Apple
Monthly
Heap out-of-bounds write in FreeRDP's Apple audio-input (audin) backends affects macOS and iOS clients running versions 3.29.0 through 3.31.x, where a malicious or compromised RDP server can send an audin Open PDU with FramesPerPacket set to 2^30 to wrap a UINT32 buffer-size calculation and corrupt the heap. The vulnerable server interaction is unauthenticated from the RDP perspective (CVSS PR:N), but exploitation depends on the victim actively initiating an RDP session in which audio-input redirection is negotiated, so there is no drive-by or server-side vector and only Apple builds using audin_mac.m or audin_ios.m are exposed. No public exploit code has been identified at time of analysis, and there is no confirmation of active exploitation (CISA KEV).
Command injection in the NetBird desktop client (versions 0.60.0 through 0.74.6) lets a malicious or compromised peer inject arbitrary OpenSSH directives - including command-executing ones - into the system-wide drop-in config of other clients' Linux, macOS, Windows and FreeBSD hosts. Exploitation requires the attacker to control an enrolled peer whose crafted FQDN or hostname containing a double quote is distributed to the victim, and the injected command runs only when a local user subsequently invokes ssh, so peer membership plus a local user action are both prerequisites rather than an unauthenticated internet-facing attack. NetBird 0.74.7 fixes the issue by rejecting peer names that are not valid DNS names; no public exploit identified at time of analysis, and the Android and iOS apps are not affected.
Command injection in the VNote note-taking application before version 4.3.0 lets an attacker-controlled note filename execute arbitrary commands as the victim user on Linux and macOS, but only when the victim opens that note and has configured an external program whose arguments are command-capable, such as vim/gvim's -c option. The root cause is SessionConfig::ExternalProgram::fetchCommand, which wraps the note path in double quotes and hands the whole string to QProcess::start(const QString&), so a double quote inside a POSIX filename terminates the quoted path and appends attacker-chosen arguments to the configured program. The vendor fixed the issue in 4.3.0; no public exploit identified at time of analysis, and the CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.0) reflects full impact on confidentiality, integrity and availability once the narrow exploitation prerequisites are met.
Firefox for iOS versions prior to 157.1 interpolate a page's HTML lang attribute directly into the browser's translation JavaScript, so crafted markup in that attribute executes as code inside Firefox's privileged content world and escapes the page's Content Security Policy - a scope-changing outcome in the independent assessment. Exploitation is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N) but requires user interaction: the victim must open an attacker-controlled or compromised page and cause the page-translation feature to process it, and CISA's SSVC rates the flaw as not automatable. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV; the vendor fixed it in Firefox for iOS 157.1, so the practical priority is prompt upgrade rather than emergency response.
Local capability escalation in the macOS build of the DigiD app (Logius) lets an attacker who already holds user-level code execution on the same Mac inject an arbitrary dynamic library into the DigiD process and run code under the app's identity, reaching DigiD data and cryptographic operations the process would not normally expose - CVSS 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). The root cause is that the app binary is not signed with the Hardened Runtime flag, so the loader still honours DYLD_INSERT_LIBRARIES; this is a post-compromise escalation primitive, not a remote or initial-access bug, and it grants no privilege beyond the app's own context (S:U) and no availability impact. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV); a Hardened-Runtime-signed build blocks the injection path and is available per the vendor advisory pointing at the Mac App Store listing.
Persistent code execution on a penetration tester's workstation is achievable through a relative path traversal (CWE-22) in the Metasploit Framework post module post/apple_ios/gather/ios_image_gather, affecting versions prior to 6.5.5. A hostile or tampered iOS device can return a crafted directory-listing entry (for example ../../msfconsole.rc) that the module interpolates without sanitization into the local destination path handed to client.fs.file.download_file(), overwriting ~/.msf4/msfconsole.rc, which every msfconsole invocation automatically executes at startup; because the written resource file can load a second written Ruby plugin, this converts into an interactive shell as the operator (frequently root) at the next console launch. Exploitation is not remote-unauthenticated against a default service: it requires operator interaction (UI:R) to run the specific gather module against an attacker-controlled Meterpreter session, no workstation authentication (PR:N) is needed, and the assessed attack complexity is High because the hostile device, the specific module, and the resulting file write must all align; no public exploit code was identified at time of analysis, and the flaw is fixed in the 6.5.5 release.
VeraCrypt 1.26.29 (FUSE-T build) on macOS can leave a dismounted volume's decrypted contents readable, because VeraCrypt fails to terminate the FUSE-T auxiliary service (go-nfsv4) and its associated core-service helper processes, which keep serving the decrypted volume image (volume.dmg) over a loopback SMB session while retaining an open handle to the underlying raw device. An authenticated local user or process on the same host can then re-attach volume.dmg from the stale auxiliary mount, or simply reopen a previously accessed path (for example from the macOS Open Recent menu), and read the decrypted volume without supplying the passphrase again. The issue is specific to the FUSE-T build - the macFUSE build is explicitly unaffected - and requires that a volume was previously mounted and dismounted on that machine; no public exploit code and no confirmed active exploitation have been identified at time of analysis.
Local privilege escalation in Deskin 3.3.4.3 and earlier on macOS allows any local unprivileged process to gain full root by connecting to the root-owned com.deskin.service.installer XPC service, which performs no client authentication, and invoking its privileged installer method with an attacker-supplied installer package. Because the flaw (CWE-306) sits on a local Mach/IPC path, an attacker must already hold a local account or code-execution foothold on a host where Deskin is installed and the installer service is running, making it a post-compromise escalation primitive rather than an initial access vector. Publicly available exploit code exists (GitHub PoC, reported via VulnCheck) but there is no confirmed active exploitation (CISA KEV) at time of analysis; the submitted CVSS 4.0 score of 8.5 and the independently assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) both reflect high confidentiality, integrity and availability impact once the local prerequisite is satisfied.
Command injection in GitAhead 2.7.1 and earlier on macOS allows an attacker to execute arbitrary shell commands as the victim user by placing a crafted filename containing a double quote and AppleScript payload into a repository and convincing the victim to select 'Show in Finder' on that file. The flaw requires user interaction (the victim must open an attacker-controlled repository and explicitly trigger the action) and affects only macOS; no public exploit code or active exploitation has been identified at time of analysis. The CVSS 4.0 score is 8.7 with a vector indicating network attack, no privileges required, and passive user interaction.
Incorrect authorization in the Selection component of Google Chrome for iOS lets a remote, unauthenticated attacker obtain sensitive information when a victim opens a crafted HTML page, and the issue is resolved in Chrome 155.0.8059.39. Only the iOS build of Chrome below that version is in scope; desktop and Android builds are not named as affected, and exploitation requires the user to actively visit the attacker-controlled page (UI:R per the assessed vector). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so the practical risk is bounded by mandatory user interaction, the narrow iOS-only affected population, and the fact that a vendor fix already ships; note that the supplied base score of 8.8 (C:H/I:H/A:H) is inconsistent with both the Chromium 'Low' severity label and the assessed vector, which rates impact as confidentiality-only.
Sensitive-information disclosure in Google Chrome for iOS before 155.0.8059.39 allows a remote, unauthenticated attacker to abuse a missing authorization check by socially engineering a victim into opening a crafted HTML page. The independent assessment limits the impact to confidentiality (C:H/I:N/A:N), so this should be treated as an information disclosure issue rather than code execution or data tampering, and exploitation requires user interaction on the iOS build only. Vendor patch 155.0.8059.39 is available, and no public exploit code or CISA KEV active exploitation was identified in the supplied intelligence.
Sandbox escape in Google Chrome on iOS (versions prior to 155.0.8059.39) allows a local attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox via a local program. The flaw is an incorrect reference resolution (CWE-706) in the Passwords component, rated Medium by Chromium and carrying a CVSS 7.4 (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code or confirmed active exploitation has been identified at time of analysis; a vendor patch is available.
Improper input validation in the Mobile component of Google Chrome on iOS allows a remote attacker to potentially execute arbitrary code outside the browser sandbox when a victim is socially engineered into opening a crafted HTML page, fixed in Chrome 155.0.8059.39. Successful exploitation requires user interaction (CVSS vector PR:N/UI:R with S:C), meaning the attack hinges on phishing or a malicious link rather than a zero-click path, and the scope change reflects the assessed ability to escape the sandbox boundary. No public exploit code has been identified at time of analysis and the issue is not a confirmed actively exploited (CISA KEV) vulnerability, but the 9.6 CVSS score and the RCE tag make prompt patching of older mobile Chrome installations the priority.
Web origin policy bypass in Google Chrome's Navigation component on iOS allows a remote, unauthenticated attacker to escape intended origin boundaries and reach a privileged page when a victim opens a crafted HTML page. Exploitation is constrained by two factors: the mandatory user interaction (CVSS UI:R - the victim must actively load the malicious page) and the narrow platform scope, since only the iOS build of Chrome is affected rather than Chrome on other operating systems. Risk signals are modest - EPSS is 0.22% (12th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis - and Google has shipped a fix, so this is a moderate-priority issue rather than an urgent one.
Code injection in the Reader Mode feature of Google Chrome on iOS (versions prior to 155.0.8059.39) lets a remote, unauthenticated attacker bypass the web origin policy by convincing a victim to open a crafted HTML page in the browser. The flaw is confined to the iOS build and depends on social engineering to drive the victim to the malicious page, so effective user interaction is required; impact is limited to a partial confidentiality, integrity and availability loss through origin-policy circumvention rather than full system compromise. No public exploit code has been identified at time of analysis, EPSS is a low 0.27% (17th percentile), and the issue is not listed in CISA KEV, so despite the 7.3 High CVSS the real-world priority is low-to-moderate. Google has shipped a vendor patch, fixed in Chrome 155.0.8059.39.
Information disclosure in Google Chrome for iOS Autofill allows an attacker who lures a victim to a crafted HTML page to obtain sensitive form data that the browser failed to properly clear. Only Chrome for iOS builds prior to 155.0.8059.39 are affected; vulnerable instances require the Autofill feature to have been used so that sensitive data is actually present for the incomplete cleanup to expose. Exploitation requires no authentication (PR:N) but is gated by mandatory user interaction and social engineering (UI:R), meaning it cannot be triggered silently; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. Note that the vendor-assigned CVSS of 8.8 overstates the impact relative to our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5), which scores confidentiality impact only, with no integrity or availability effect.
Out-of-sandbox code execution in Google Chrome for iOS (versions prior to 155.0.8059.39) stems from a missing authorization check that lets a remote, unauthenticated attacker who socially engineers a victim into opening a crafted HTML page run arbitrary code outside the browser sandbox (CVSS 3.1 base 9.6, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, CWE-862). Exploitation is not possible without user interaction - the victim must navigate to or open attacker-controlled content on a vulnerable iOS Chrome build - and no public exploit code was identified at time of analysis, with no KEV confirmation of active exploitation. The combination of a scope-changing sandbox escape with high confidentiality, integrity, and availability impact makes this a high-priority browser flaw, but the mandatory user interaction and the narrow affected population (only unpatched iOS Chrome builds) keep it short of an emergency-patch situation.
Unauthenticated attackers can hijack arbitrary WordPress accounts, including administrators, on sites running the WPMobile.App - Android and iOS App Builder plugin (wpappninja) in all versions up to and including 11.82, because a missing authorization check exposes password-reset URLs that the plugin's push queue has mirrored from outbound emails. The issue carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and the assessed vector matches the vendor listing; exploitation is contingent on the non-default mail-to-push setting (wpmobile_auto_mail=1) being enabled and on a password-reset email existing in the queue, which an attacker can induce through WordPress's standard lost-password flow. No CISA KEV entry and no public exploit code were identified at time of analysis, so the flaw is not confirmed as actively exploited, but the combination of unauthenticated reach, low complexity, and full account-takeover impact makes it high priority wherever the prerequisite configuration is in place.
Out-of-bounds write in PeaZip's PEA archive extractor allows an attacker to execute arbitrary code with the privileges of the user who opens or extracts a crafted .pea file in PeaZip 11.2.0 and earlier, on Windows, Linux, macOS and BSD. The defect is in the first PCOMPRESS1 block: an attacker-controlled 32-bit compsize value is taken straight from the archive and used as both the blockread length and the copy-loop bound into fixed 1,114,112-byte global buffers, with no archive password, integrity tag or non-default configuration required. Exploitation is local and requires the victim to open or extract the archive (CVSS 3.1 AV:L/AC:L/PR:N/UI:R, C:H/I:H/A:H; CVSS 4.0 base 8.4), and no public exploit was identified at time of analysis, although the reporting researchers demonstrated code execution against the official Linux x86-64 and Windows x64 builds.
Untrusted-link activation inside an Ionic Capacitor app on Android or iOS can render attacker-controlled HTML at the application's own origin via the internal /_capacitor_http_interceptor_ proxy path, giving that script full same-origin access to storage, cookies and registered Capacitor plugin capabilities. Affected releases are 6.0.0 up to (but not including) 6.2.2, 7.6.9, 8.3.5, 8.4.3 and 8.5.1; exploitation requires the victim to activate an attacker-supplied link in the WebView (UI:R) but no authentication (PR:N) and no non-default feature flag, so apps are exposed even when the CapacitorHttp plugin is disabled because vulnerable builds serve the proxy path regardless of that setting. No public exploit code or confirmed active exploitation was identified at time of analysis, though the high CVSS score of 9.3 (S:C/C:H/I:H) and the broad mobile install base make patch urgency high.
