SB2026102745 - Multiple vulnerabilities in Apple iOS 27 and iPadOS 27
Published: October 27, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 163 vulnerabilities.
1) Out-of-bounds write (CVE-ID: CVE-2026-86971)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to an out-of-bounds write in Accelerate Framework. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.
2) State issues (CVE-ID: CVE-2026-84493)
CWE-ID: CWE-371 - State Issues
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a state management issue in AccessorySetupKit. A local application can access Bluetooth without user consent.
3) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-113898)
CWE-ID: CWE-532 - Information Exposure Through Log Files
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially disclose sensitive information.
The vulnerability exists due to insertion of sensitive information into log files in the Accounts component of macOS when writing log entries. A local user can read sensitive data from these logs, if accessible, to obtain information that may otherwise be restricted.
4) Improper access control (CVE-ID: CVE-2026-112446)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in Accounts. A local application can access sensitive user data.
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows an attacker with physical access to the system to escalate privileges on the system.
The vulnerability exists due to incorrect handling of path names in Accounts. An attacker with physical access to the system can trick the victim into opening a specially crafted file and read and write arbitrary files.
6) Improper access control (CVE-ID: CVE-2026-112692)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in App Intents. A local application can access sensitive user data.
7) State issues (CVE-ID: CVE-2026-113914)
CWE-ID: CWE-371 - State Issues
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a state management issue in App Store. A local application can access sensitive user data.
8) Improper input validation (CVE-ID: CVE-2026-112690)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to escalate privileges on the system.
The vulnerability exists due to insufficient input validation in App Store. A remote attacker can trick the victim into opening a specially crafted file and break out of the WebContent sandbox.
9) Information disclosure (CVE-ID: CVE-2026-86987)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to insufficient protection of sensitive information in Apple Intelligence when the feature is accessed remotely. A remote attacker can exploit this information disclosure weakness to gain access to sensitive information.
10) Out-of-bounds write (CVE-ID: CVE-2026-112696)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to an out-of-bounds write in Apple Neural Engine. A local application can cause unexpected system termination or corrupt kernel memory.
11) Out-of-bounds write (CVE-ID: CVE-2026-84494)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to an out-of-bounds write in Apple Neural Engine. A local application can cause unexpected system termination or write kernel memory.
12) Out-of-bounds write (CVE-ID: CVE-2026-112416)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to an out-of-bounds write in AppleAVD. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.
13) Out-of-bounds write (CVE-ID: CVE-2026-112415)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to an out-of-bounds write in AppleAVD. A local application can cause unexpected system termination or corrupt process memory.
14) Memory corruption (CVE-ID: CVE-2026-112454)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error in AppleAVD. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination or corrupt process memory.
15) Memory corruption (CVE-ID: CVE-2026-112546)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in Audio. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.
16) Out-of-bounds write (CVE-ID: CVE-2026-112705)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to an out-of-bounds write in AVEVideoEncoder. A local application can cause unexpected system termination.
17) Out-of-bounds write (CVE-ID: CVE-2026-112689)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to an out-of-bounds write in AVEVideoEncoder. A local application can cause unexpected system termination or corrupt kernel memory.
18) Out-of-bounds write (CVE-ID: CVE-2026-112470)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to an out-of-bounds write in AVEVideoEncoder. A local application can cause unexpected system termination or corrupt kernel memory.
19) Out-of-bounds write (CVE-ID: CVE-2026-112469)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to an out-of-bounds write in AVEVideoEncoder. A local application can cause unexpected system termination or corrupt kernel memory.
20) Out-of-bounds write (CVE-ID: CVE-2026-112468)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to an out-of-bounds write in AVEVideoEncoder. A local application can cause unexpected system termination or corrupt kernel memory.
21) Improper input validation (CVE-ID: CVE-2026-112466)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation in AVEVideoEncoder. A local application can cause unexpected system termination or read kernel memory.
22) Improper input validation (CVE-ID: CVE-2026-112566)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows an attacker with physical access to the system to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation in Bluetooth. An attacker with physical access to the system can cause a denial-of-service.
23) Improper input validation (CVE-ID: CVE-2026-113906)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows an attacker with physical access to the system to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation in Bluetooth. An attacker with physical access to the system can cause a denial-of-service.
