SB2026102746 - Multiple vulnerabilities in Apple iOS 26 and iPadOS 26
Published: October 27, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 134 vulnerabilities.
1) Out-of-bounds write (CVE-ID: CVE-2026-86971)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to an out-of-bounds write in Accelerate Framework. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.
2) State issues (CVE-ID: CVE-2026-84493)
CWE-ID: CWE-371 - State Issues
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a state management issue in AccessorySetupKit. A local application can access Bluetooth without user consent.
3) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-113898)
CWE-ID: CWE-532 - Information Exposure Through Log Files
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially disclose sensitive information.
The vulnerability exists due to insertion of sensitive information into log files in the Accounts component of macOS when writing log entries. A local user can read sensitive data from these logs, if accessible, to obtain information that may otherwise be restricted.
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows an attacker with physical access to the system to escalate privileges on the system.
The vulnerability exists due to incorrect handling of path names in Accounts. An attacker with physical access to the system can trick the victim into opening a specially crafted file and read and write arbitrary files.
5) State issues (CVE-ID: CVE-2026-113914)
CWE-ID: CWE-371 - State Issues
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a state management issue in App Store. A local application can access sensitive user data.
6) Improper input validation (CVE-ID: CVE-2026-112690)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to escalate privileges on the system.
The vulnerability exists due to insufficient input validation in App Store. A remote attacker can trick the victim into opening a specially crafted file and break out of the WebContent sandbox.
7) State issues (CVE-ID: CVE-2026-86920)
CWE-ID: CWE-371 - State Issues
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a state management issue in Apple Intelligence. A local application can access sensitive user data.
8) Out-of-bounds write (CVE-ID: CVE-2026-112416)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to an out-of-bounds write in AppleAVD. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.
9) Out-of-bounds write (CVE-ID: CVE-2026-112415)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to an out-of-bounds write in AppleAVD. A local application can cause unexpected system termination or corrupt process memory.
10) Memory corruption (CVE-ID: CVE-2026-112546)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in Audio. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.
11) Out-of-bounds write (CVE-ID: CVE-2026-112705)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to an out-of-bounds write in AVEVideoEncoder. A local application can cause unexpected system termination.
12) Out-of-bounds write (CVE-ID: CVE-2026-112689)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to an out-of-bounds write in AVEVideoEncoder. A local application can cause unexpected system termination or corrupt kernel memory.
13) Out-of-bounds write (CVE-ID: CVE-2026-112470)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to an out-of-bounds write in AVEVideoEncoder. A local application can cause unexpected system termination or corrupt kernel memory.
14) Out-of-bounds write (CVE-ID: CVE-2026-112468)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to an out-of-bounds write in AVEVideoEncoder. A local application can cause unexpected system termination or corrupt kernel memory.
15) Out-of-bounds write (CVE-ID: CVE-2026-112469)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to an out-of-bounds write in AVEVideoEncoder. A local application can cause unexpected system termination or corrupt kernel memory.
16) Improper input validation (CVE-ID: CVE-2026-112466)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation in AVEVideoEncoder. A local application can cause unexpected system termination or read kernel memory.
17) Improper input validation (CVE-ID: CVE-2026-112566)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows an attacker with physical access to the system to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation in Bluetooth. An attacker with physical access to the system can cause a denial-of-service.
18) Improper input validation (CVE-ID: CVE-2026-113906)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows an attacker with physical access to the system to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation in Bluetooth. An attacker with physical access to the system can cause a denial-of-service.
19) Permissions, privileges, and access controls (CVE-ID: CVE-2026-112678)
CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improperly imposed security restrictions in Calendar. A local application can access sensitive user data.
20) State issues (CVE-ID: CVE-2026-112701)
CWE-ID: CWE-371 - State Issues
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a state management issue in CloudKit. A local application can access sensitive user data.
21) Memory corruption (CVE-ID: CVE-2026-113910)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a boundary error in Compression. A local application can disclose kernel memory.
22) Improper link resolution before file access ('link following') (CVE-ID: CVE-2026-86966)
CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to insecure symbolic link following in copyfile. A local application can modify protected parts of the file system.