Unauthenticated attackers can bypass authentication in Fleet (versions before 4.87.0) by using non-secret device identifiers like hostnames or hardware serials as tokens, allowing them to impersonate iOS/iPadOS hosts, read device data, and trigger device-scoped actions such as software installation and MDM migration. Exploitation requires knowledge of a valid identifier but no privileges or user interaction; no public exploit code has been identified at time of analysis. This is a high-priority vulnerability (CVSS 9.3) with a vendor patch available in version 4.87.0.
TeamViewer Full Client and Host on Windows, Linux, and macOS contain an improper access control flaw that allows authenticated session participants to bypass user-configured permission settings during session establishment, potentially leading to unauthorized actions or remote code execution. The vulnerability requires the attacker to be a session participant (PR:L) and the victim to accept the session (UI:R), and no public exploit code is identified at time of analysis. This is a moderately high-priority issue but not an emergency.
Heap-based buffer overflow in TeamViewer Full Client and Host for Linux and macOS before version 15.82 allows arbitrary code execution at the victim user's privilege level when a crafted .tvs session recording is opened through the 'Play or convert recorded session…' feature. Exploitation is gated by heavy prerequisites: the attacker must land the malicious file on the target host and socially engineer the user into opening it (CVSS 3.1 7.8, AV:L/AC:L/PR:N/UI:R), and the resulting code runs only as the current user with no privilege escalation and no network-reachable path. No public exploit code or confirmed active exploitation is identified at time of analysis, so real-world risk is materially below the raw score.
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code execution when a victim opens a maliciously crafted file, scoring CVSS 8.8 (AV:N/AC:L/PR:N/UI:R, CWE-787). Apple fixed the flaw in iOS 26.7.1, iPadOS 26.7.1, macOS Sequoia 15.8.1, and macOS Tahoe 26.7.1, and states it is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records an exploitation value of 'none' with the attack assessed as non-automatable.
OS command injection in Fleet's generator for Fleet-maintained macOS app install and uninstall scripts allows crafted Homebrew cask metadata containing shell metacharacters such as $(...) to be carried unescaped into scripts that run as root on managed macOS hosts. Manifests generated before 2026-08-19 are affected; the flaw is a supply-chain vector because the attacker needs no Fleet credentials, only the ability to land crafted metadata in an upstream Homebrew cask that must then survive both upstream Homebrew cask review and Fleet's review of the automated ingestion pull request before a managed host installs or uninstalls the app. The vendor CVSS 4.0 base is 8.9, but the vendor's own vector is PR:H while CERT's independent assessment scores it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, and the two independent review gates plus central, pre-built manifest distribution on 2026-08-19 sharply limit real-world exploitability; no public exploit code has been identified and there is no confirmed active exploitation (not in CISA KEV), so exploitation is assessed as difficult rather than imminent.
Authorization bypass in OpenClaw before 2026.8.1 lets an attacker reuse an already-approved executable with different arguments, so commands execute without a new approval prompt. The root of the flaw is that 'Allow Always' approvals granted for an exact command are persisted on macOS and Linux as path-only grants, meaning any later invocation of that same binary silently inherits the earlier approval. Exploitation is conditionally gated: an operator must first have granted Allow Always for at least one command, and the attacker must then steer the agent into invoking that binary with attacker-chosen arguments (typically via prompt or content injection), which is reflected in the high attack complexity and user-interaction metrics of the assessed vector rather than a pre-auth internet-facing entry point. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Credential theft in OpenClaw for iOS (versions >= 2026.7.1 and < 2026.8.11) lets a man-in-the-middle attacker who redirects the same Gateway host and port and presents a certificate that passes iOS system trust capture the injected Gateway token or password from the authenticated Terminal and session Dashboard WebViews, which - unlike native connections - failed to enforce the saved Gateway TLS fingerprint. The stolen credential can grant operator access, including reading sensitive Gateway state and invoking host-capable tools. No public exploit has been identified at time of analysis, and exploitation requires a prior accepted Gateway fingerprint, a network-adjacent MITM position, a validly trusted certificate for the host, and the victim opening the affected WebView, which substantially limits realistic risk to targeted adversaries despite the vendor's Critical 9.0 CVSS 4.0 rating.
Denial of service in Wire's Swift runtime (the SPM/CocoaPods 'Wire' product, implemented by wire-runtime-swift) lets an unauthenticated remote attacker abort a decoding process with a single 10-byte protobuf payload; all released Swift runtime versions through 6.4.0 and Wire 7 alphas through 7.0.0-alpha03 are affected. An unknown START_GROUP field wrapping a LENGTH_DELIMITED field whose varint decodes to a negative Int32 (for example -128) slips past a bounds check in ReadBuffer.readData(count:) that only validates the upper bound, and the negative count reaches Foundation's Data(bytes:count:), which traps with SIGTRAP instead of throwing the documented, catchable ProtoDecoder.Error. Publicly available exploit code exists (the vendor advisory ships a complete proof of concept), but there is no indication of active exploitation; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5) reflects a low-complexity remote availability impact confined to Swift applications that actually feed untrusted protobuf bytes to Wire's decoder.
Local privilege escalation in Foxit PDF Editor for macOS allows an attacker with a low-privilege foothold to execute arbitrary commands as root by tampering with a user-modifiable configuration value that the installer trusts during high-privilege upgrades. Exploitation requires local access, write access to the configuration value, and a privileged upgrade operation to be triggered, but no user interaction (UI:N) is needed. No public exploit code or active exploitation has been identified at time of analysis (no KEV, no POC).
OpenClaw iOS builds before 2026.8.11 write complete agent deep-link URLs - including persistent bearer keys - into the iOS unified log with public diagnostic visibility, so anyone who obtains a diagnostic archive (sysdiagnose bundle, device backup, or MDM-collected log set) can recover those keys and replay them inside forged deep links to submit agent requests without the normal on-device confirmation prompt. Exploitation is local and conditional rather than remote: the recovered bearer key must still be unrotated and valid at replay time, and the attacker must reconstruct a working forged deep link, which is why the assessed vector carries AV:L/AC:H (CVSS:3.1 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N). The status of this issue is that of a genuine but constrained credential-exposure flaw - no public exploit identified at time of analysis, no confirmed actively exploited (CISA KEV) activity, and a vendor patch shipping in 2026.8.11.
Stack-based buffer overflow in Fluent Bit's out_forward Secure Forward plugin (versions 0.11.0 through releases prior to 5.0.8) lets an attacker who controls or can impersonate the configured forwarding destination overwrite stack memory while Fluent Bit processes the handshake PONG response. The vulnerable path is only reachable when the out_forward output plugin is configured in Secure Forward mode with Shared_Key or Empty_Shared_Key - not the default output configuration - and the CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) plus the independent CVSS 3.1 assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) both characterize it as an unauthenticated network attack that depends on specific deployment preconditions. Impact ranges from reliable process termination on builds compiled with a stack canary to full remote code execution as the Fluent Bit process user on builds lacking canary protection or where a memory-disclosure primitive exists; the opt-in --supervisor mode with fork-only respawns further weakens hardened builds by preserving canary and address layout across restarts. No public exploit code has been identified at time of analysis, and the issue is fixed in version 5.0.8.
Kernel panic and NULL-pointer dereference in the Linux nvme-apple driver can crash Apple Silicon systems (e.g., Apple Mac mini M1) when an NVMe controller fails to initialize and is then immediately torn down, because the admin blk-mq queue allocated by blk_mq_alloc_queue() is never destroyed on that error path. The stale queue keeps its timeout timer and work armed, so blk_mq_timeout_work() later runs against freed state and oopses in percpu_ref_tryget_many after a WARN in blk_mq_release(). Our independent assessment rates this as a low-real-world-risk reliability defect rather than the vendor's high-severity base score: it is local-only, reachable exclusively on the failed-controller-plus-removal sequence (high attack complexity, low-privileged local context per the assessed vector AV:L/AC:H/PR:L), with no remote path and no public exploit identified at time of analysis.
Rsbuild versions before 2.0.9 contain a command injection flaw in the developer-server browser-launcher on macOS. The openBrowser() helper in packages/core/src/server/open.ts passes a URL through encodeURI() and then interpolates it into a string handed to child_process.exec(), and because encodeURI() leaves characters such as $, (, ), and ; untouched, a crafted URL is evaluated by /bin/sh and can execute arbitrary operating-system commands with the privileges of the developer running the dev server. The issue was fixed in the 2.0.9 release (upstream PR 7789), so a vendor-released patch is available; no CISA KEV listing or public exploit code was present in the supplied intelligence, and the attack requires local conditions on the developer machine.
MCPVault, a lightweight Model Context Protocol server that exposes Obsidian vault files to AI agents, fails to block access to restricted directories such as .git, .obsidian, and node_modules in versions prior to 0.11.4. PathFilter compiles its deny-list patterns case-sensitively and matches raw path segments, so on case-insensitive macOS and Windows filesystems variants like .Git/config or .GIT/config (and on Windows, trailing-dot/space forms such as .git./config) pass both isAllowed() and isAllowedForListing() while the operating system still opens the real restricted directory. An attacker who can influence a path selected by an AI agent can then read, write, move, search, or list sensitive repository and Obsidian metadata; no public exploit code or CISA KEV entry was identified at time of analysis.
Sandbox escape in Docker Sandboxes on macOS (0.28.0 through 0.41.x) lets a workload running inside a sandbox break out of its shared workspace and read or modify arbitrary files on the host as the VMM user, with host code execution possible where the reachable files are executable or otherwise privileged. The virtio-fs host server follows symlinks when reopening an unlinked file from a stored path, so a guest that replaces a parent directory of a workspace file with a symlink can redirect host-side file operations outside the workspace bind mount. Exploitation requires the attacker to already control a guest workload (for example an untrusted agent or repository), is macOS-specific, and depends on winning a directory-swap timing race; SSVC records Exploitation: none, and no public exploit code was identified at time of analysis. The raw 9.4 CVSS 4.0 score should be read alongside these preconditions rather than at face value - this is a genuine sandbox escape leading to host compromise, but it is not remotely reachable and is bounded by the privileges of the VMM user rather than root.
Apple iOS 18.7.10 and iPadOS 18.7.10 ship a fix for an input-validation flaw (CWE-20) that lets a remote attacker crash or otherwise deny service on unpatched devices, with Apple rating the impact as a full availability loss (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/A:H). Every iPhone or iPad still running a version below 18.7.10 is potentially affected. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is currently a patch-promptly issue rather than an emergency.
Local applications on macOS versions prior to 27 can escalate to root privileges because the operating system fails to properly validate entitlements before granting privileged operations (CWE-280). An attacker who can get a user to launch — or who can otherwise run — a crafted app on the target Mac gains full root-level control of the system, with high impact to confidentiality, integrity, and availability. The flaw is fixed in macOS Golden Gate 27 per Apple's advisory; no CISA KEV listing, no public exploit code, and no EPSS score were provided at time of analysis, so this is currently a patching-hygiene issue rather than a confirmed active threat.
A logic flaw in Apple macOS Sequoia, Tahoe, and Golden Gate allows an application running on the target Mac to force unexpected system termination, producing a denial-of-service condition that can crash the host and force a reboot. The flaw is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27 per Apple's advisories, and no public exploit code has been identified at time of analysis. EPSS is very low (0.17%, 6th percentile) and the issue is not listed in CISA KEV, so near-term mass exploitation is unlikely.
Kernel-level use-after-free in Apple's built-in NFS client allows memory corruption when a device connects to an attacker-operated NFS server, affecting iOS/iPadOS, macOS, tvOS, visionOS and watchOS. Exploitation requires the victim to mount or connect to a malicious NFS share (UI:R) but no credentials or privileges on the target device, making this a remote, unauthenticated-against-the-client attack that terminates in kernel memory corruption with high confidentiality, integrity and availability impact. No public exploit code and no CISA KEV listing were identified at time of analysis; EPSS is low at 0.18% (8th percentile), and CISA SSVC rates exploitation as none and automatable as no, though technical impact is total. Apple has released fixes in iOS 26.7/27, iPadOS 26.7/27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27.
Out-of-bounds write in Apple's file-parsing code affects iOS/iPadOS 27 and earlier, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27, allowing a maliciously crafted file to corrupt memory when processed. Apple addressed the flaw with improved bounds checking across all listed platforms, and CVSS 3.1 scores it 7.8 (AV:L/AC:L/PR:L/UI:N) with high confidentiality, integrity, and availability impact, even though the advisory text itself describes only unexpected app termination. No publicly available exploit code and no CISA KEV listing were identified at time of analysis, and EPSS is 0.18% (7th percentile), indicating low near-term exploitation likelihood.
Local privilege escalation in Apple macOS Sequoia (before 15.7.8) and macOS Tahoe (before 26.6) lets a malicious application already running as a normal user obtain root privileges. Apple addressed the flaw by adding restriction checks in its permission-handling code, disclosing it only as 'a permissions issue'; fixed versions are macOS Sequoia 15.7.8 and macOS Tahoe 26.6. There is no CISA KEV listing and no public exploit code identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', so this is a patching-during-normal-maintenance item rather than an emergency remote threat.