24) Permissions, privileges, and access controls (CVE-ID: CVE-2026-112678)
CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improperly imposed security restrictions in Calendar. A local application can access sensitive user data.
25) Out-of-bounds write (CVE-ID: CVE-2026-112619)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt memory, potentially causing a denial of service or arbitrary code execution.
The vulnerability exists due to an out-of-bounds write in the Calendar component of Apple macOS when processing input. A remote attacker can supply crafted input to trigger a write outside the intended memory boundaries, potentially causing a denial of service or arbitrary code execution.
26) State issues (CVE-ID: CVE-2026-112701)
CWE-ID: CWE-371 - State Issues
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a state management issue in CloudKit. A local application can access sensitive user data.
27) Improper access control (CVE-ID: CVE-2026-86988)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in ColorSync. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.
28) Memory corruption (CVE-ID: CVE-2026-113910)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a boundary error in Compression. A local application can disclose kernel memory.
29) Information disclosure (CVE-ID: CVE-2026-113908)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to exposure of sensitive information in the Contacts component of macOS when accessed by a local application. A local user can use a local application to gain unauthorized access to sensitive information.
30) Memory corruption (CVE-ID: CVE-2026-113912)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error in CoreAudio. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination or corrupt process memory.
31) Memory corruption (CVE-ID: CVE-2026-113907)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error in CoreAudio. A local application can cause unexpected system termination or corrupt process memory.
32) Buffer overflow (CVE-ID: CVE-2026-86972)
CWE-ID: CWE-120 - Buffer overflow
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to memory corruption in CoreAudio when processing crafted audio files. A remote attacker can trick the victim into opening a specially crafted file, trigger memory corruption and execute arbitrary code on the target system.
33) Out-of-bounds write (CVE-ID: CVE-2026-86969)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to an out-of-bounds write in CoreAudio. A local application can cause unexpected system termination or corrupt kernel memory.
34) Memory corruption (CVE-ID: CVE-2026-112638)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper restriction of operations within memory buffer bounds in CoreAudio when processing input. A local user can supply crafted input that triggers an invalid memory operation to cause a denial of service.
35) Out-of-bounds write (CVE-ID: CVE-2026-112611)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt memory, potentially causing a denial of service or enabling arbitrary code execution.
The vulnerability exists due to an out-of-bounds write in CoreGraphics when processing input. A remote attacker can supply specially crafted input to potentially write beyond the bounds of a memory buffer, causing a crash or enabling arbitrary code execution.
36) Out-of-bounds write (CVE-ID: CVE-2026-112610)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt memory, potentially causing a denial of service.
The vulnerability exists due to an out-of-bounds write in CoreGraphics when processing input. A remote attacker can supply specially crafted input to trigger a write outside the bounds of a memory buffer, potentially causing a denial of service.
37) Out-of-bounds write (CVE-ID: CVE-2026-113950)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to an out-of-bounds write in CoreGraphics. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination or corrupt process memory.
38) Memory corruption (CVE-ID: CVE-2026-86992)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in CoreMedia. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.
39) Permissions, privileges, and access controls (CVE-ID: CVE-2026-112706)
CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improperly imposed security restrictions in CoreMedia. A local application can access sensitive user data.
40) Memory corruption (CVE-ID: CVE-2026-112688)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in CoreMedia. A local application can trick the victim into opening a specially crafted file and perform an unexpected app termination or arbitrary code execution.
41) Information disclosure (CVE-ID: CVE-2026-86990)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to insufficient protection of sensitive information in the CoreMedia component when accessed by a local application. A local user can use a local application to access sensitive information.
42) Memory corruption (CVE-ID: CVE-2026-112656)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a boundary error in CoreText. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.
43) Information disclosure (CVE-ID: CVE-2026-113896)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to exposure of sensitive information in the FileProvider component of macOS when handling access from local applications. A local user can run a local application to gain access to sensitive information.
44) Information disclosure (CVE-ID: CVE-2026-112618)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an information exposure weakness in the Files component of macOS when handling access from a local application. A local user can use a local application to gain unauthorized access to sensitive information.
45) Improper input validation (CVE-ID: CVE-2026-86970)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to insufficient input validation in FontParser. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.
46) Out-of-bounds write (CVE-ID: CVE-2026-112683)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to an out-of-bounds write in FontParser. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination or corrupt process memory.
