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error in Wi-Fi. A local application can cause unexpected system termination or corrupt process memory.

260) Memory corruption (CVE-ID: CVE-2026-112622)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to cause a denial of service.

The vulnerability exists due to improper restriction of memory operations in the Wi-Fi component of Apple macOS when handling input. A remote attacker on the local network can supply specially crafted input to trigger a memory safety error and cause a denial of service.

261) Improper input validation (CVE-ID: CVE-2026-112620)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to cause a denial of service.

The vulnerability exists due to improper input validation in the Wi-Fi component of Apple macOS when processing input. A remote attacker on the local network can supply specially crafted input to cause a denial of service.

262) Improper input validation (CVE-ID: CVE-2026-112575)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger unintended behavior in WindowServer, potentially affecting system security.

The vulnerability exists due to improper input validation in WindowServer when handling input from a local application. A local user can supply malformed input through a local application to trigger unintended behavior.

263) Improper input validation (CVE-ID: CVE-2026-112555)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to an unspecified security weakness in the zsh component of Apple macOS when accessed by a local application. A local user can exploit the weakness through a local application to escalate privileges on the system.

Remediation

Install update from vendor's website.

References

• https://support.apple.com/en-us/149521