Out-of-bounds memory access in the macOS SMB client kernel component allows a malicious or compromised SMB server to corrupt kernel memory when a victim connects to it, resulting in unexpected system termination or potentially kernel-level code execution. All macOS releases prior to Sequoia 15.8, Tahoe 26.7, and Golden Gate 27 are affected. Apple has released fixed versions (support.apple.com advisories 149035, 149042, 149043); no public exploit code has been identified and EPSS is low at 0.17% (6th percentile), though the flaw is unauthenticated from the network perspective and requires only that the victim initiate an SMB connection.
Improper state management in Apple's operating systems (iOS/iPadOS, tvOS, visionOS, watchOS) allows a locally installed app to read a persistent account identifier that should have remained isolated, resulting in information disclosure. Affected platforms are all versions prior to the 27 release train on each OS. Vendor patches are available (iOS 27, iPadOS 27, tvOS 27, visionOS 27, watchOS 27), no public exploit code has been identified at time of analysis, and EPSS is very low (0.15%, 5th percentile). The supplied CVSS vector (AV:N/PR:N) does not match the description's local-app precondition, so treat the 7.5 score with caution.
Sandbox escape in Apple macOS lets a malicious or compromised application already running inside the macOS App Sandbox break out of that confinement and operate with privileges beyond what its sandbox profile permits (CVSS 3.1 base 8.4, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). Affected systems are macOS releases prior to Sequoia 15.8, Tahoe 26.7, and Golden Gate 27; exploitation requires the attacker to already have local code execution as a sandboxed app (for example, one the user installed and launched), and provides no remote initial access, functioning as a boundary-crossing primitive once code is running on the host. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS is 0.19% (9th percentile), so real-world activity appears limited, though the sandbox-boundary impact keeps this a serious local isolation flaw rather than a theoretical one.
An out-of-bounds write (CWE-787) in the Apple frameworks that parse 3D model files lets a maliciously crafted model corrupt memory when it is opened on an affected device, potentially giving the attacker code execution in the context of the processing application. The flaw affects iOS/iPadOS before 26.7 and 27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate 27, tvOS before 27, visionOS before 27 and watchOS before 27, and Apple has shipped fixes for all of them. Exploitation likelihood is low: EPSS is 0.17% (7th percentile), CISA SSVC records exploitation as 'none' and the vulnerability is not in KEV — no public exploit code has been identified, and the local attack vector with required user interaction makes mass exploitation unlikely.
Race condition in Apple's kernel state management lets a malicious sandboxed app escape its sandbox and execute arbitrary code with kernel privileges on iOS, iPadOS, macOS, tvOS, visionOS and watchOS. Exploitation requires a timing window to be won (CVSS AC:H) but no user interaction beyond launching the app, and success yields full control of the affected device. Apple shipped fixes in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27; no public exploit code or CISA KEV listing was present in the provided data, and no EPSS
A sandbox escape in Apple macOS allows a locally running sandboxed application to break out of its sandbox on unpatched versions below macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27, gaining full read, write, and execute privileges across the system. The flaw is a protection mechanism failure (CWE-693) in macOS sandbox enforcement logic, and the CVSS score of 8.8 reflects a scope change (S:C) with high confidentiality, integrity, and availability impact. No public exploit code or active exploitation is known at time of analysis, and EPSS is low at 0.17% (6th percentile).
Improper state management in Apple iOS, iPadOS, and watchOS allows an installed app to track a user across other apps and websites without the user's permission, effectively defeating the platform's cross-app tracking consent controls. The flaw affects iOS/iPadOS releases before 26.7 and before 27, plus watchOS before 27, and is remediated by the iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, and watchOS 27 updates. Exploitation requires a hostile app on the device rather than remote network access; EPSS is 0.15% (5th percentile), there is no CISA KEV listing or public exploit identified, and SSVC rates exploitation as 'none' with partial technical impact.
Improper handling of persistent identifiers in Apple's mobile and desktop operating systems allows an app installed on the device to recognize the same user across app reinstalls, defeating the identifier-reset behavior that users and administrators rely on for privacy. Apple states the issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, and visionOS 27, and the affected CPE set covers all earlier releases of iOS/iPadOS, macOS, and visionOS. No public exploit code or CISA KEV entry has been reported at time of analysis, and EPSS is only 0.16% (6th percentile), so this is a privacy-integrity hardening fix rather than an emergency remote-code-execution patch.
Kernel memory corruption in Apple macOS can be triggered when a user mounts a maliciously crafted disk image, causing unexpected system termination or corruption of kernel memory. Apple addressed the CWE-120 buffer overflow with improved bounds checking in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27. No public exploit code and no active exploitation have been identified, and the EPSS score is low (0.21%, 12th percentile), so practical exposure is dominated by local file-delivery scenarios rather than remote mass exploitation.
Sandboxed applications on Apple macOS can break out of their App Sandbox because of a logic error in the sandbox's validation checks, and Apple has fixed the issue in macOS 27 "Golden Gate". Any Mac running a macOS release earlier than 27 is affected, and successful exploitation gives a malicious app access to files, services, and resources it should never have been able to reach, matching the integrity-only impact (C:N/I:H) in the published vector. No public exploit code and no CISA KEV entry were identified at the time of analysis, and the EPSS score of 0.15% (5th percentile) suggests the flaw is not currently being exploited at scale.
Kernel-level out-of-bounds write (CWE-787) in the macOS SMB client stack allows a malicious SMB server to corrupt kernel memory when a target Mac connects to it, potentially yielding kernel code execution or a system crash. All macOS branches are affected: Sequoia before 15.8, Tahoe before 26.7, and macOS Golden Gate versions before 27. Apple has released patches for all three branches; there is no public exploit code identified, no CISA KEV listing, and EPSS is low (0.17%, 6th percentile), so exploitation is currently assessed as targeted/manual rather than widespread.
Local privilege escalation in Apple macOS lets a low-privileged local process obtain root via improper path validation (CWE-22), affecting macOS versions prior to Sequoia 15.8, Tahoe 26.7 and Golden Gate 27. Apple addressed the flaw with improved path validation, and the CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N, total CIA impact) reflects a reliable but non-automatable local escalation requiring an existing code-execution foothold. There is no CISA KEV listing and no public exploit identified at time of analysis; exploitation status is 'none' per CISA SSVC and the issue is not considered automatable.
A local sandbox-escape flaw in Apple macOS (CWE-284, improper access control via faulty state management) allows a malicious application to break out of its App Sandbox and operate outside the restricted environment it was granted. Affected versions are macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27, with Apple shipping fixes in all three (support.apple.com advisories 149035, 149042, 149043). CVSS 3.1 rates it 8.2 (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), but EPSS is only 0.19% (9th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis — so this is a high-severity, low-current-activity issue whose priority is driven by the App Sandbox being a core macOS security boundary rather than by observed exploitation.
Apple iOS and iPadOS before version 27 leak cross-application information through the handling of user preferences, allowing a locally installed app to enumerate which other apps are present on the device. Apple addressed the privacy flaw in iOS 27 and iPadOS 27; EPSS is only 0.17% (7th percentile), there is no CISA KEV listing, and no public exploit code identified at time of analysis. The practical impact is user profiling and device fingerprinting rather than code execution or data theft.
A race condition in Apple macOS (fixed in macOS Tahoe 26.6) allows a locally executed malicious application to escalate privileges and gain root on the host. The flaw is reachable by a low-privileged local process without user interaction beyond running the app, and it has a 7.8 CVSS base score reflecting total loss of confidentiality, integrity and availability for the vulnerable component. There is no CISA KEV listing, no vendor confirmation of in-the-wild exploitation, and no public exploit code identified at time of analysis; CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', indicating a targeted rather than wormable threat.
An out-of-bounds read in Apple's kernel (CWE-125) lets an app already running on the device read past the end of a kernel buffer, potentially leaking kernel memory or crashing the system. Affected platforms span iOS/iPadOS before 26.6.1, macOS Sequoia before 15.8, macOS Tahoe before 26.6.2, and tvOS, visionOS and watchOS before 27, with a CVSS 3.1 base of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H). There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is 0.20% (10th percentile), so this is a local, app-mediated kernel hardening issue rather than a remotely exploitable emergency.
Resource exhaustion in Apple macOS allows a remote, unauthenticated attacker to deny service to legitimate users by feeding input that the operating system fails to bound correctly. Apple fixed the flaw with improved input validation in macOS Tahoe 26.7, macOS Sequoia 15.8, and macOS Golden Gate 27. It is rated 7.5 with an availability-only impact (CWE-400), and while no public exploit code or observed exploitation has been identified, the attack is network-reachable and fully automatable per CISA's SSVC assessment.
Race condition in Apple's kernel allows a local user on iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27 to cause unexpected system termination or read kernel memory. Apple fixed the flaw with additional validation, publishing advisories 149034-149038; there is no public exploit code and no confirmed active exploitation (EPSS 0.16%, SSVC exploitation: none).
Kernel memory corruption in Apple macOS disk image handling allows an attacker to crash the system or corrupt kernel memory when a user mounts a maliciously crafted disk image; affected versions are all macOS releases before Sequoia 15.8, Tahoe 26.7, and Golden Gate 27. Exploitation requires the victim to actively mount the image (UI:R) with no authentication needed (PR:N), and no public exploit code has been identified at time of analysis. Apple has released fixes, and EPSS is low (0.21%, 12th percentile), making this a genuine but not urgent patch priority.
An out-of-bounds read in the macOS kernel NFS client can terminate the system or corrupt kernel memory when the host connects to a malicious NFS server, and it affects macOS releases before Golden Gate 27, Tahoe 26.7, and Sequoia 15.8. The vendor rates it 7.5 (AV:N/AC:L/PR:N/UI:N), while our assessment adjusts to require user interaction (UI:R) because the victim host must mount or auto-mount an attacker-controlled NFS export - this is a client-side, attacker-server-initiated condition, not a remote hit against a listening service. No public exploit code was identified at time of analysis and EPSS is 0.20% (10th percentile); demonstrated impact is availability only, since code execution is not established. Apple has released vendor fixes.
Processing a maliciously crafted disk image on an unpatched Apple macOS system can trigger an out-of-bounds read that terminates the affected application unexpectedly. The issue affects macOS releases before Golden Gate 27, Sequoia 15.8, and Tahoe 26.7, and requires a local user with no privileges (PR:N) to open or mount the crafted image, meaning user interaction (UI:R) is the trigger rather than remote network access. Apple has shipped fixes in the three affected release trains, and there is no public exploit identified at time of analysis; EPSS is low at 0.17% (6th percentile), reflecting the local, interaction-dependent nature of the issue.
Kernel memory corruption in the macOS Apple Filing Protocol client (afpfs) can be triggered when a user connects to a malicious AFP server, for example by following an afp:// link or using 'Connect to Server'; the underlying out-of-bounds write is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8 and macOS Tahoe 26.6. Exploitation is conditional rather than broadly wormable: the attacker is unauthenticated (PR:N) but must still induce the victim to initiate the AFP connection (UI:R), and any host running the patched builds is not affected. No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is low at 0.20% (10th percentile), so this is a genuine but socially mediated client-side kernel flaw rather than a mass-exploitation candidate.
An out-of-bounds read in Apple macOS lets a locally running application read kernel memory or trigger unexpected system termination, and is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27. Exploitation is bounded by the CVSS vector (AV:L/AC:L/PR:L/UI:N) - the attacker must already have code executing as a local app on the host and no user interaction is needed - making this a post-access information-disclosure and denial-of-service primitive rather than a remote entry point. EPSS is only 0.17% (6th percentile) and no public exploit has been identified at time of analysis, consistent with a genuine but non-urgent local privilege issue.
An out-of-bounds read in Apple macOS allows memory disclosure and potential denial-of-service when the system processes a maliciously crafted 3D file, and is addressed by improved bounds checking in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H, 7.1) confirms the path is local and unauthenticated but requires the victim to open or parse attacker-supplied content, so exploitation depends on social-engineering delivery rather than any remote/network-triggerable route. No public exploit code or confirmed active exploitation was identified at time of analysis, EPSS is a low 0.19% (9th percentile), and this is assessed as a moderate, not urgent, priority for fleets that have not yet patched.
An integer overflow in Apple macOS document processing can trigger an out-of-bounds read when a user opens a maliciously crafted file, resulting in potential disclosure of adjacent memory contents and/or a crash of the affected application. Affected versions are macOS releases below Golden Gate 27, below Tahoe 26.7, and below Sequoia 15.8; exploitation requires local handling of the crafted document plus mandatory user interaction (the victim must open the file), and no privileges are required per the CVSS vector (PR:N), but there is no remote or network-service exposure. Apple has released patched versions (Golden Gate 27, Tahoe 26.7, Sequoia 15.8), and no public exploit code or confirmed active exploitation has been identified at time of analysis; EPSS is 0.17% (6th percentile), consistent with a low-likelihood, user-interaction-dependent flaw, and the realistic impact is bounded to memory disclosure or denial of service rather than code execution.
An out-of-bounds memory access in the Apple kernel allows a locally installed app to crash the system or corrupt kernel memory on iOS/iPadOS, macOS, tvOS, visionOS, and watchOS releases prior to the 27-series. The flaw is reachable only by an attacker who already has code executing as an app on the device (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), for example a malicious, sideloaded, enterprise-provisioned, or trojanized application - there is no remote or unauthenticated network path, and no user interaction beyond launching the app is required. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS is 0.17% (7th percentile), and the realistic ceiling absent a follow-on kernel exploit chain is a device crash. Vendor patches are available in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.