47) Memory corruption (CVE-ID: CVE-2026-112642)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a boundary error in FontParser. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.
48) Information exposure through log files (CVE-ID: CVE-2026-112432)
CWE-ID: CWE-532 - Information Exposure Through Log Files
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to inclusion of sensitive information into a log file in FontParser. A local application can access sensitive user data.
49) Improper access control (CVE-ID: CVE-2026-112518)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially gain unauthorized access to restricted resources.
The vulnerability exists due to improper access control in the Heimdal component of Apple macOS when enforcing access restrictions. A local user can attempt operations on restricted resources to potentially bypass intended access controls.
50) Out-of-bounds write (CVE-ID: CVE-2026-112456)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt memory, potentially causing a denial of service or arbitrary code execution.
The vulnerability exists due to an out-of-bounds write in the HFS component of Apple macOS when processing input. A remote attacker can supply specially crafted input to trigger a write outside the bounds of a memory buffer, potentially causing a denial of service or arbitrary code execution.
51) Improper access control (CVE-ID: CVE-2026-86978)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in HomeKit. A local application can access sensitive user data.
52) Memory corruption (CVE-ID: CVE-2026-112596)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in HomeKit. A remote attacker can trick the victim into opening a specially crafted file and perform unexpected system termination.
53) Memory corruption (CVE-ID: CVE-2026-112571)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a boundary error in ImageIO. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.
54) Memory corruption (CVE-ID: CVE-2026-112561)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a boundary error in ImageIO. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.
55) Memory corruption (CVE-ID: CVE-2026-112627)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a boundary error in ImageIO. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.
56) Memory corruption (CVE-ID: CVE-2026-112488)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to escalate privileges on the system.
The vulnerability exists due to a boundary error in ImageIO. A remote attacker can trick the victim into opening a specially crafted file and escalate privileges on the system.
57) Memory corruption (CVE-ID: CVE-2026-112634)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in ImageIO. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.
58) Memory corruption (CVE-ID: CVE-2026-112629)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in ImageIO. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.
59) Out-of-bounds write (CVE-ID: CVE-2026-112633)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to an out-of-bounds write in ImageIO. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.
60) Out-of-bounds write (CVE-ID: CVE-2026-112614)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to an out-of-bounds write in ImageIO. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.
61) Memory corruption (CVE-ID: CVE-2026-112632)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a boundary error in ImageIO. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.
62) Memory corruption (CVE-ID: CVE-2026-112630)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a boundary error in ImageIO. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.
63) Improper input validation (CVE-ID: CVE-2026-112625)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to potentially disrupt normal application behavior through improperly validated input.
The vulnerability exists due to improper input validation in ImageIO when processing input. A remote attacker can supply malformed input to potentially cause unexpected application behavior.
64) Memory corruption (CVE-ID: CVE-2026-112515)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper restriction of operations within the bounds of a memory buffer in IOHIDFamily when processing input. A local user can supply crafted input that triggers an invalid memory access to cause a denial of service.
65) Out-of-bounds write (CVE-ID: CVE-2026-65385)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to an out-of-bounds write in IOKit. A local application can perform a denial of service (DoS) attack.
66) State issues (CVE-ID: CVE-2026-112459)
CWE-ID: CWE-371 - State Issues
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a state management issue in IOMobileFrameBuffer. A local application can cause unexpected system termination or corrupt kernel memory.
67) Memory corruption (CVE-ID: CVE-2026-112554)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in IOStorageFamily. A local application can cause unexpected system termination or read kernel memory.
68) Improper privilege management (CVE-ID: CVE-2026-112477)
CWE-ID: CWE-269 - Improper Privilege Management
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to improper privilege management in the IOSurface component when handling operations initiated by a local application. A local user can run an application that exploits the component to escalate privileges on the system.
69) Improper input validation (CVE-ID: CVE-2026-112576)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially cause unintended kernel behavior through malformed input.
The vulnerability exists due to improper input validation in the macOS kernel when processing input from a local application. A local user can supply malformed input through a local application to potentially trigger unintended kernel behavior.
70) Memory corruption (CVE-ID: CVE-2026-112606)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in Kernel. A local application can cause unexpected system termination.
71) Use after free (CVE-ID: CVE-2026-65350)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a use-after-free error in Kernel. A local application can cause unexpected system termination or corrupt kernel memory.