23) Out-of-bounds write (CVE-ID: CVE-2026-86969)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to an out-of-bounds write in CoreAudio. A local application can cause unexpected system termination or corrupt kernel memory.
24) Memory corruption (CVE-ID: CVE-2026-113907)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error in CoreAudio. A local application can cause unexpected system termination or corrupt process memory.
25) Memory corruption (CVE-ID: CVE-2026-112638)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper restriction of operations within memory buffer bounds in CoreAudio when processing input. A local user can supply crafted input that triggers an invalid memory operation to cause a denial of service.
26) Buffer overflow (CVE-ID: CVE-2026-86972)
CWE-ID: CWE-120 - Buffer overflow
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to memory corruption in CoreAudio when processing crafted audio files. A remote attacker can trick the victim into opening a specially crafted file, trigger memory corruption and execute arbitrary code on the target system.
27) Out-of-bounds write (CVE-ID: CVE-2026-112610)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt memory, potentially causing a denial of service.
The vulnerability exists due to an out-of-bounds write in CoreGraphics when processing input. A remote attacker can supply specially crafted input to trigger a write outside the bounds of a memory buffer, potentially causing a denial of service.
28) Out-of-bounds write (CVE-ID: CVE-2026-112611)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt memory, potentially causing a denial of service or enabling arbitrary code execution.
The vulnerability exists due to an out-of-bounds write in CoreGraphics when processing input. A remote attacker can supply specially crafted input to potentially write beyond the bounds of a memory buffer, causing a crash or enabling arbitrary code execution.
29) Memory corruption (CVE-ID: CVE-2026-86992)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in CoreMedia. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.
30) Permissions, privileges, and access controls (CVE-ID: CVE-2026-112706)
CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improperly imposed security restrictions in CoreMedia. A local application can access sensitive user data.
31) Information disclosure (CVE-ID: CVE-2026-86990)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to insufficient protection of sensitive information in the CoreMedia component when accessed by a local application. A local user can use a local application to access sensitive information.
32) Memory corruption (CVE-ID: CVE-2026-112656)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a boundary error in CoreText. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.
33) Information disclosure (CVE-ID: CVE-2026-113896)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to exposure of sensitive information in the FileProvider component of macOS when handling access from local applications. A local user can run a local application to gain access to sensitive information.
34) Improper input validation (CVE-ID: CVE-2026-86970)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to insufficient input validation in FontParser. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.
35) Out-of-bounds write (CVE-ID: CVE-2026-112683)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to an out-of-bounds write in FontParser. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination or corrupt process memory.
36) Memory corruption (CVE-ID: CVE-2026-112642)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a boundary error in FontParser. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.
37) Memory corruption (CVE-ID: CVE-2026-86942)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in Heimdal. A local application can cause a denial-of-service.
38) Out-of-bounds write (CVE-ID: CVE-2026-112456)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt memory, potentially causing a denial of service or arbitrary code execution.
The vulnerability exists due to an out-of-bounds write in the HFS component of Apple macOS when processing input. A remote attacker can supply specially crafted input to trigger a write outside the bounds of a memory buffer, potentially causing a denial of service or arbitrary code execution.
39) Memory corruption (CVE-ID: CVE-2026-84627)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to potentially cause a denial of service.
The vulnerability exists due to improper restriction of operations within memory buffer boundaries in ImageIO when processing input. A remote attacker can supply specially crafted input that may trigger out-of-bounds memory access to cause a denial of service.
40) Memory corruption (CVE-ID: CVE-2026-112488)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to escalate privileges on the system.
The vulnerability exists due to a boundary error in ImageIO. A remote attacker can trick the victim into opening a specially crafted file and escalate privileges on the system.
41) Out-of-bounds write (CVE-ID: CVE-2026-64750)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt memory, potentially causing a denial of service or enabling arbitrary code execution.
The vulnerability exists due to an out-of-bounds write in ImageIO in Apple macOS when processing input. A remote attacker can supply specially crafted input to potentially trigger writes outside the intended memory boundaries and corrupt memory.