Memory corruption during 3D model parsing on unpatched Apple platforms (iOS/iPadOS before 26.7 and 27, macOS Sequoia before 15.8 / Tahoe before 26.7 / Golden Gate 27, and tvOS, visionOS, watchOS before 27) allows an attacker who can get a victim to open or preview a maliciously crafted 3D model file to corrupt memory, potentially leading to code execution in the context of the parsing process with high confidentiality, integrity, and availability impact. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.3), so the practical barrier is user interaction - the target must parse the crafted asset locally; there is no remote unauthenticated network path, and no public exploit code has been identified at time of analysis (EPSS 0.20%, 10th percentile). Apple has shipped fixes; this is a genuine but moderate-priority issue rather than a top-tier emergency, since exploitation depends on social engineering plus a locally delivered file.
Local kernel memory corruption in Apple's 26.x operating-system family (iOS and iPadOS, macOS Tahoe, tvOS, visionOS, watchOS) allows an installed, running application to write to kernel memory or trigger unexpected system termination, with the flaw fixed in the 26.6 releases. The bug requires the victim to install and run a malicious or compromised app - it is not reachable over the network and needs no user interaction beyond launching that app (CVSS 7.8, AV:L/PR:L/UI:N) - and Apple's sandbox, notarization and App Review keep the delivery bar high, though a successful kernel-write primitive carries high confidentiality, integrity and availability impact. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and EPSS sits at 0.16% (6th percentile), indicating low near-term exploitation likelihood relative to the severity of the primitive itself.
A path traversal flaw (CWE-22) in Apple macOS is addressed by improved path validation and allows an attacker who controls a network directory server to execute arbitrary code with root privileges on a connecting client. Affected are macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27. Apple has shipped fixes in all three release trains. There is no public exploit code and no CISA KEV listing at time of analysis, and the CVSS 3.1 vector (7.8, AV:L/PR:L) reflects a local vector requiring the attacker to already hold a foothold as a directory service rather than a remote unauthenticated path.
Local sandbox authorization bypass in Apple macOS allows a malicious app already running on the target Mac to access user-sensitive data without proper authorization. Exploitation requires the user to run an untrusted application (UI:R) and affects macOS versions before Sequoia 15.8, Tahoe 26.7, and Golden Gate 27; the impact is limited to confidentiality disclosure with no integrity or availability effect. No public exploit was identified at time of analysis, EPSS is low at 0.19% (9th percentile), and vendor patches are available.
An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate), tvOS, visionOS, and watchOS - lets a remote attacker corrupt memory in an affected process, with the confirmed outcome being an application crash and the potential outcome being arbitrary code execution. Exploitation requires no authentication and no user interaction per the CVSS vector (AV:N/PR:N/UI:N), but the independent assessment rates attack complexity as High and the confirmed technical impact as limited to denial of service, because the specific component or content-processing surface that must be reached has not been documented and reliable code execution is unproven. Apple has released fixed builds for every affected platform, and no public exploit code or active exploitation has been identified at time of analysis; EPSS is a modest 0.99% (61st percentile), which is consistent with a patched, non-weaponized memory-safety defect rather than a top-tier emergency.
Integer overflow in the macOS kernel NFS client can be triggered when an unpatched Mac connects to or mounts a share from a malicious or spoofed NFS server, leading to kernel memory corruption or unexpected system termination. Affected systems are macOS releases below Sequoia 15.8, Tahoe 26.7, and Golden Gate 27 (CPE cpe:2.3:a:apple:macos). The flaw is availability-only (CVSS 3.1 base 7.5; our assessment AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), requires no credentials on the target but does require the victim to initiate an NFS client session, and is best exploited by an attacker positioned to serve or impersonate an NFS endpoint the victim reaches; no public exploit code has been identified at time of analysis, EPSS is low at 0.17% (6th percentile), and the issue is not in CISA KEV. Apple has released fixes, so patching removes the exposure entirely.
An out-of-bounds write in Apple macOS lets a malicious or compromised app running as a normal, unprivileged user corrupt memory and escalate to root privileges on the affected system. The flaw is fixed in macOS Golden Gate 27, macOS Tahoe 26.7, and macOS Sequoia 15.8; all earlier releases of those branches remain exposed (CWE-787, CVSS 7.8, AV:L/PR:L/UI:N). No public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' and non-automatable, so practical risk is currently confined to local post-compromise privilege escalation rather than mass remote attacks.
Sandbox escape in Apple iOS, iPadOS, and macOS allows a locally installed low-privileged malicious app to break out of its sandbox and gain elevated access to system resources, affecting iOS/iPadOS and macOS versions prior to 27 (macOS Golden Gate 27). Apple corrected the underlying permissions weakness (CWE-269, improper privilege management) by adding restrictions in the version 27 releases, so devices updated to iOS 27, iPadOS 27, or macOS Golden Gate 27 are remediated. The flaw is local-only with no remote or network trigger and requires the attacker to first get a malicious app onto the device; EPSS is 0.19% (8th percentile) and no public exploit identified at time of analysis, so risk is concentrated on devices that permit sideloaded, enterprise-provisioned, or otherwise untrusted applications.
Kernel out-of-bounds write in Apple macOS exFAT volume handling lets a local attacker who can get a maliciously crafted exFAT-formatted volume mounted - such as removable USB media or a disk image - trigger unexpected system termination (kernel panic) or disclose kernel memory. Only macOS builds below macOS Golden Gate 27 are affected; Apple fixed the flaw with improved bounds checking in macOS Golden Gate 27. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; EPSS is 0.14% (3rd percentile), and the attack is locally gated, requiring physical, removable-media, or delivery-based access rather than network reach.
Local privilege escalation in Apple macOS allows a malicious or compromised application already running on the system to obtain root privileges. The flaw is a permissions-handling defect (CWE-280) that Apple addressed by adding additional restrictions, with fixes shipping in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27. Exploitation requires local code execution as a normal user (AV:L, PR:L) and, per CISA SSVC, is not automatable with no known exploitation activity; no public exploit code or EPSS signal was provided at time of analysis.
Sandbox escape in Apple macOS (all releases prior to Golden Gate 27) allows an app already running inside the macOS App Sandbox to break out of its confinement by abusing improper symlink handling, fixed by Apple in macOS Golden Gate 27. The attacker must first get a malicious or compromised sandboxed app installed and running on the target (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, CWE-59), so there is no remote or network vector and no user interaction is required beyond launching the app. No public exploit code has been identified and the issue is not in CISA KEV; EPSS is 0.14% (4th percentile), indicating low near-term exploitation likelihood.
Authorization bypass in Apple macOS allows a malicious or compromised application already running on the system to access sensitive user data it should not be able to reach. All macOS releases below Golden Gate 27, Tahoe 26.7, and Sequoia 15.8 are affected; the flaw is rooted in missing authorization checks (CWE-862) that Apple addressed through improved permission validation. Per the independent assessment the practical attack path is local rather than remote - the attacker must first get an app onto the device and executed, with Gatekeeper, notarization, App Store review, and TCC prompts acting as added barriers - and impact is confined to confidentiality (data disclosure) with no integrity or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is low (0.19%, 9th percentile), so risk is driven primarily by the widespread install base rather than observed attacks.
Apple macOS contains a process-entitlement verification flaw (CVE-2026-65381) that lets a malicious application break out of the App Sandbox, escalating its reach beyond the container it is supposed to be confined to. Affected systems are macOS versions prior to Golden Gate 27, Sequoia 15.8, and Tahoe 26.7; exploitation requires the attacker to first get their app onto the host and have it launched locally, after which no further privileges or user interaction are needed (assessed vector AV:L/PR:N/UI:N/S:C). The impact is a genuine security-boundary crossing with high confidentiality, integrity, and availability consequences, but EPSS is only 0.19% (9th percentile) and no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis.
Improper authorization handling in Apple macOS lets a locally running app reach sensitive user data it should not be permitted to access, because the underlying authorization state is not managed correctly. The flaw affects macOS versions prior to Golden Gate 27, Tahoe 26.7, and Sequoia 15.8, and exploits require a malicious or compromised application to already be executing on the target Mac - the external CVSS score of 7.5 (AV:N) is inconsistent with the vendor description and with our assessed vector of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, which reflects a local, low-privileged precondition. No public exploit code has been identified at time of analysis and EPSS is 0.19% (9th percentile), though Apple has shipped fixes in the versions named above, so patching is the decisive control.
A use-after-free in Apple macOS kernel memory management allows a locally installed and executed app to escalate to kernel privileges and run arbitrary code with full system control. Affected releases are macOS before Sequoia 15.8, before Tahoe 26.7, and before Golden Gate 27; Apple shipped fixes in all three branches. The flaw is a local privilege escalation (CVSS 7.8, AV:L/PR:L) rather than a remote code execution bug, and there is no public exploit code or CISA KEV listing identified at time of analysis, so real-world exploitation currently depends on an attacker first getting a malicious app onto the target Mac.
Memory corruption in Apple's image-handling code across iOS 27, iPadOS 27, macOS Golden Gate 27 and visionOS 27 allows an attacker to achieve arbitrary code execution when a user processes a maliciously crafted image. Apple removed the vulnerable code entirely in the 27-generation releases, which are the only versions containing the fix; all earlier supported builds remain affected. The flaw is rated 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H), meaning exploitation needs local positioning plus some user interaction, and there is no public exploit code or CISA KEV entry identified at time of analysis.
Kernel memory corruption in Apple macOS before Sequoia 15.8, Golden Gate 27, and Tahoe 26.7 can be triggered by a remote attacker, leading to unexpected system termination or kernel memory corruption. Exploitation requires network reachability to an unidentified service with no authentication or user interaction, though the assessed attack complexity is high (AC:H) and the exact trigger surface is unconfirmed. Apple has released patched versions, and no public exploit code has been identified; EPSS is low at 0.29%.
Apple macOS contains a local privilege-escalation flaw in which an application running on the system can escalate to root because entitlement checks were insufficient. Apple addressed the issue with additional entitlement validation, fixing it in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27; earlier releases (pre-15.8, pre-26.7) remain vulnerable. The attack is local (CVSS AV:L) and requires the attacker to already have code running as an ordinary user, so exploitation is typically a second-stage payload delivered by a malicious app or initial social-engineering lope rather than a remote network attack. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied by the contributing sources.
Sign In With Apple state-management flaw in iOS, iPadOS, macOS, and visionOS lets a locally installed app hijack the authentication flow and obtain access to the victim's Apple Account. An attacker needs a malicious or compromised app already present on the device (AV:L) and the user must actively complete a Sign In With Apple prompt (UI:R), but no privileges or credentials are required by the app itself (PR:N), yielding high confidentiality and integrity impact on the linked Apple Account. Apple has shipped fixes in iOS/iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, and visionOS 27; EPSS is low at 0.24% (15th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis.
Local privilege escalation in Apple macOS lets an application running with standard user privileges obtain root, giving an attacker full control of the host once code executes on the machine. The flaw is an improper access-control check (CWE-284) that Apple addressed with improved validation logic, fixed in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27. No public exploit code has been identified and the vulnerability is not in CISA KEV; CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', so risk is concentrated in environments where untrusted local code can be executed.
Memory corruption in Apple macOS WebDAV client handling allows code execution when a user connects to an attacker-controlled WebDAV server, affecting macOS versions prior to Sequoia 15.8, Tahoe 26.7, and Golden Gate 27. The flaw is an out-of-bounds write (CWE-787) reachable over the network but gated by user interaction, rated 8.8 by Apple/NVD with an unauthenticated network attack vector. Apple has released fixes in three OS updates, and exploitation is not confirmed — no public exploit code and no CISA KEV listing — while EPSS sits at 0.18% (8th percentile), indicating low predicted mass-exploitation activity; this reads as a credible but targeted risk rather than a wormable event.
Device fingerprinting on Apple iOS and iPadOS before 26.7 (and before 27) lets a locally installed app defeat an authorization/state-management check and read a device-stable identifier it should not be able to obtain, weakening user privacy and enabling cross-app tracking or device re-identification. Exploitation requires an attacker to first get a malicious or privacy-invasive app onto the device (App Store distribution or sideloading), and the assessed impact is confidentiality-only - reading an identifier, with no code execution, data modification, or availability loss - so the vendor's CVSS 7.5 (AV:N/PR:N/I:H) overstates the practical risk relative to the assessed local, low-impact vector; this is a low real-world risk, confirmed patched by iOS/iPadOS 26.7 or 27, with no public exploit identified at time of analysis and a low EPSS score of 0.15% (5th percentile).
Unexpected system termination (denial of service) can be induced on Apple macOS by a malicious or crafted application running on the host, with the underlying cause classified as an improper authentication weakness (CWE-287) that Apple addressed through improved authentication logic. Affected builds are macOS Sequoia before 15.8, macOS Tahoe before 26.6, and macOS Golden Gate before 27; the independent assessment recalibrates the vendor's network-oriented vector to a local one (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning the attacker must first get code executing on the machine - no remote path, no privilege gain, no confidentiality or integrity loss, and no code execution beyond the crash. Exploitation requires both local access and a running malicious app, so practical risk is moderate rather than urgent: no public exploit code has been identified at time of analysis, EPSS is only 0.20% (10th percentile), and vendor-released patches (15.8, 26.6, 27) are available, though the CVE is tracked in the Apple/ENISA ecosystem (EUVD-2026-78030) and tagged as an authentication-bypass class issue.
