SB20261110323 - Multiple vulnerabilities in Apple visionOS

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261110323

SB20261110323 - Multiple vulnerabilities in Apple visionOS

Published: November 10, 2026

Security Bulletin ID SB20261110323
CSH Severity
High
Patch available
YES
Number of vulnerabilities 9
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 11% Medium 22% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 9 vulnerabilities.


1) State Issues (CVE-ID: CVE-2026-113968)

CWE-ID: CWE-371 - State Issues

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker on the local network to potentially disrupt the intended operation of AirPlay.

The vulnerability exists due to improper application state management in AirPlay when handling interactions over the local network. A remote attacker on the local network can interact with the affected component to potentially cause unexpected behavior through incorrectly managed application state.


2) Improper authorization (CVE-ID: CVE-2026-113963)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper authorization checks in App Intents. A local application can gain unauthorized access to sensitive user data. 


3) Use after free (CVE-ID: CVE-2026-113970)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker on the local network to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in Bluetooth. A remote attacker on the local network can corrupt process memory.


4) Out-of-bounds write (CVE-ID: CVE-2026-111497) Exploited

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to corrupt process memory, potentially execute arbitrary code, disclose process memory, or cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the Brotli decoder bundled with Node.js when an invalid block switch is treated as a temporary need for input rather than a permanent format error. A remote attacker can supply malformed Brotli data that an application decompresses with node:zlib to make the streaming decoder append bytes beyond an eight-byte internal buffer, potentially causing code execution, process memory disclosure, or a crash.


5) Improper access control (CVE-ID: CVE-2026-113965)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker on the local network to potentially gain unauthorized access to protected resources.

The vulnerability exists due to improper access control in the CoreUtils component of Apple macOS when access to protected resources is handled. A remote attacker on the local network can potentially bypass access restrictions from the local network to gain unauthorized access to protected resources.


6) State Issues (CVE-ID: CVE-2026-113964)

CWE-ID: CWE-371 - State Issues

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker on the local network to potentially cause incorrect application behavior through weaknesses in state handling.

The vulnerability exists due to improper state management in the CoreUtils component of macOS when handling state-dependent operations. A remote attacker on the local network can interact with the affected component over the local network to potentially interfere with its intended state handling.


7) Improper input validation (CVE-ID: CVE-2026-113961)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to potentially trigger unintended application behavior.

The vulnerability exists due to improper input validation in the Messages component of Apple macOS when processing externally supplied input. A remote attacker can submit malformed input to potentially trigger unintended application behavior.


8) Improper input validation (CVE-ID: CVE-2026-113960)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to insufficient input validation in Messages. A local user can access messages sent before they joined.


9) State Issues (CVE-ID: CVE-2026-113969)

CWE-ID: CWE-371 - State Issues

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local user to potentially disrupt intended application behavior through improper state handling.

The vulnerability exists due to improper state management in the macOS rapportd component when handling application state. A local user can potentially trigger incorrect state-dependent behavior to interfere with intended application operations.


Remediation

Install update from vendor's website.

References