42) Memory corruption (CVE-ID: CVE-2026-112571)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a boundary error in ImageIO. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.
43) Memory corruption (CVE-ID: CVE-2026-112560)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a boundary error in ImageIO. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.
44) Memory corruption (CVE-ID: CVE-2026-112561)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a boundary error in ImageIO. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.
45) Memory corruption (CVE-ID: CVE-2026-112627)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a boundary error in ImageIO. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.
46) Improper input validation (CVE-ID: CVE-2026-64759)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to insufficient input validation in ImageIO. A remote attacker can trick the victim into opening a specially crafted file and perform arbitrary code execution.
47) Memory corruption (CVE-ID: CVE-2026-86954)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in ImageIO. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.
48) Memory corruption (CVE-ID: CVE-2026-112634)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in ImageIO. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.
49) Memory corruption (CVE-ID: CVE-2026-112629)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in ImageIO. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.
50) Memory corruption (CVE-ID: CVE-2026-112632)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a boundary error in ImageIO. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.
51) Memory corruption (CVE-ID: CVE-2026-112630)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a boundary error in ImageIO. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.
52) Improper input validation (CVE-ID: CVE-2026-112625)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to potentially disrupt normal application behavior through improperly validated input.
The vulnerability exists due to improper input validation in ImageIO when processing input. A remote attacker can supply malformed input to potentially cause unexpected application behavior.
53) Out-of-bounds write (CVE-ID: CVE-2026-112633)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to an out-of-bounds write in ImageIO. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.
54) Out-of-bounds write (CVE-ID: CVE-2026-112614)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to an out-of-bounds write in ImageIO. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.
55) Memory corruption (CVE-ID: CVE-2026-112515)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper restriction of operations within the bounds of a memory buffer in IOHIDFamily when processing input. A local user can supply crafted input that triggers an invalid memory access to cause a denial of service.
56) Out-of-bounds write (CVE-ID: CVE-2026-65385)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to an out-of-bounds write in IOKit. A local application can perform a denial of service (DoS) attack.
57) Memory corruption (CVE-ID: CVE-2026-112554)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in IOStorageFamily. A local application can cause unexpected system termination or read kernel memory.
58) Improper privilege management (CVE-ID: CVE-2026-112477)
CWE-ID: CWE-269 - Improper Privilege Management
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to improper privilege management in the IOSurface component when handling operations initiated by a local application. A local user can run an application that exploits the component to escalate privileges on the system.
59) Improper input validation (CVE-ID: CVE-2026-112576)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially cause unintended kernel behavior through malformed input.
The vulnerability exists due to improper input validation in the macOS kernel when processing input from a local application. A local user can supply malformed input through a local application to potentially trigger unintended kernel behavior.
60) Memory corruption (CVE-ID: CVE-2026-84599)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error in Kernel. A local application can cause unexpected system termination or corrupt kernel memory.
61) Memory corruption (CVE-ID: CVE-2026-112606)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in Kernel. A local application can cause unexpected system termination.
62) Memory corruption (CVE-ID: CVE-2026-112698)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in Kernel. A local application can cause unexpected system termination.
63) Memory corruption (CVE-ID: CVE-2026-112476)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in Kernel. A local application can cause unexpected system termination.
64) Use after free (CVE-ID: CVE-2026-65350)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a use-after-free error in Kernel. A local application can cause unexpected system termination or corrupt kernel memory.
65) Input validation error (CVE-ID: CVE-2019-5598)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to manipulate data.
In FreeBSD 11.3-PRERELEASE before r345378, 12.0-STABLE before r345377, 11.2-RELEASE before 11.2-RELEASE-p10, and 12.0-RELEASE before 12.0-RELEASE-p4, a bug in pf does not check if the outer ICMP or ICMP6 packet has the same destination IP as the source IP of the inner protocol packet allowing a maliciously crafted ICMP/ICMP6 packet could bypass the packet filter rules and be passed to a host that would otherwise be unavailable.
66) Use after free (CVE-ID: CVE-2026-112516)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a use-after-free error in Kernel. A local application can cause unexpected system termination.