72) Use after free (CVE-ID: CVE-2026-112679)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a use-after-free error in Kernel. A local application can cause unexpected system termination or corrupt kernel memory.
73) Use after free (CVE-ID: CVE-2026-112517)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a use-after-free error in Kernel. A local application can cause unexpected system termination or corrupt kernel memory.
74) Use after free (CVE-ID: CVE-2026-112516)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a use-after-free error in Kernel. A local application can cause unexpected system termination.
75) Use-after-free (CVE-ID: CVE-2026-112514)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to use-after-free in the macOS kernel when accessing previously freed memory. A local user can exploit references to freed memory to escalate privileges on the system.
76) Out-of-bounds write (CVE-ID: CVE-2026-112507)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to an out-of-bounds write in Kernel. A local application can cause unexpected system termination or write kernel memory.
77) Use after free (CVE-ID: CVE-2026-84495)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a use-after-free error in Kernel. A local application can cause unexpected system termination or write kernel memory.
78) Use after free (CVE-ID: CVE-2026-112474)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a use-after-free error in Kernel. A local application can cause unexpected system termination or write kernel memory.
79) Memory corruption (CVE-ID: CVE-2026-112698)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in Kernel. A local application can cause unexpected system termination.
80) State issues (CVE-ID: CVE-2026-112501)
CWE-ID: CWE-371 - State Issues
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a state management issue in Kernel. A local application can cause unexpected system termination.
81) Memory corruption (CVE-ID: CVE-2026-112476)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in Kernel. A local application can cause unexpected system termination.
82) State Issues (CVE-ID: CVE-2026-112665)
CWE-ID: CWE-371 - State Issues
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially cause incorrect kernel behavior.
The vulnerability exists due to improper state management in the macOS kernel when handling operations initiated by a local application. A local user can run a local application that exercises the affected functionality to potentially cause incorrect kernel behavior.
83) Improper access control (CVE-ID: CVE-2026-112624)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially gain unauthorized access to protected resources.
The vulnerability exists due to improper access control in the macOS kernel when handling operations initiated by a local application. A local user can run a local application that attempts operations without appropriate authorization checks to potentially access protected resources.
84) Out-of-bounds write (CVE-ID: CVE-2026-112522)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to an out-of-bounds write in libarchive. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.
85) Out-of-bounds write (CVE-ID: CVE-2026-112621)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt memory, potentially causing a denial of service or arbitrary code execution.
The vulnerability exists due to an out-of-bounds write in the LinkPresentation component of Apple macOS when processing input. A remote attacker can supply crafted input to cause writes outside the intended memory boundaries, potentially causing a denial of service or arbitrary code execution.
86) Improper access control (CVE-ID: CVE-2026-112500)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to bypass access restrictions, potentially gaining unauthorized access to protected resources.
The vulnerability exists due to improper access control in the Mail component of macOS when enforcing access restrictions. A local user can attempt operations that are not properly authorized to bypass intended access controls.
87) Improper input validation (CVE-ID: CVE-2026-112671)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation in Mail. A remote attacker can trick the victim into opening a specially crafted file and cause a denial-of-service.
88) Improper input validation (CVE-ID: CVE-2026-112414)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation in Mail. A remote attacker can trick the victim into opening a specially crafted file and perform a denial-of-service.
89) Information disclosure (CVE-ID: CVE-2026-112707)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output in Maps. A local application can identify what other apps a user has installed.
90) Memory corruption (CVE-ID: CVE-2026-112607)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to potentially corrupt memory and cause a denial of service.
The vulnerability exists due to improper restriction of operations within memory buffer boundaries in mDNSResponder when handling input. A remote attacker can supply specially crafted input to potentially trigger out-of-bounds memory access and disrupt the service.
91) Information disclosure (CVE-ID: CVE-2026-113915)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to an information disclosure weakness in the MediaAnalysis component when accessed by a local application. A local user can use a local application to obtain sensitive information.
92) Improper input validation (CVE-ID: CVE-2026-112687)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker on the local network to escalate privileges on the system.
The vulnerability exists due to insufficient input validation in MediaRemote. A remote attacker on the local network can cause unexpected system termination or corrupt process memory.
93) Improper input validation (CVE-ID: CVE-2026-112682)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation in Messages. A remote attacker can trick the victim into opening a specially crafted file and cause unexpected app termination.