Heap out-of-bounds write in FreeRDP's Apple audio-input (audin) backends affects macOS and iOS clients running versions 3.29.0 through 3.31.x, where a malicious or compromised RDP server can send an audin Open PDU with FramesPerPacket set to 2^30 to wrap a UINT32 buffer-size calculation and corrupt the heap. The vulnerable server interaction is unauthenticated from the RDP perspective (CVSS PR:N), but exploitation depends on the victim actively initiating an RDP session in which audio-input redirection is negotiated, so there is no drive-by or server-side vector and only Apple builds using audin_mac.m or audin_ios.m are exposed. No public exploit code has been identified at time of analysis, and there is no confirmation of active exploitation (CISA KEV).
Command injection in the NetBird desktop client (versions 0.60.0 through 0.74.6) lets a malicious or compromised peer inject arbitrary OpenSSH directives - including command-executing ones - into the system-wide drop-in config of other clients' Linux, macOS, Windows and FreeBSD hosts. Exploitation requires the attacker to control an enrolled peer whose crafted FQDN or hostname containing a double quote is distributed to the victim, and the injected command runs only when a local user subsequently invokes ssh, so peer membership plus a local user action are both prerequisites rather than an unauthenticated internet-facing attack. NetBird 0.74.7 fixes the issue by rejecting peer names that are not valid DNS names; no public exploit identified at time of analysis, and the Android and iOS apps are not affected.
Command injection in the VNote note-taking application before version 4.3.0 lets an attacker-controlled note filename execute arbitrary commands as the victim user on Linux and macOS, but only when the victim opens that note and has configured an external program whose arguments are command-capable, such as vim/gvim's -c option. The root cause is SessionConfig::ExternalProgram::fetchCommand, which wraps the note path in double quotes and hands the whole string to QProcess::start(const QString&), so a double quote inside a POSIX filename terminates the quoted path and appends attacker-chosen arguments to the configured program. The vendor fixed the issue in 4.3.0; no public exploit identified at time of analysis, and the CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.0) reflects full impact on confidentiality, integrity and availability once the narrow exploitation prerequisites are met.
Firefox for iOS versions prior to 157.1 interpolate a page's HTML lang attribute directly into the browser's translation JavaScript, so crafted markup in that attribute executes as code inside Firefox's privileged content world and escapes the page's Content Security Policy - a scope-changing outcome in the independent assessment. Exploitation is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N) but requires user interaction: the victim must open an attacker-controlled or compromised page and cause the page-translation feature to process it, and CISA's SSVC rates the flaw as not automatable. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV; the vendor fixed it in Firefox for iOS 157.1, so the practical priority is prompt upgrade rather than emergency response.
Local capability escalation in the macOS build of the DigiD app (Logius) lets an attacker who already holds user-level code execution on the same Mac inject an arbitrary dynamic library into the DigiD process and run code under the app's identity, reaching DigiD data and cryptographic operations the process would not normally expose - CVSS 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). The root cause is that the app binary is not signed with the Hardened Runtime flag, so the loader still honours DYLD_INSERT_LIBRARIES; this is a post-compromise escalation primitive, not a remote or initial-access bug, and it grants no privilege beyond the app's own context (S:U) and no availability impact. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV); a Hardened-Runtime-signed build blocks the injection path and is available per the vendor advisory pointing at the Mac App Store listing.
Persistent code execution on a penetration tester's workstation is achievable through a relative path traversal (CWE-22) in the Metasploit Framework post module post/apple_ios/gather/ios_image_gather, affecting versions prior to 6.5.5. A hostile or tampered iOS device can return a crafted directory-listing entry (for example ../../msfconsole.rc) that the module interpolates without sanitization into the local destination path handed to client.fs.file.download_file(), overwriting ~/.msf4/msfconsole.rc, which every msfconsole invocation automatically executes at startup; because the written resource file can load a second written Ruby plugin, this converts into an interactive shell as the operator (frequently root) at the next console launch. Exploitation is not remote-unauthenticated against a default service: it requires operator interaction (UI:R) to run the specific gather module against an attacker-controlled Meterpreter session, no workstation authentication (PR:N) is needed, and the assessed attack complexity is High because the hostile device, the specific module, and the resulting file write must all align; no public exploit code was identified at time of analysis, and the flaw is fixed in the 6.5.5 release.
VeraCrypt 1.26.29 (FUSE-T build) on macOS can leave a dismounted volume's decrypted contents readable, because VeraCrypt fails to terminate the FUSE-T auxiliary service (go-nfsv4) and its associated core-service helper processes, which keep serving the decrypted volume image (volume.dmg) over a loopback SMB session while retaining an open handle to the underlying raw device. An authenticated local user or process on the same host can then re-attach volume.dmg from the stale auxiliary mount, or simply reopen a previously accessed path (for example from the macOS Open Recent menu), and read the decrypted volume without supplying the passphrase again. The issue is specific to the FUSE-T build - the macFUSE build is explicitly unaffected - and requires that a volume was previously mounted and dismounted on that machine; no public exploit code and no confirmed active exploitation have been identified at time of analysis.
Local privilege escalation in Deskin 3.3.4.3 and earlier on macOS allows any local unprivileged process to gain full root by connecting to the root-owned com.deskin.service.installer XPC service, which performs no client authentication, and invoking its privileged installer method with an attacker-supplied installer package. Because the flaw (CWE-306) sits on a local Mach/IPC path, an attacker must already hold a local account or code-execution foothold on a host where Deskin is installed and the installer service is running, making it a post-compromise escalation primitive rather than an initial access vector. Publicly available exploit code exists (GitHub PoC, reported via VulnCheck) but there is no confirmed active exploitation (CISA KEV) at time of analysis; the submitted CVSS 4.0 score of 8.5 and the independently assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) both reflect high confidentiality, integrity and availability impact once the local prerequisite is satisfied.
Command injection in GitAhead 2.7.1 and earlier on macOS allows an attacker to execute arbitrary shell commands as the victim user by placing a crafted filename containing a double quote and AppleScript payload into a repository and convincing the victim to select 'Show in Finder' on that file. The flaw requires user interaction (the victim must open an attacker-controlled repository and explicitly trigger the action) and affects only macOS; no public exploit code or active exploitation has been identified at time of analysis. The CVSS 4.0 score is 8.7 with a vector indicating network attack, no privileges required, and passive user interaction.
Incorrect authorization in the Selection component of Google Chrome for iOS lets a remote, unauthenticated attacker obtain sensitive information when a victim opens a crafted HTML page, and the issue is resolved in Chrome 155.0.8059.39. Only the iOS build of Chrome below that version is in scope; desktop and Android builds are not named as affected, and exploitation requires the user to actively visit the attacker-controlled page (UI:R per the assessed vector). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so the practical risk is bounded by mandatory user interaction, the narrow iOS-only affected population, and the fact that a vendor fix already ships; note that the supplied base score of 8.8 (C:H/I:H/A:H) is inconsistent with both the Chromium 'Low' severity label and the assessed vector, which rates impact as confidentiality-only.
Sensitive-information disclosure in Google Chrome for iOS before 155.0.8059.39 allows a remote, unauthenticated attacker to abuse a missing authorization check by socially engineering a victim into opening a crafted HTML page. The independent assessment limits the impact to confidentiality (C:H/I:N/A:N), so this should be treated as an information disclosure issue rather than code execution or data tampering, and exploitation requires user interaction on the iOS build only. Vendor patch 155.0.8059.39 is available, and no public exploit code or CISA KEV active exploitation was identified in the supplied intelligence.
Sandbox escape in Google Chrome on iOS (versions prior to 155.0.8059.39) allows a local attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox via a local program. The flaw is an incorrect reference resolution (CWE-706) in the Passwords component, rated Medium by Chromium and carrying a CVSS 7.4 (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code or confirmed active exploitation has been identified at time of analysis; a vendor patch is available.
Improper input validation in the Mobile component of Google Chrome on iOS allows a remote attacker to potentially execute arbitrary code outside the browser sandbox when a victim is socially engineered into opening a crafted HTML page, fixed in Chrome 155.0.8059.39. Successful exploitation requires user interaction (CVSS vector PR:N/UI:R with S:C), meaning the attack hinges on phishing or a malicious link rather than a zero-click path, and the scope change reflects the assessed ability to escape the sandbox boundary. No public exploit code has been identified at time of analysis and the issue is not a confirmed actively exploited (CISA KEV) vulnerability, but the 9.6 CVSS score and the RCE tag make prompt patching of older mobile Chrome installations the priority.
Web origin policy bypass in Google Chrome's Navigation component on iOS allows a remote, unauthenticated attacker to escape intended origin boundaries and reach a privileged page when a victim opens a crafted HTML page. Exploitation is constrained by two factors: the mandatory user interaction (CVSS UI:R - the victim must actively load the malicious page) and the narrow platform scope, since only the iOS build of Chrome is affected rather than Chrome on other operating systems. Risk signals are modest - EPSS is 0.22% (12th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis - and Google has shipped a fix, so this is a moderate-priority issue rather than an urgent one.
Code injection in the Reader Mode feature of Google Chrome on iOS (versions prior to 155.0.8059.39) lets a remote, unauthenticated attacker bypass the web origin policy by convincing a victim to open a crafted HTML page in the browser. The flaw is confined to the iOS build and depends on social engineering to drive the victim to the malicious page, so effective user interaction is required; impact is limited to a partial confidentiality, integrity and availability loss through origin-policy circumvention rather than full system compromise. No public exploit code has been identified at time of analysis, EPSS is a low 0.27% (17th percentile), and the issue is not listed in CISA KEV, so despite the 7.3 High CVSS the real-world priority is low-to-moderate. Google has shipped a vendor patch, fixed in Chrome 155.0.8059.39.
Information disclosure in Google Chrome for iOS Autofill allows an attacker who lures a victim to a crafted HTML page to obtain sensitive form data that the browser failed to properly clear. Only Chrome for iOS builds prior to 155.0.8059.39 are affected; vulnerable instances require the Autofill feature to have been used so that sensitive data is actually present for the incomplete cleanup to expose. Exploitation requires no authentication (PR:N) but is gated by mandatory user interaction and social engineering (UI:R), meaning it cannot be triggered silently; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. Note that the vendor-assigned CVSS of 8.8 overstates the impact relative to our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5), which scores confidentiality impact only, with no integrity or availability effect.
Out-of-sandbox code execution in Google Chrome for iOS (versions prior to 155.0.8059.39) stems from a missing authorization check that lets a remote, unauthenticated attacker who socially engineers a victim into opening a crafted HTML page run arbitrary code outside the browser sandbox (CVSS 3.1 base 9.6, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, CWE-862). Exploitation is not possible without user interaction - the victim must navigate to or open attacker-controlled content on a vulnerable iOS Chrome build - and no public exploit code was identified at time of analysis, with no KEV confirmation of active exploitation. The combination of a scope-changing sandbox escape with high confidentiality, integrity, and availability impact makes this a high-priority browser flaw, but the mandatory user interaction and the narrow affected population (only unpatched iOS Chrome builds) keep it short of an emergency-patch situation.
Unauthenticated attackers can hijack arbitrary WordPress accounts, including administrators, on sites running the WPMobile.App - Android and iOS App Builder plugin (wpappninja) in all versions up to and including 11.82, because a missing authorization check exposes password-reset URLs that the plugin's push queue has mirrored from outbound emails. The issue carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and the assessed vector matches the vendor listing; exploitation is contingent on the non-default mail-to-push setting (wpmobile_auto_mail=1) being enabled and on a password-reset email existing in the queue, which an attacker can induce through WordPress's standard lost-password flow. No CISA KEV entry and no public exploit code were identified at time of analysis, so the flaw is not confirmed as actively exploited, but the combination of unauthenticated reach, low complexity, and full account-takeover impact makes it high priority wherever the prerequisite configuration is in place.
Out-of-bounds write in PeaZip's PEA archive extractor allows an attacker to execute arbitrary code with the privileges of the user who opens or extracts a crafted .pea file in PeaZip 11.2.0 and earlier, on Windows, Linux, macOS and BSD. The defect is in the first PCOMPRESS1 block: an attacker-controlled 32-bit compsize value is taken straight from the archive and used as both the blockread length and the copy-loop bound into fixed 1,114,112-byte global buffers, with no archive password, integrity tag or non-default configuration required. Exploitation is local and requires the victim to open or extract the archive (CVSS 3.1 AV:L/AC:L/PR:N/UI:R, C:H/I:H/A:H; CVSS 4.0 base 8.4), and no public exploit was identified at time of analysis, although the reporting researchers demonstrated code execution against the official Linux x86-64 and Windows x64 builds.
Untrusted-link activation inside an Ionic Capacitor app on Android or iOS can render attacker-controlled HTML at the application's own origin via the internal /_capacitor_http_interceptor_ proxy path, giving that script full same-origin access to storage, cookies and registered Capacitor plugin capabilities. Affected releases are 6.0.0 up to (but not including) 6.2.2, 7.6.9, 8.3.5, 8.4.3 and 8.5.1; exploitation requires the victim to activate an attacker-supplied link in the WebView (UI:R) but no authentication (PR:N) and no non-default feature flag, so apps are exposed even when the CapacitorHttp plugin is disabled because vulnerable builds serve the proxy path regardless of that setting. No public exploit code or confirmed active exploitation was identified at time of analysis, though the high CVSS score of 9.3 (S:C/C:H/I:H) and the broad mobile install base make patch urgency high.