67) Use after free (CVE-ID: CVE-2026-112517)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a use-after-free error in Kernel. A local application can cause unexpected system termination or corrupt kernel memory.
68) Use-after-free (CVE-ID: CVE-2026-112514)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to use-after-free in the macOS kernel when accessing previously freed memory. A local user can exploit references to freed memory to escalate privileges on the system.
69) Use after free (CVE-ID: CVE-2026-84495)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a use-after-free error in Kernel. A local application can cause unexpected system termination or write kernel memory.
70) State issues (CVE-ID: CVE-2026-112501)
CWE-ID: CWE-371 - State Issues
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a state management issue in Kernel. A local application can cause unexpected system termination.
71) State Issues (CVE-ID: CVE-2026-112665)
CWE-ID: CWE-371 - State Issues
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially cause incorrect kernel behavior.
The vulnerability exists due to improper state management in the macOS kernel when handling operations initiated by a local application. A local user can run a local application that exercises the affected functionality to potentially cause incorrect kernel behavior.
72) Improper access control (CVE-ID: CVE-2026-112624)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially gain unauthorized access to protected resources.
The vulnerability exists due to improper access control in the macOS kernel when handling operations initiated by a local application. A local user can run a local application that attempts operations without appropriate authorization checks to potentially access protected resources.
73) Out-of-bounds write (CVE-ID: CVE-2026-112522)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to an out-of-bounds write in libarchive. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.
74) Out-of-bounds write (CVE-ID: CVE-2026-112621)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt memory, potentially causing a denial of service or arbitrary code execution.
The vulnerability exists due to an out-of-bounds write in the LinkPresentation component of Apple macOS when processing input. A remote attacker can supply crafted input to cause writes outside the intended memory boundaries, potentially causing a denial of service or arbitrary code execution.
75) Improper input validation (CVE-ID: CVE-2026-112671)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation in Mail. A remote attacker can trick the victim into opening a specially crafted file and cause a denial-of-service.
76) Improper input validation (CVE-ID: CVE-2026-112414)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation in Mail. A remote attacker can trick the victim into opening a specially crafted file and perform a denial-of-service.
77) Information disclosure (CVE-ID: CVE-2026-112707)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output in Maps. A local application can identify what other apps a user has installed.
78) Information disclosure (CVE-ID: CVE-2026-113915)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to an information disclosure weakness in the MediaAnalysis component when accessed by a local application. A local user can use a local application to obtain sensitive information.
79) Improper access control (CVE-ID: CVE-2026-86880)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in MediaRemote. A local application can access sensitive user data.
80) Improper input validation (CVE-ID: CVE-2026-112682)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation in Messages. A remote attacker can trick the victim into opening a specially crafted file and cause unexpected app termination.
81) State Issues (CVE-ID: CVE-2026-86989)
CWE-ID: CWE-371 - State Issues
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially cause unintended behavior by interfering with program state.
The vulnerability exists due to improper management of program state in MobileGestalt when the component is accessed by a local application. A local user can interact with the component through a local application to potentially trigger unintended state-dependent behavior.
82) Memory corruption (CVE-ID: CVE-2026-112413)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in Model I/O. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.
83) Out-of-bounds write (CVE-ID: CVE-2026-112461)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt memory, potentially causing a denial of service or arbitrary code execution.
The vulnerability exists due to an out-of-bounds write in Model I/O when processing input. A remote attacker can supply crafted input to potentially write outside the bounds of an allocated memory region and cause memory corruption.
84) Improper input validation (CVE-ID: CVE-2026-112449)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass expected input constraints, potentially causing unintended application behavior.
The vulnerability exists due to improper input validation in Model I/O when processing input. A remote attacker can supply malformed input to bypass expected input constraints and potentially interfere with normal processing.
85) Out-of-bounds write (CVE-ID: CVE-2026-112486)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to an out-of-bounds write in Model I/O. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.
86) State issues (CVE-ID: CVE-2026-65397)
CWE-ID: CWE-371 - State Issues
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a state management issue in Photos Storage. A local application can access sensitive user data.