94) State Issues (CVE-ID: CVE-2026-86989)
CWE-ID: CWE-371 - State Issues
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially cause unintended behavior by interfering with program state.
The vulnerability exists due to improper management of program state in MobileGestalt when the component is accessed by a local application. A local user can interact with the component through a local application to potentially trigger unintended state-dependent behavior.
95) Improper input validation (CVE-ID: CVE-2026-112565)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to potentially interfere with normal application behavior through improperly validated input.
The vulnerability exists due to improper input validation in the Model I/O component of macOS when processing input. A remote attacker can supply malformed input to potentially bypass expected input restrictions or trigger unintended processing behavior.
96) Improper input validation (CVE-ID: CVE-2026-112449)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass expected input constraints, potentially causing unintended application behavior.
The vulnerability exists due to improper input validation in Model I/O when processing input. A remote attacker can supply malformed input to bypass expected input constraints and potentially interfere with normal processing.
97) Memory corruption (CVE-ID: CVE-2026-112413)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in Model I/O. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.
98) Memory corruption (CVE-ID: CVE-2026-112485)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause memory corruption that may lead to a denial of service or arbitrary code execution.
The vulnerability exists due to improper restriction of operations within memory buffer boundaries in the Model I/O component of Apple macOS when processing input. A remote attacker can supply specially crafted input to potentially trigger out-of-bounds memory access, which may cause a crash or arbitrary code execution.
99) Out-of-bounds write (CVE-ID: CVE-2026-112461)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt memory, potentially causing a denial of service or arbitrary code execution.
The vulnerability exists due to an out-of-bounds write in Model I/O when processing input. A remote attacker can supply crafted input to potentially write outside the bounds of an allocated memory region and cause memory corruption.
100) Out-of-bounds write (CVE-ID: CVE-2026-112486)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to an out-of-bounds write in Model I/O. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.
101) State issues (CVE-ID: CVE-2026-65397)
CWE-ID: CWE-371 - State Issues
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a state management issue in Photos Storage. A local application can access sensitive user data.
102) Improper access control (CVE-ID: CVE-2026-112676)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in Photos Storage. A local application can access a user's Photos Library.
103) State Issues (CVE-ID: CVE-2026-112660)
CWE-ID: CWE-371 - State Issues
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially disrupt intended application behavior through improper state handling.
The vulnerability exists due to improper state management in Photos Storage when interacting with a local application. A local user can use a local application to exercise affected state-handling behavior, potentially causing the component to behave unexpectedly.
104) Improper access control (CVE-ID: CVE-2026-112681)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially gain unauthorized access to protected functionality.
The vulnerability exists due to improper access control in the macOS Power Management component when handling operations initiated by a local application. A local user can use a local application to potentially access functionality without the required authorization.
105) State issues (CVE-ID: CVE-2026-86925)
CWE-ID: CWE-371 - State Issues
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a state management issue in Quick Look. A local application can access sensitive user data.
106) Memory corruption (CVE-ID: CVE-2026-112491)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in RealityKit. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.
107) Improper access control (CVE-ID: CVE-2026-112547)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in ReplayKit. A local application can access sensitive user data.
108) Improper access control (CVE-ID: CVE-2026-112609)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in Safety Check. A local application can access sensitive user data.
109) Memory corruption (CVE-ID: CVE-2026-112425)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a boundary error in SceneKit. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.
110) Memory corruption (CVE-ID: CVE-2026-112423)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in SceneKit. A remote attacker can trick the victim into opening a specially crafted file and perform a denial-of-service or potentially disclose memory contents.
111) Out-of-bounds write (CVE-ID: CVE-2026-112464)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt memory, potentially causing a denial of service or arbitrary code execution.
The vulnerability exists due to an out-of-bounds write in SceneKit when processing input. A remote attacker can supply crafted input that triggers a write outside the bounds of a memory buffer to corrupt memory, potentially causing a crash or arbitrary code execution.
112) Memory corruption (CVE-ID: CVE-2026-86991)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in SceneKit. A remote attacker can trick the victim into opening a specially crafted file and perform unexpected process termination.
113) Information disclosure (CVE-ID: CVE-2026-112616)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to access sensitive information.