Unauthenticated attackers can bypass authentication in Fleet (versions before 4.87.0) by using non-secret device identifiers like hostnames or hardware serials as tokens, allowing them to impersonate iOS/iPadOS hosts, read device data, and trigger device-scoped actions such as software installation and MDM migration. Exploitation requires knowledge of a valid identifier but no privileges or user interaction; no public exploit code has been identified at time of analysis. This is a high-priority vulnerability (CVSS 9.3) with a vendor patch available in version 4.87.0.
TeamViewer Full Client and Host on Windows, Linux, and macOS contain an improper access control flaw that allows authenticated session participants to bypass user-configured permission settings during session establishment, potentially leading to unauthorized actions or remote code execution. The vulnerability requires the attacker to be a session participant (PR:L) and the victim to accept the session (UI:R), and no public exploit code is identified at time of analysis. This is a moderately high-priority issue but not an emergency.
Heap-based buffer overflow in TeamViewer Full Client and Host for Linux and macOS before version 15.82 allows arbitrary code execution at the victim user's privilege level when a crafted .tvs session recording is opened through the 'Play or convert recorded session…' feature. Exploitation is gated by heavy prerequisites: the attacker must land the malicious file on the target host and socially engineer the user into opening it (CVSS 3.1 7.8, AV:L/AC:L/PR:N/UI:R), and the resulting code runs only as the current user with no privilege escalation and no network-reachable path. No public exploit code or confirmed active exploitation is identified at time of analysis, so real-world risk is materially below the raw score.
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code execution when a victim opens a maliciously crafted file, scoring CVSS 8.8 (AV:N/AC:L/PR:N/UI:R, CWE-787). Apple fixed the flaw in iOS 26.7.1, iPadOS 26.7.1, macOS Sequoia 15.8.1, and macOS Tahoe 26.7.1, and states it is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records an exploitation value of 'none' with the attack assessed as non-automatable.
OS command injection in Fleet's generator for Fleet-maintained macOS app install and uninstall scripts allows crafted Homebrew cask metadata containing shell metacharacters such as $(...) to be carried unescaped into scripts that run as root on managed macOS hosts. Manifests generated before 2026-08-19 are affected; the flaw is a supply-chain vector because the attacker needs no Fleet credentials, only the ability to land crafted metadata in an upstream Homebrew cask that must then survive both upstream Homebrew cask review and Fleet's review of the automated ingestion pull request before a managed host installs or uninstalls the app. The vendor CVSS 4.0 base is 8.9, but the vendor's own vector is PR:H while CERT's independent assessment scores it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, and the two independent review gates plus central, pre-built manifest distribution on 2026-08-19 sharply limit real-world exploitability; no public exploit code has been identified and there is no confirmed active exploitation (not in CISA KEV), so exploitation is assessed as difficult rather than imminent.
Authorization bypass in OpenClaw before 2026.8.1 lets an attacker reuse an already-approved executable with different arguments, so commands execute without a new approval prompt. The root of the flaw is that 'Allow Always' approvals granted for an exact command are persisted on macOS and Linux as path-only grants, meaning any later invocation of that same binary silently inherits the earlier approval. Exploitation is conditionally gated: an operator must first have granted Allow Always for at least one command, and the attacker must then steer the agent into invoking that binary with attacker-chosen arguments (typically via prompt or content injection), which is reflected in the high attack complexity and user-interaction metrics of the assessed vector rather than a pre-auth internet-facing entry point. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Credential theft in OpenClaw for iOS (versions >= 2026.7.1 and < 2026.8.11) lets a man-in-the-middle attacker who redirects the same Gateway host and port and presents a certificate that passes iOS system trust capture the injected Gateway token or password from the authenticated Terminal and session Dashboard WebViews, which - unlike native connections - failed to enforce the saved Gateway TLS fingerprint. The stolen credential can grant operator access, including reading sensitive Gateway state and invoking host-capable tools. No public exploit has been identified at time of analysis, and exploitation requires a prior accepted Gateway fingerprint, a network-adjacent MITM position, a validly trusted certificate for the host, and the victim opening the affected WebView, which substantially limits realistic risk to targeted adversaries despite the vendor's Critical 9.0 CVSS 4.0 rating.
Denial of service in Wire's Swift runtime (the SPM/CocoaPods 'Wire' product, implemented by wire-runtime-swift) lets an unauthenticated remote attacker abort a decoding process with a single 10-byte protobuf payload; all released Swift runtime versions through 6.4.0 and Wire 7 alphas through 7.0.0-alpha03 are affected. An unknown START_GROUP field wrapping a LENGTH_DELIMITED field whose varint decodes to a negative Int32 (for example -128) slips past a bounds check in ReadBuffer.readData(count:) that only validates the upper bound, and the negative count reaches Foundation's Data(bytes:count:), which traps with SIGTRAP instead of throwing the documented, catchable ProtoDecoder.Error. Publicly available exploit code exists (the vendor advisory ships a complete proof of concept), but there is no indication of active exploitation; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5) reflects a low-complexity remote availability impact confined to Swift applications that actually feed untrusted protobuf bytes to Wire's decoder.
Local privilege escalation in Foxit PDF Editor for macOS allows an attacker with a low-privilege foothold to execute arbitrary commands as root by tampering with a user-modifiable configuration value that the installer trusts during high-privilege upgrades. Exploitation requires local access, write access to the configuration value, and a privileged upgrade operation to be triggered, but no user interaction (UI:N) is needed. No public exploit code or active exploitation has been identified at time of analysis (no KEV, no POC).
OpenClaw iOS builds before 2026.8.11 write complete agent deep-link URLs - including persistent bearer keys - into the iOS unified log with public diagnostic visibility, so anyone who obtains a diagnostic archive (sysdiagnose bundle, device backup, or MDM-collected log set) can recover those keys and replay them inside forged deep links to submit agent requests without the normal on-device confirmation prompt. Exploitation is local and conditional rather than remote: the recovered bearer key must still be unrotated and valid at replay time, and the attacker must reconstruct a working forged deep link, which is why the assessed vector carries AV:L/AC:H (CVSS:3.1 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N). The status of this issue is that of a genuine but constrained credential-exposure flaw - no public exploit identified at time of analysis, no confirmed actively exploited (CISA KEV) activity, and a vendor patch shipping in 2026.8.11.
Stack-based buffer overflow in Fluent Bit's out_forward Secure Forward plugin (versions 0.11.0 through releases prior to 5.0.8) lets an attacker who controls or can impersonate the configured forwarding destination overwrite stack memory while Fluent Bit processes the handshake PONG response. The vulnerable path is only reachable when the out_forward output plugin is configured in Secure Forward mode with Shared_Key or Empty_Shared_Key - not the default output configuration - and the CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) plus the independent CVSS 3.1 assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) both characterize it as an unauthenticated network attack that depends on specific deployment preconditions. Impact ranges from reliable process termination on builds compiled with a stack canary to full remote code execution as the Fluent Bit process user on builds lacking canary protection or where a memory-disclosure primitive exists; the opt-in --supervisor mode with fork-only respawns further weakens hardened builds by preserving canary and address layout across restarts. No public exploit code has been identified at time of analysis, and the issue is fixed in version 5.0.8.
Kernel panic and NULL-pointer dereference in the Linux nvme-apple driver can crash Apple Silicon systems (e.g., Apple Mac mini M1) when an NVMe controller fails to initialize and is then immediately torn down, because the admin blk-mq queue allocated by blk_mq_alloc_queue() is never destroyed on that error path. The stale queue keeps its timeout timer and work armed, so blk_mq_timeout_work() later runs against freed state and oopses in percpu_ref_tryget_many after a WARN in blk_mq_release(). Our independent assessment rates this as a low-real-world-risk reliability defect rather than the vendor's high-severity base score: it is local-only, reachable exclusively on the failed-controller-plus-removal sequence (high attack complexity, low-privileged local context per the assessed vector AV:L/AC:H/PR:L), with no remote path and no public exploit identified at time of analysis.
Rsbuild versions before 2.0.9 contain a command injection flaw in the developer-server browser-launcher on macOS. The openBrowser() helper in packages/core/src/server/open.ts passes a URL through encodeURI() and then interpolates it into a string handed to child_process.exec(), and because encodeURI() leaves characters such as $, (, ), and ; untouched, a crafted URL is evaluated by /bin/sh and can execute arbitrary operating-system commands with the privileges of the developer running the dev server. The issue was fixed in the 2.0.9 release (upstream PR 7789), so a vendor-released patch is available; no CISA KEV listing or public exploit code was present in the supplied intelligence, and the attack requires local conditions on the developer machine.
MCPVault, a lightweight Model Context Protocol server that exposes Obsidian vault files to AI agents, fails to block access to restricted directories such as .git, .obsidian, and node_modules in versions prior to 0.11.4. PathFilter compiles its deny-list patterns case-sensitively and matches raw path segments, so on case-insensitive macOS and Windows filesystems variants like .Git/config or .GIT/config (and on Windows, trailing-dot/space forms such as .git./config) pass both isAllowed() and isAllowedForListing() while the operating system still opens the real restricted directory. An attacker who can influence a path selected by an AI agent can then read, write, move, search, or list sensitive repository and Obsidian metadata; no public exploit code or CISA KEV entry was identified at time of analysis.
Sandbox escape in Docker Sandboxes on macOS (0.28.0 through 0.41.x) lets a workload running inside a sandbox break out of its shared workspace and read or modify arbitrary files on the host as the VMM user, with host code execution possible where the reachable files are executable or otherwise privileged. The virtio-fs host server follows symlinks when reopening an unlinked file from a stored path, so a guest that replaces a parent directory of a workspace file with a symlink can redirect host-side file operations outside the workspace bind mount. Exploitation requires the attacker to already control a guest workload (for example an untrusted agent or repository), is macOS-specific, and depends on winning a directory-swap timing race; SSVC records Exploitation: none, and no public exploit code was identified at time of analysis. The raw 9.4 CVSS 4.0 score should be read alongside these preconditions rather than at face value - this is a genuine sandbox escape leading to host compromise, but it is not remotely reachable and is bounded by the privileges of the VMM user rather than root.
Apple iOS 18.7.10 and iPadOS 18.7.10 ship a fix for an input-validation flaw (CWE-20) that lets a remote attacker crash or otherwise deny service on unpatched devices, with Apple rating the impact as a full availability loss (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/A:H). Every iPhone or iPad still running a version below 18.7.10 is potentially affected. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is currently a patch-promptly issue rather than an emergency.
Local applications on macOS versions prior to 27 can escalate to root privileges because the operating system fails to properly validate entitlements before granting privileged operations (CWE-280). An attacker who can get a user to launch — or who can otherwise run — a crafted app on the target Mac gains full root-level control of the system, with high impact to confidentiality, integrity, and availability. The flaw is fixed in macOS Golden Gate 27 per Apple's advisory; no CISA KEV listing, no public exploit code, and no EPSS score were provided at time of analysis, so this is currently a patching-hygiene issue rather than a confirmed active threat.
A logic flaw in Apple macOS Sequoia, Tahoe, and Golden Gate allows an application running on the target Mac to force unexpected system termination, producing a denial-of-service condition that can crash the host and force a reboot. The flaw is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27 per Apple's advisories, and no public exploit code has been identified at time of analysis. EPSS is very low (0.17%, 6th percentile) and the issue is not listed in CISA KEV, so near-term mass exploitation is unlikely.
Kernel-level use-after-free in Apple's built-in NFS client allows memory corruption when a device connects to an attacker-operated NFS server, affecting iOS/iPadOS, macOS, tvOS, visionOS and watchOS. Exploitation requires the victim to mount or connect to a malicious NFS share (UI:R) but no credentials or privileges on the target device, making this a remote, unauthenticated-against-the-client attack that terminates in kernel memory corruption with high confidentiality, integrity and availability impact. No public exploit code and no CISA KEV listing were identified at time of analysis; EPSS is low at 0.18% (8th percentile), and CISA SSVC rates exploitation as none and automatable as no, though technical impact is total. Apple has released fixes in iOS 26.7/27, iPadOS 26.7/27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27.
Out-of-bounds write in Apple's file-parsing code affects iOS/iPadOS 27 and earlier, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27, allowing a maliciously crafted file to corrupt memory when processed. Apple addressed the flaw with improved bounds checking across all listed platforms, and CVSS 3.1 scores it 7.8 (AV:L/AC:L/PR:L/UI:N) with high confidentiality, integrity, and availability impact, even though the advisory text itself describes only unexpected app termination. No publicly available exploit code and no CISA KEV listing were identified at time of analysis, and EPSS is 0.18% (7th percentile), indicating low near-term exploitation likelihood.
Local privilege escalation in Apple macOS Sequoia (before 15.7.8) and macOS Tahoe (before 26.6) lets a malicious application already running as a normal user obtain root privileges. Apple addressed the flaw by adding restriction checks in its permission-handling code, disclosing it only as 'a permissions issue'; fixed versions are macOS Sequoia 15.7.8 and macOS Tahoe 26.6. There is no CISA KEV listing and no public exploit code identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', so this is a patching-during-normal-maintenance item rather than an emergency remote threat.