87) State Issues (CVE-ID: CVE-2026-112660)
CWE-ID: CWE-371 - State Issues
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially disrupt intended application behavior through improper state handling.
The vulnerability exists due to improper state management in Photos Storage when interacting with a local application. A local user can use a local application to exercise affected state-handling behavior, potentially causing the component to behave unexpectedly.
88) Improper access control (CVE-ID: CVE-2026-112676)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in Photos Storage. A local application can access a user's Photos Library.
89) Improper access control (CVE-ID: CVE-2026-112681)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially gain unauthorized access to protected functionality.
The vulnerability exists due to improper access control in the macOS Power Management component when handling operations initiated by a local application. A local user can use a local application to potentially access functionality without the required authorization.
90) Memory corruption (CVE-ID: CVE-2026-112491)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in RealityKit. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.
91) Memory corruption (CVE-ID: CVE-2026-112425)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a boundary error in SceneKit. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.
92) Memory corruption (CVE-ID: CVE-2026-112423)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in SceneKit. A remote attacker can trick the victim into opening a specially crafted file and perform a denial-of-service or potentially disclose memory contents.
93) Out-of-bounds write (CVE-ID: CVE-2026-112464)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt memory, potentially causing a denial of service or arbitrary code execution.
The vulnerability exists due to an out-of-bounds write in SceneKit when processing input. A remote attacker can supply crafted input that triggers a write outside the bounds of a memory buffer to corrupt memory, potentially causing a crash or arbitrary code execution.
94) Memory corruption (CVE-ID: CVE-2026-86991)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in SceneKit. A remote attacker can trick the victim into opening a specially crafted file and perform unexpected process termination.
95) Improper input validation (CVE-ID: CVE-2026-113913)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to insufficient input validation in Security. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.
96) Improper access control (CVE-ID: CVE-2026-65363)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to improper access restrictions in Security. A local application can break out of its sandbox.
97) Information disclosure (CVE-ID: CVE-2026-28864)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper access controls in the Security component when handling local requests. A local user can exploit this to disclose sensitive information.
Exploitation requires local access and no additional privileges beyond those of a standard user.
98) State Issues (CVE-ID: CVE-2026-112652)
CWE-ID: CWE-371 - State Issues
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially bypass security restrictions.
The vulnerability exists due to improper state management in the macOS Security component when handling interactions from a local application. A local user can use a local application to exploit state-handling weaknesses to potentially bypass security restrictions.
99) State issues (CVE-ID: CVE-2026-112559)
CWE-ID: CWE-371 - State Issues
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a state management issue in Shortcuts. A local application can access sensitive user data.
100) State issues (CVE-ID: CVE-2026-112455)
CWE-ID: CWE-371 - State Issues
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a state management issue in Shortcuts. A local application can access sensitive user data.
101) Improper access control (CVE-ID: CVE-2026-84614)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an attacker with physical access to the system to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in Siri. An attacker with physical access to the system can access contacts from the lock screen.
102) Information disclosure (CVE-ID: CVE-2026-112628)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to insufficient protection of sensitive information in Spotlight when handling access from a local application. A local user can use a local application to gain access to sensitive information.
103) Out-of-bounds write (CVE-ID: CVE-2026-112646)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to an out-of-bounds write in SpringBoard. A local application can cause unexpected system termination or corrupt process memory.
104) Out-of-bounds write (CVE-ID: CVE-2026-112691)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to an out-of-bounds write in SwiftUI. A local application can cause unexpected system termination.
105) State issues (CVE-ID: CVE-2026-84605)
CWE-ID: CWE-371 - State Issues
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a state management issue in TextKit. A local application can read the device's name.
106) State issues (CVE-ID: CVE-2026-84594)
CWE-ID: CWE-371 - State Issues
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a state management issue in UIKit. A local application can access sensitive user data.
107) Memory corruption (CVE-ID: CVE-2026-112479)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper restriction of memory operations in the USB component of Apple macOS when processing input. A local user can supply input that triggers an invalid memory operation to cause a denial of service.