The vulnerability exists due to insufficient protection of sensitive information in Screen Time when accessed by a local application. A local user can use a local application to gain access to sensitive information.
114) Improper input validation (CVE-ID: CVE-2026-113913)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to insufficient input validation in Security. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.
115) State Issues (CVE-ID: CVE-2026-112652)
CWE-ID: CWE-371 - State Issues
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially bypass security restrictions.
The vulnerability exists due to improper state management in the macOS Security component when handling interactions from a local application. A local user can use a local application to exploit state-handling weaknesses to potentially bypass security restrictions.
116) State issues (CVE-ID: CVE-2026-112559)
CWE-ID: CWE-371 - State Issues
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a state management issue in Shortcuts. A local application can access sensitive user data.
117) State issues (CVE-ID: CVE-2026-112455)
CWE-ID: CWE-371 - State Issues
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a state management issue in Shortcuts. A local application can access sensitive user data.
118) Improper input validation (CVE-ID: CVE-2026-112658)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to insufficient input validation in Siri. A local application can access sensitive user data.
119) State issues (CVE-ID: CVE-2026-112685)
CWE-ID: CWE-371 - State Issues
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a state management issue in Siri. A local application can access sensitive user data.
120) UNIX symbolic link following (CVE-ID: CVE-2022-26704)
CWE-ID: CWE-61 - UNIX Symbolic Link (Symlink) Following
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a symlink following issue in Spotlight. A local user can create a specially crafted symbolic link to a critical file on the system and overwrite it with privileges of the application.
Successful exploitation of this vulnerability may result in privilege escalation.
121) Improper access control (CVE-ID: CVE-2026-112567)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to bypass access restrictions, potentially gaining unauthorized access to protected resources.
The vulnerability exists due to improper access control in Spotlight when interacting with a local application. A local user can use a local application to bypass access restrictions, potentially gaining unauthorized access to protected resources.
122) Information disclosure (CVE-ID: CVE-2026-112628)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to insufficient protection of sensitive information in Spotlight when handling access from a local application. A local user can use a local application to gain access to sensitive information.
123) Out-of-bounds write (CVE-ID: CVE-2026-112646)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to an out-of-bounds write in SpringBoard. A local application can cause unexpected system termination or corrupt process memory.
124) Out-of-bounds write (CVE-ID: CVE-2026-112691)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to an out-of-bounds write in SwiftUI. A local application can cause unexpected system termination.
125) Information disclosure (CVE-ID: CVE-2026-86968)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to insufficient protection of sensitive information in System Preferences when accessed by a local application. A local user can use a local application to obtain sensitive information.
126) State issues (CVE-ID: CVE-2026-84605)
CWE-ID: CWE-371 - State Issues
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a state management issue in TextKit. A local application can read the device's name.
127) Information disclosure (CVE-ID: CVE-2026-112595)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an attacker with physical access to system to gain access to sensitive information.
The vulnerability exists due to an unspecified weakness in the Thread component of Apple macOS when the system is accessed physically. An attacker with physical access to system can exploit this weakness through physical access to obtain sensitive information.
128) Memory corruption (CVE-ID: CVE-2026-112479)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper restriction of memory operations in the USB component of Apple macOS when processing input. A local user can supply input that triggers an invalid memory operation to cause a denial of service.
129) Use-after-free (CVE-ID: CVE-2026-113904)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to crash the browser.
The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
130) Use-after-free (CVE-ID: CVE-2026-112599)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to crash the browser.
The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
131) Type confusion (CVE-ID: CVE-2026-86974)
CWE-ID: CWE-843 - Type confusion
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a type confusion error in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a type confusion error and execute arbitrary code on the target system.
132) Use-after-free (CVE-ID: CVE-2026-86986)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to crash the browser.
The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
133) Use-after-free (CVE-ID: CVE-2026-112693)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to crash the browser.
The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
134) Input validation error (CVE-ID: CVE-2026-86985)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page and crash the browser.
135) Out-of-bounds read (CVE-ID: CVE-2026-112699)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and read contents of memory on the system.
136) Out-of-bounds read (CVE-ID: CVE-2026-112680)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in WebKit. A remote attacker can trick the victim into visiting a specially crafted website, trigger an out-of-bounds read error and read contents of memory on the system.
137) Use-after-free (CVE-ID: CVE-2026-112697)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page and execute arbitrary code on the system.