Out-of-bounds memory access in the macOS SMB client kernel component allows a malicious or compromised SMB server to corrupt kernel memory when a victim connects to it, resulting in unexpected system termination or potentially kernel-level code execution. All macOS releases prior to Sequoia 15.8, Tahoe 26.7, and Golden Gate 27 are affected. Apple has released fixed versions (support.apple.com advisories 149035, 149042, 149043); no public exploit code has been identified and EPSS is low at 0.17% (6th percentile), though the flaw is unauthenticated from the network perspective and requires only that the victim initiate an SMB connection.
Improper state management in Apple's operating systems (iOS/iPadOS, tvOS, visionOS, watchOS) allows a locally installed app to read a persistent account identifier that should have remained isolated, resulting in information disclosure. Affected platforms are all versions prior to the 27 release train on each OS. Vendor patches are available (iOS 27, iPadOS 27, tvOS 27, visionOS 27, watchOS 27), no public exploit code has been identified at time of analysis, and EPSS is very low (0.15%, 5th percentile). The supplied CVSS vector (AV:N/PR:N) does not match the description's local-app precondition, so treat the 7.5 score with caution.
Sandbox escape in Apple macOS lets a malicious or compromised application already running inside the macOS App Sandbox break out of that confinement and operate with privileges beyond what its sandbox profile permits (CVSS 3.1 base 8.4, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). Affected systems are macOS releases prior to Sequoia 15.8, Tahoe 26.7, and Golden Gate 27; exploitation requires the attacker to already have local code execution as a sandboxed app (for example, one the user installed and launched), and provides no remote initial access, functioning as a boundary-crossing primitive once code is running on the host. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS is 0.19% (9th percentile), so real-world activity appears limited, though the sandbox-boundary impact keeps this a serious local isolation flaw rather than a theoretical one.
An out-of-bounds write (CWE-787) in the Apple frameworks that parse 3D model files lets a maliciously crafted model corrupt memory when it is opened on an affected device, potentially giving the attacker code execution in the context of the processing application. The flaw affects iOS/iPadOS before 26.7 and 27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate 27, tvOS before 27, visionOS before 27 and watchOS before 27, and Apple has shipped fixes for all of them. Exploitation likelihood is low: EPSS is 0.17% (7th percentile), CISA SSVC records exploitation as 'none' and the vulnerability is not in KEV — no public exploit code has been identified, and the local attack vector with required user interaction makes mass exploitation unlikely.
Race condition in Apple's kernel state management lets a malicious sandboxed app escape its sandbox and execute arbitrary code with kernel privileges on iOS, iPadOS, macOS, tvOS, visionOS and watchOS. Exploitation requires a timing window to be won (CVSS AC:H) but no user interaction beyond launching the app, and success yields full control of the affected device. Apple shipped fixes in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27; no public exploit code or CISA KEV listing was present in the provided data, and no EPSS
A sandbox escape in Apple macOS allows a locally running sandboxed application to break out of its sandbox on unpatched versions below macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27, gaining full read, write, and execute privileges across the system. The flaw is a protection mechanism failure (CWE-693) in macOS sandbox enforcement logic, and the CVSS score of 8.8 reflects a scope change (S:C) with high confidentiality, integrity, and availability impact. No public exploit code or active exploitation is known at time of analysis, and EPSS is low at 0.17% (6th percentile).
Improper state management in Apple iOS, iPadOS, and watchOS allows an installed app to track a user across other apps and websites without the user's permission, effectively defeating the platform's cross-app tracking consent controls. The flaw affects iOS/iPadOS releases before 26.7 and before 27, plus watchOS before 27, and is remediated by the iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, and watchOS 27 updates. Exploitation requires a hostile app on the device rather than remote network access; EPSS is 0.15% (5th percentile), there is no CISA KEV listing or public exploit identified, and SSVC rates exploitation as 'none' with partial technical impact.
Improper handling of persistent identifiers in Apple's mobile and desktop operating systems allows an app installed on the device to recognize the same user across app reinstalls, defeating the identifier-reset behavior that users and administrators rely on for privacy. Apple states the issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, and visionOS 27, and the affected CPE set covers all earlier releases of iOS/iPadOS, macOS, and visionOS. No public exploit code or CISA KEV entry has been reported at time of analysis, and EPSS is only 0.16% (6th percentile), so this is a privacy-integrity hardening fix rather than an emergency remote-code-execution patch.
Kernel memory corruption in Apple macOS can be triggered when a user mounts a maliciously crafted disk image, causing unexpected system termination or corruption of kernel memory. Apple addressed the CWE-120 buffer overflow with improved bounds checking in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27. No public exploit code and no active exploitation have been identified, and the EPSS score is low (0.21%, 12th percentile), so practical exposure is dominated by local file-delivery scenarios rather than remote mass exploitation.
Sandboxed applications on Apple macOS can break out of their App Sandbox because of a logic error in the sandbox's validation checks, and Apple has fixed the issue in macOS 27 "Golden Gate". Any Mac running a macOS release earlier than 27 is affected, and successful exploitation gives a malicious app access to files, services, and resources it should never have been able to reach, matching the integrity-only impact (C:N/I:H) in the published vector. No public exploit code and no CISA KEV entry were identified at the time of analysis, and the EPSS score of 0.15% (5th percentile) suggests the flaw is not currently being exploited at scale.
Kernel-level out-of-bounds write (CWE-787) in the macOS SMB client stack allows a malicious SMB server to corrupt kernel memory when a target Mac connects to it, potentially yielding kernel code execution or a system crash. All macOS branches are affected: Sequoia before 15.8, Tahoe before 26.7, and macOS Golden Gate versions before 27. Apple has released patches for all three branches; there is no public exploit code identified, no CISA KEV listing, and EPSS is low (0.17%, 6th percentile), so exploitation is currently assessed as targeted/manual rather than widespread.
Local privilege escalation in Apple macOS lets a low-privileged local process obtain root via improper path validation (CWE-22), affecting macOS versions prior to Sequoia 15.8, Tahoe 26.7 and Golden Gate 27. Apple addressed the flaw with improved path validation, and the CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N, total CIA impact) reflects a reliable but non-automatable local escalation requiring an existing code-execution foothold. There is no CISA KEV listing and no public exploit identified at time of analysis; exploitation status is 'none' per CISA SSVC and the issue is not considered automatable.
A local sandbox-escape flaw in Apple macOS (CWE-284, improper access control via faulty state management) allows a malicious application to break out of its App Sandbox and operate outside the restricted environment it was granted. Affected versions are macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27, with Apple shipping fixes in all three (support.apple.com advisories 149035, 149042, 149043). CVSS 3.1 rates it 8.2 (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), but EPSS is only 0.19% (9th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis — so this is a high-severity, low-current-activity issue whose priority is driven by the App Sandbox being a core macOS security boundary rather than by observed exploitation.
Apple iOS and iPadOS before version 27 leak cross-application information through the handling of user preferences, allowing a locally installed app to enumerate which other apps are present on the device. Apple addressed the privacy flaw in iOS 27 and iPadOS 27; EPSS is only 0.17% (7th percentile), there is no CISA KEV listing, and no public exploit code identified at time of analysis. The practical impact is user profiling and device fingerprinting rather than code execution or data theft.
A race condition in Apple macOS (fixed in macOS Tahoe 26.6) allows a locally executed malicious application to escalate privileges and gain root on the host. The flaw is reachable by a low-privileged local process without user interaction beyond running the app, and it has a 7.8 CVSS base score reflecting total loss of confidentiality, integrity and availability for the vulnerable component. There is no CISA KEV listing, no vendor confirmation of in-the-wild exploitation, and no public exploit code identified at time of analysis; CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', indicating a targeted rather than wormable threat.
An out-of-bounds read in Apple's kernel (CWE-125) lets an app already running on the device read past the end of a kernel buffer, potentially leaking kernel memory or crashing the system. Affected platforms span iOS/iPadOS before 26.6.1, macOS Sequoia before 15.8, macOS Tahoe before 26.6.2, and tvOS, visionOS and watchOS before 27, with a CVSS 3.1 base of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H). There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is 0.20% (10th percentile), so this is a local, app-mediated kernel hardening issue rather than a remotely exploitable emergency.
Resource exhaustion in Apple macOS allows a remote, unauthenticated attacker to deny service to legitimate users by feeding input that the operating system fails to bound correctly. Apple fixed the flaw with improved input validation in macOS Tahoe 26.7, macOS Sequoia 15.8, and macOS Golden Gate 27. It is rated 7.5 with an availability-only impact (CWE-400), and while no public exploit code or observed exploitation has been identified, the attack is network-reachable and fully automatable per CISA's SSVC assessment.
Race condition in Apple's kernel allows a local user on iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27 to cause unexpected system termination or read kernel memory. Apple fixed the flaw with additional validation, publishing advisories 149034-149038; there is no public exploit code and no confirmed active exploitation (EPSS 0.16%, SSVC exploitation: none).
Kernel memory corruption in Apple macOS disk image handling allows an attacker to crash the system or corrupt kernel memory when a user mounts a maliciously crafted disk image; affected versions are all macOS releases before Sequoia 15.8, Tahoe 26.7, and Golden Gate 27. Exploitation requires the victim to actively mount the image (UI:R) with no authentication needed (PR:N), and no public exploit code has been identified at time of analysis. Apple has released fixes, and EPSS is low (0.21%, 12th percentile), making this a genuine but not urgent patch priority.
An out-of-bounds read in the macOS kernel NFS client can terminate the system or corrupt kernel memory when the host connects to a malicious NFS server, and it affects macOS releases before Golden Gate 27, Tahoe 26.7, and Sequoia 15.8. The vendor rates it 7.5 (AV:N/AC:L/PR:N/UI:N), while our assessment adjusts to require user interaction (UI:R) because the victim host must mount or auto-mount an attacker-controlled NFS export - this is a client-side, attacker-server-initiated condition, not a remote hit against a listening service. No public exploit code was identified at time of analysis and EPSS is 0.20% (10th percentile); demonstrated impact is availability only, since code execution is not established. Apple has released vendor fixes.
Processing a maliciously crafted disk image on an unpatched Apple macOS system can trigger an out-of-bounds read that terminates the affected application unexpectedly. The issue affects macOS releases before Golden Gate 27, Sequoia 15.8, and Tahoe 26.7, and requires a local user with no privileges (PR:N) to open or mount the crafted image, meaning user interaction (UI:R) is the trigger rather than remote network access. Apple has shipped fixes in the three affected release trains, and there is no public exploit identified at time of analysis; EPSS is low at 0.17% (6th percentile), reflecting the local, interaction-dependent nature of the issue.
Kernel memory corruption in the macOS Apple Filing Protocol client (afpfs) can be triggered when a user connects to a malicious AFP server, for example by following an afp:// link or using 'Connect to Server'; the underlying out-of-bounds write is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8 and macOS Tahoe 26.6. Exploitation is conditional rather than broadly wormable: the attacker is unauthenticated (PR:N) but must still induce the victim to initiate the AFP connection (UI:R), and any host running the patched builds is not affected. No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is low at 0.20% (10th percentile), so this is a genuine but socially mediated client-side kernel flaw rather than a mass-exploitation candidate.
An out-of-bounds read in Apple macOS lets a locally running application read kernel memory or trigger unexpected system termination, and is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27. Exploitation is bounded by the CVSS vector (AV:L/AC:L/PR:L/UI:N) - the attacker must already have code executing as a local app on the host and no user interaction is needed - making this a post-access information-disclosure and denial-of-service primitive rather than a remote entry point. EPSS is only 0.17% (6th percentile) and no public exploit has been identified at time of analysis, consistent with a genuine but non-urgent local privilege issue.
An out-of-bounds read in Apple macOS allows memory disclosure and potential denial-of-service when the system processes a maliciously crafted 3D file, and is addressed by improved bounds checking in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H, 7.1) confirms the path is local and unauthenticated but requires the victim to open or parse attacker-supplied content, so exploitation depends on social-engineering delivery rather than any remote/network-triggerable route. No public exploit code or confirmed active exploitation was identified at time of analysis, EPSS is a low 0.19% (9th percentile), and this is assessed as a moderate, not urgent, priority for fleets that have not yet patched.
An integer overflow in Apple macOS document processing can trigger an out-of-bounds read when a user opens a maliciously crafted file, resulting in potential disclosure of adjacent memory contents and/or a crash of the affected application. Affected versions are macOS releases below Golden Gate 27, below Tahoe 26.7, and below Sequoia 15.8; exploitation requires local handling of the crafted document plus mandatory user interaction (the victim must open the file), and no privileges are required per the CVSS vector (PR:N), but there is no remote or network-service exposure. Apple has released patched versions (Golden Gate 27, Tahoe 26.7, Sequoia 15.8), and no public exploit code or confirmed active exploitation has been identified at time of analysis; EPSS is 0.17% (6th percentile), consistent with a low-likelihood, user-interaction-dependent flaw, and the realistic impact is bounded to memory disclosure or denial of service rather than code execution.
An out-of-bounds memory access in the Apple kernel allows a locally installed app to crash the system or corrupt kernel memory on iOS/iPadOS, macOS, tvOS, visionOS, and watchOS releases prior to the 27-series. The flaw is reachable only by an attacker who already has code executing as an app on the device (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), for example a malicious, sideloaded, enterprise-provisioned, or trojanized application - there is no remote or unauthenticated network path, and no user interaction beyond launching the app is required. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS is 0.17% (7th percentile), and the realistic ceiling absent a follow-on kernel exploit chain is a device crash. Vendor patches are available in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.