108) Race condition (CVE-ID: CVE-2026-112686)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to crash the browser.
The vulnerability exists due to a race condition in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page and crash the browser.
109) Type confusion (CVE-ID: CVE-2026-86974)
CWE-ID: CWE-843 - Type confusion
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a type confusion error in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a type confusion error and execute arbitrary code on the target system.
110) Use-after-free (CVE-ID: CVE-2026-113904)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to crash the browser.
The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
111) Use-after-free (CVE-ID: CVE-2026-112697)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page and execute arbitrary code on the system.
112) Use-after-free (CVE-ID: CVE-2026-112651)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page and execute arbitrary code on the system.
113) Use-after-free (CVE-ID: CVE-2026-112623)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page and execute arbitrary code on the system.
114) Use-after-free (CVE-ID: CVE-2026-112655)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page and execute arbitrary code on the system.
115) Use-after-free (CVE-ID: CVE-2026-112693)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to crash the browser.
The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
116) Use-after-free (CVE-ID: CVE-2026-86986)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to crash the browser.
The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
117) Out-of-bounds read (CVE-ID: CVE-2026-112699)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and read contents of memory on the system.
118) Out-of-bounds read (CVE-ID: CVE-2026-112680)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in WebKit. A remote attacker can trick the victim into visiting a specially crafted website, trigger an out-of-bounds read error and read contents of memory on the system.
119) Input validation error (CVE-ID: CVE-2026-86985)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page and crash the browser.
120) Type confusion (CVE-ID: CVE-2026-112673)
CWE-ID: CWE-843 - Type confusion
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to crash the browser
The vulnerability exists due to a type confusion error in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
121) Input validation error (CVE-ID: CVE-2026-112684)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page and crash the browser.
122) Type confusion (CVE-ID: CVE-2026-112659)
CWE-ID: CWE-843 - Type confusion
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a type confusion error in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a type confusion error and execute arbitrary code on the target system.
123) Use-after-free (CVE-ID: CVE-2026-112695)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to crash the browser.
The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
124) Use-after-free (CVE-ID: CVE-2026-112653)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to crash the browser.
The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
125) Use-after-free (CVE-ID: CVE-2026-112654)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to crash the browser.
The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
126) Use-after-free (CVE-ID: CVE-2026-112615)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to crash the browser.
The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
127) Use-after-free (CVE-ID: CVE-2026-112640)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and execute arbitrary code on the system.
128) Protection mechanism failure (CVE-ID: CVE-2026-113952)
CWE-ID: CWE-693 - Protection Mechanism Failure
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient implementation of security measures in WebKit. A remote attacker can force the browser to use a media format that should be restricted in Lockdown Mode.
129) Type confusion (CVE-ID: CVE-2026-113949)
CWE-ID: CWE-843 - Type confusion
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a type confusion error in WebKit. A remote attacker can trick the victim into visiting a specially crafted website, trigger a type confusion error and execute arbitrary code on the target system.
130) Use-after-free (CVE-ID: CVE-2026-112626)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing web content in WebKit JavaScript Bindings. A remote attacker can trick the victim into visiting a specially crafted website and execute arbitrary code on the system.
131) Use-after-free (CVE-ID: CVE-2026-112639)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing HTML content in WebKit Process Model. A remote attacker can trick the victim into visiting a specially crafted website and execute arbitrary code on the system.
132) Memory corruption (CVE-ID: CVE-2026-86973)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in WebRTC. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected process crash.
133) Improper input validation (CVE-ID: CVE-2026-113909)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows an attacker with physical access to the system to escalate privileges on the system.
The vulnerability exists due to insufficient input validation in Wi-Fi. An attacker with physical access to the system can corrupt process memory.
134) Memory corruption (CVE-ID: CVE-2026-112622)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker on the local network to cause a denial of service.
The vulnerability exists due to improper restriction of memory operations in the Wi-Fi component of Apple macOS when handling input. A remote attacker on the local network can supply specially crafted input to trigger a memory safety error and cause a denial of service.
Remediation
Install update from vendor's website.