138) Use-after-free (CVE-ID: CVE-2026-112655)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page and execute arbitrary code on the system.
139) Use-after-free (CVE-ID: CVE-2026-112651)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page and execute arbitrary code on the system.
140) Use-after-free (CVE-ID: CVE-2026-112623)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page and execute arbitrary code on the system.
141) Race condition (CVE-ID: CVE-2026-112686)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to crash the browser.
The vulnerability exists due to a race condition in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page and crash the browser.
142) Input validation error (CVE-ID: CVE-2026-112684)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page and crash the browser.
143) Type confusion (CVE-ID: CVE-2026-112673)
CWE-ID: CWE-843 - Type confusion
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to crash the browser
The vulnerability exists due to a type confusion error in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
144) Race condition (CVE-ID: CVE-2026-112669)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to crash the browser.
The vulnerability exists due to a race condition in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page and crash the browser.
145) Use-after-free (CVE-ID: CVE-2026-112695)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to crash the browser.
The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
146) Use-after-free (CVE-ID: CVE-2026-112666)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to crash the browser.
The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
147) Use-after-free (CVE-ID: CVE-2026-112654)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to crash the browser.
The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
148) Use-after-free (CVE-ID: CVE-2026-112653)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to crash the browser.
The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
149) Use-after-free (CVE-ID: CVE-2026-112615)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to crash the browser.
The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
150) Type confusion (CVE-ID: CVE-2026-112659)
CWE-ID: CWE-843 - Type confusion
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a type confusion error in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a type confusion error and execute arbitrary code on the target system.
151) Use-after-free (CVE-ID: CVE-2026-112640)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and execute arbitrary code on the system.
152) Protection mechanism failure (CVE-ID: CVE-2026-113952)
CWE-ID: CWE-693 - Protection Mechanism Failure
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient implementation of security measures in WebKit. A remote attacker can force the browser to use a media format that should be restricted in Lockdown Mode.
153) Type confusion (CVE-ID: CVE-2026-113949)
CWE-ID: CWE-843 - Type confusion
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a type confusion error in WebKit. A remote attacker can trick the victim into visiting a specially crafted website, trigger a type confusion error and execute arbitrary code on the target system.
154) Use-after-free (CVE-ID: CVE-2026-113903)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and execute arbitrary code on the system.
155) Use-after-free (CVE-ID: CVE-2026-112637)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing HTML content in WebKit Canvas. A remote attacker can trick the victim into visiting a specially crafted website and execute arbitrary code on the system.
156) Use-after-free (CVE-ID: CVE-2026-112626)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing web content in WebKit JavaScript Bindings. A remote attacker can trick the victim into visiting a specially crafted website and execute arbitrary code on the system.
157) Protection mechanism failure (CVE-ID: CVE-2026-113897)
CWE-ID: CWE-693 - Protection Mechanism Failure
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient implementation of security measures in WebKit Process Model. A remote attacker can trick the victim into visiting a specially crafted website and break out of the web content sandbox.
158) Use-after-free (CVE-ID: CVE-2026-112639)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing HTML content in WebKit Process Model. A remote attacker can trick the victim into visiting a specially crafted website and execute arbitrary code on the system.
159) Use after free (CVE-ID: CVE-2026-113901)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a use-after-free error in WebRTC. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected process crash.
160) Memory corruption (CVE-ID: CVE-2026-86973)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in WebRTC. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected process crash.
161) Improper input validation (CVE-ID: CVE-2026-113909)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows an attacker with physical access to the system to escalate privileges on the system.
The vulnerability exists due to insufficient input validation in Wi-Fi. An attacker with physical access to the system can corrupt process memory.
162) Memory corruption (CVE-ID: CVE-2026-112622)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker on the local network to cause a denial of service.
The vulnerability exists due to improper restriction of memory operations in the Wi-Fi component of Apple macOS when handling input. A remote attacker on the local network can supply specially crafted input to trigger a memory safety error and cause a denial of service.
163) Improper input validation (CVE-ID: CVE-2026-112620)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker on the local network to cause a denial of service.
The vulnerability exists due to improper input validation in the Wi-Fi component of Apple macOS when processing input. A remote attacker on the local network can supply specially crafted input to cause a denial of service.
Remediation
Install update from vendor's website.