Memory corruption during 3D model parsing on unpatched Apple platforms (iOS/iPadOS before 26.7 and 27, macOS Sequoia before 15.8 / Tahoe before 26.7 / Golden Gate 27, and tvOS, visionOS, watchOS before 27) allows an attacker who can get a victim to open or preview a maliciously crafted 3D model file to corrupt memory, potentially leading to code execution in the context of the parsing process with high confidentiality, integrity, and availability impact. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.3), so the practical barrier is user interaction - the target must parse the crafted asset locally; there is no remote unauthenticated network path, and no public exploit code has been identified at time of analysis (EPSS 0.20%, 10th percentile). Apple has shipped fixes; this is a genuine but moderate-priority issue rather than a top-tier emergency, since exploitation depends on social engineering plus a locally delivered file.
Local kernel memory corruption in Apple's 26.x operating-system family (iOS and iPadOS, macOS Tahoe, tvOS, visionOS, watchOS) allows an installed, running application to write to kernel memory or trigger unexpected system termination, with the flaw fixed in the 26.6 releases. The bug requires the victim to install and run a malicious or compromised app - it is not reachable over the network and needs no user interaction beyond launching that app (CVSS 7.8, AV:L/PR:L/UI:N) - and Apple's sandbox, notarization and App Review keep the delivery bar high, though a successful kernel-write primitive carries high confidentiality, integrity and availability impact. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and EPSS sits at 0.16% (6th percentile), indicating low near-term exploitation likelihood relative to the severity of the primitive itself.
A path traversal flaw (CWE-22) in Apple macOS is addressed by improved path validation and allows an attacker who controls a network directory server to execute arbitrary code with root privileges on a connecting client. Affected are macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27. Apple has shipped fixes in all three release trains. There is no public exploit code and no CISA KEV listing at time of analysis, and the CVSS 3.1 vector (7.8, AV:L/PR:L) reflects a local vector requiring the attacker to already hold a foothold as a directory service rather than a remote unauthenticated path.
Local sandbox authorization bypass in Apple macOS allows a malicious app already running on the target Mac to access user-sensitive data without proper authorization. Exploitation requires the user to run an untrusted application (UI:R) and affects macOS versions before Sequoia 15.8, Tahoe 26.7, and Golden Gate 27; the impact is limited to confidentiality disclosure with no integrity or availability effect. No public exploit was identified at time of analysis, EPSS is low at 0.19% (9th percentile), and vendor patches are available.
An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate), tvOS, visionOS, and watchOS - lets a remote attacker corrupt memory in an affected process, with the confirmed outcome being an application crash and the potential outcome being arbitrary code execution. Exploitation requires no authentication and no user interaction per the CVSS vector (AV:N/PR:N/UI:N), but the independent assessment rates attack complexity as High and the confirmed technical impact as limited to denial of service, because the specific component or content-processing surface that must be reached has not been documented and reliable code execution is unproven. Apple has released fixed builds for every affected platform, and no public exploit code or active exploitation has been identified at time of analysis; EPSS is a modest 0.99% (61st percentile), which is consistent with a patched, non-weaponized memory-safety defect rather than a top-tier emergency.
Integer overflow in the macOS kernel NFS client can be triggered when an unpatched Mac connects to or mounts a share from a malicious or spoofed NFS server, leading to kernel memory corruption or unexpected system termination. Affected systems are macOS releases below Sequoia 15.8, Tahoe 26.7, and Golden Gate 27 (CPE cpe:2.3:a:apple:macos). The flaw is availability-only (CVSS 3.1 base 7.5; our assessment AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), requires no credentials on the target but does require the victim to initiate an NFS client session, and is best exploited by an attacker positioned to serve or impersonate an NFS endpoint the victim reaches; no public exploit code has been identified at time of analysis, EPSS is low at 0.17% (6th percentile), and the issue is not in CISA KEV. Apple has released fixes, so patching removes the exposure entirely.
An out-of-bounds write in Apple macOS lets a malicious or compromised app running as a normal, unprivileged user corrupt memory and escalate to root privileges on the affected system. The flaw is fixed in macOS Golden Gate 27, macOS Tahoe 26.7, and macOS Sequoia 15.8; all earlier releases of those branches remain exposed (CWE-787, CVSS 7.8, AV:L/PR:L/UI:N). No public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' and non-automatable, so practical risk is currently confined to local post-compromise privilege escalation rather than mass remote attacks.
Sandbox escape in Apple iOS, iPadOS, and macOS allows a locally installed low-privileged malicious app to break out of its sandbox and gain elevated access to system resources, affecting iOS/iPadOS and macOS versions prior to 27 (macOS Golden Gate 27). Apple corrected the underlying permissions weakness (CWE-269, improper privilege management) by adding restrictions in the version 27 releases, so devices updated to iOS 27, iPadOS 27, or macOS Golden Gate 27 are remediated. The flaw is local-only with no remote or network trigger and requires the attacker to first get a malicious app onto the device; EPSS is 0.19% (8th percentile) and no public exploit identified at time of analysis, so risk is concentrated on devices that permit sideloaded, enterprise-provisioned, or otherwise untrusted applications.
Kernel out-of-bounds write in Apple macOS exFAT volume handling lets a local attacker who can get a maliciously crafted exFAT-formatted volume mounted - such as removable USB media or a disk image - trigger unexpected system termination (kernel panic) or disclose kernel memory. Only macOS builds below macOS Golden Gate 27 are affected; Apple fixed the flaw with improved bounds checking in macOS Golden Gate 27. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; EPSS is 0.14% (3rd percentile), and the attack is locally gated, requiring physical, removable-media, or delivery-based access rather than network reach.
Local privilege escalation in Apple macOS allows a malicious or compromised application already running on the system to obtain root privileges. The flaw is a permissions-handling defect (CWE-280) that Apple addressed by adding additional restrictions, with fixes shipping in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27. Exploitation requires local code execution as a normal user (AV:L, PR:L) and, per CISA SSVC, is not automatable with no known exploitation activity; no public exploit code or EPSS signal was provided at time of analysis.
Sandbox escape in Apple macOS (all releases prior to Golden Gate 27) allows an app already running inside the macOS App Sandbox to break out of its confinement by abusing improper symlink handling, fixed by Apple in macOS Golden Gate 27. The attacker must first get a malicious or compromised sandboxed app installed and running on the target (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, CWE-59), so there is no remote or network vector and no user interaction is required beyond launching the app. No public exploit code has been identified and the issue is not in CISA KEV; EPSS is 0.14% (4th percentile), indicating low near-term exploitation likelihood.
Authorization bypass in Apple macOS allows a malicious or compromised application already running on the system to access sensitive user data it should not be able to reach. All macOS releases below Golden Gate 27, Tahoe 26.7, and Sequoia 15.8 are affected; the flaw is rooted in missing authorization checks (CWE-862) that Apple addressed through improved permission validation. Per the independent assessment the practical attack path is local rather than remote - the attacker must first get an app onto the device and executed, with Gatekeeper, notarization, App Store review, and TCC prompts acting as added barriers - and impact is confined to confidentiality (data disclosure) with no integrity or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is low (0.19%, 9th percentile), so risk is driven primarily by the widespread install base rather than observed attacks.
Apple macOS contains a process-entitlement verification flaw (CVE-2026-65381) that lets a malicious application break out of the App Sandbox, escalating its reach beyond the container it is supposed to be confined to. Affected systems are macOS versions prior to Golden Gate 27, Sequoia 15.8, and Tahoe 26.7; exploitation requires the attacker to first get their app onto the host and have it launched locally, after which no further privileges or user interaction are needed (assessed vector AV:L/PR:N/UI:N/S:C). The impact is a genuine security-boundary crossing with high confidentiality, integrity, and availability consequences, but EPSS is only 0.19% (9th percentile) and no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis.
Improper authorization handling in Apple macOS lets a locally running app reach sensitive user data it should not be permitted to access, because the underlying authorization state is not managed correctly. The flaw affects macOS versions prior to Golden Gate 27, Tahoe 26.7, and Sequoia 15.8, and exploits require a malicious or compromised application to already be executing on the target Mac - the external CVSS score of 7.5 (AV:N) is inconsistent with the vendor description and with our assessed vector of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, which reflects a local, low-privileged precondition. No public exploit code has been identified at time of analysis and EPSS is 0.19% (9th percentile), though Apple has shipped fixes in the versions named above, so patching is the decisive control.
A use-after-free in Apple macOS kernel memory management allows a locally installed and executed app to escalate to kernel privileges and run arbitrary code with full system control. Affected releases are macOS before Sequoia 15.8, before Tahoe 26.7, and before Golden Gate 27; Apple shipped fixes in all three branches. The flaw is a local privilege escalation (CVSS 7.8, AV:L/PR:L) rather than a remote code execution bug, and there is no public exploit code or CISA KEV listing identified at time of analysis, so real-world exploitation currently depends on an attacker first getting a malicious app onto the target Mac.
Memory corruption in Apple's image-handling code across iOS 27, iPadOS 27, macOS Golden Gate 27 and visionOS 27 allows an attacker to achieve arbitrary code execution when a user processes a maliciously crafted image. Apple removed the vulnerable code entirely in the 27-generation releases, which are the only versions containing the fix; all earlier supported builds remain affected. The flaw is rated 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H), meaning exploitation needs local positioning plus some user interaction, and there is no public exploit code or CISA KEV entry identified at time of analysis.
Kernel memory corruption in Apple macOS before Sequoia 15.8, Golden Gate 27, and Tahoe 26.7 can be triggered by a remote attacker, leading to unexpected system termination or kernel memory corruption. Exploitation requires network reachability to an unidentified service with no authentication or user interaction, though the assessed attack complexity is high (AC:H) and the exact trigger surface is unconfirmed. Apple has released patched versions, and no public exploit code has been identified; EPSS is low at 0.29%.
Apple macOS contains a local privilege-escalation flaw in which an application running on the system can escalate to root because entitlement checks were insufficient. Apple addressed the issue with additional entitlement validation, fixing it in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27; earlier releases (pre-15.8, pre-26.7) remain vulnerable. The attack is local (CVSS AV:L) and requires the attacker to already have code running as an ordinary user, so exploitation is typically a second-stage payload delivered by a malicious app or initial social-engineering lope rather than a remote network attack. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied by the contributing sources.
Sign In With Apple state-management flaw in iOS, iPadOS, macOS, and visionOS lets a locally installed app hijack the authentication flow and obtain access to the victim's Apple Account. An attacker needs a malicious or compromised app already present on the device (AV:L) and the user must actively complete a Sign In With Apple prompt (UI:R), but no privileges or credentials are required by the app itself (PR:N), yielding high confidentiality and integrity impact on the linked Apple Account. Apple has shipped fixes in iOS/iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, and visionOS 27; EPSS is low at 0.24% (15th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis.
Local privilege escalation in Apple macOS lets an application running with standard user privileges obtain root, giving an attacker full control of the host once code executes on the machine. The flaw is an improper access-control check (CWE-284) that Apple addressed with improved validation logic, fixed in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27. No public exploit code has been identified and the vulnerability is not in CISA KEV; CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', so risk is concentrated in environments where untrusted local code can be executed.
Memory corruption in Apple macOS WebDAV client handling allows code execution when a user connects to an attacker-controlled WebDAV server, affecting macOS versions prior to Sequoia 15.8, Tahoe 26.7, and Golden Gate 27. The flaw is an out-of-bounds write (CWE-787) reachable over the network but gated by user interaction, rated 8.8 by Apple/NVD with an unauthenticated network attack vector. Apple has released fixes in three OS updates, and exploitation is not confirmed — no public exploit code and no CISA KEV listing — while EPSS sits at 0.18% (8th percentile), indicating low predicted mass-exploitation activity; this reads as a credible but targeted risk rather than a wormable event.
Device fingerprinting on Apple iOS and iPadOS before 26.7 (and before 27) lets a locally installed app defeat an authorization/state-management check and read a device-stable identifier it should not be able to obtain, weakening user privacy and enabling cross-app tracking or device re-identification. Exploitation requires an attacker to first get a malicious or privacy-invasive app onto the device (App Store distribution or sideloading), and the assessed impact is confidentiality-only - reading an identifier, with no code execution, data modification, or availability loss - so the vendor's CVSS 7.5 (AV:N/PR:N/I:H) overstates the practical risk relative to the assessed local, low-impact vector; this is a low real-world risk, confirmed patched by iOS/iPadOS 26.7 or 27, with no public exploit identified at time of analysis and a low EPSS score of 0.15% (5th percentile).
Unexpected system termination (denial of service) can be induced on Apple macOS by a malicious or crafted application running on the host, with the underlying cause classified as an improper authentication weakness (CWE-287) that Apple addressed through improved authentication logic. Affected builds are macOS Sequoia before 15.8, macOS Tahoe before 26.6, and macOS Golden Gate before 27; the independent assessment recalibrates the vendor's network-oriented vector to a local one (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning the attacker must first get code executing on the machine - no remote path, no privilege gain, no confidentiality or integrity loss, and no code execution beyond the crash. Exploitation requires both local access and a running malicious app, so practical risk is moderate rather than urgent: no public exploit code has been identified at time of analysis, EPSS is only 0.20% (10th percentile), and vendor-released patches (15.8, 26.6, 27) are available, though the CVE is tracked in the Apple/ENISA ecosystem (EUVD-2026-78030) and tagged as an authentication-bypass class issue.