Apple
Monthly
This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to disclose kernel memory.
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination.
Double-free memory corruption in Apple macOS (all versions prior to macOS Golden Gate 27) is reachable by a locally installed or executed untrusted application, which can then trigger unexpected system termination and a local denial of service; confidentiality and integrity are unaffected and there is no remote or network-triggered path. Exploitation requires the attacker to already be able to run code as an application on the target Mac (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, i.e. local, low-privilege context), which is the primary limiting factor against real-world abuse; no public exploit identified at time of analysis and EPSS is very low at 0.14% (4th percentile).
An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to identify what other apps a user has installed.
Connecting an attacker-controlled hardware accessory to an unpatched iPhone, iPad, or Mac can drive a memory corruption fault that terminates the system (unexpected system termination) in iOS/iPadOS before 26.7 and before 27, and in macOS Tahoe before 26.7 and macOS Golden Gate before 27. The vendor describes the root cause as insufficient input validation (CWE-20) on data supplied by the attached peripheral; the vector requires no privileges on the target device (PR:N) but does require the victim to physically attach the malicious accessory and to interact with it (UI:R), and the impact is availability-only with no confidentiality or integrity loss. Apple has released fixes (iOS/iPadOS 26.7 and 27, macOS Tahoe 26.7 and macOS Golden Gate 27), the vendor score is 5.5, EPSS is 0.15% (5th percentile), and there is no CISA KEV listing and no public exploit identified at time of analysis.
An unauthenticated attacker positioned within radio range of an Apple iPhone or iPad can send specially crafted wireless input that causes the device to terminate unexpectedly (crash/restart), due to an input validation failure in the affected platform. The flaw is rated CVSS 6.5 (AV:A, A:H) and affects iOS and iPadOS before version 27; Apple has released a fixed version and no public exploit code or active exploitation has been identified (EPSS 0.14%, 4th percentile). Impact is limited to availability - there is no confidentiality or integrity impact.
An out-of-bounds write in Apple's image processing pipeline (CWE-787) allows a maliciously crafted image to corrupt memory when it is viewed on affected Apple platforms. Apple addressed the flaw with improved bounds checking in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, and visionOS 27. The CVSS 3.1 base score of 6.5 reflects a network-delivered attack requiring the victim to open the image (UI:R), with impact limited to availability (C:N/I:N/A:H); EPSS is very low at 0.18% (7th percentile) and there is no public exploit identified at time of analysis.
This issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27, watchOS 27. An app may be able to access sensitive user data.
A locally installed application on macOS versions prior to macOS Golden Gate 27 can bypass Gatekeeper code-origin and notarization checks, weakening the platform control that is supposed to stop untrusted apps from launching. The flaw is assessed at CVSS 4.4 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), meaning it requires local presence and normal user privileges, and the resulting impact is limited to partial confidentiality and integrity loss rather than code execution or denial of service. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing); EPSS is only 0.18% (8th percentile), and Apple has released a fix in macOS Golden Gate 27. Per the independent assessment, this is a genuinely low-priority issue despite the 'Authentication Bypass' tag.
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to read device name.
Processing a maliciously crafted file on Apple macOS versions below Golden Gate 27 can crash the affected component, causing a denial-of-service, and may potentially leak partial memory contents. The bug is an integer overflow (CWE-190) corrected through improved input validation, and exploitation requires a local victim to actually open or handle the attacker-supplied file, so both a local attack vector and user interaction are prerequisites. Severity is assessed as moderate (assessed CVSS 6.6-level, availability-high with limited-confidentiality impact); EPSS is low at 0.17% (7th percentile), CISA SSVC records no exploitation, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Local information disclosure in Apple macOS before Golden Gate 27 allows an installed app to bypass system pasteboard sandbox restrictions and read sensitive pasteboard data, resulting in confidentiality impact only. The flaw is not remotely exploitable; it requires attacker-controlled code already running locally, typically a malicious or compromised app that the user has installed and launched. Apple fixed it in macOS Golden Gate 27, and no public exploit was identified at time of analysis (EPSS 0.17%, CVSS 5.5 Medium).
A malicious application running on Apple macOS (versions prior to 27) or watchOS (versions prior to 27) can leak sensitive user information because the operating system fails to properly manage internal state. Apple addressed the flaw in macOS Golden Gate 27 and watchOS 27, so all earlier releases on both platforms remain exposed. The issue is rated CVSS 5.5 (local vector, low privileges, high confidentiality impact), EPSS is only 0.16% (5th percentile), and there is no public exploit code identified at time of analysis.
Incorrect authorization handling in Apple's iOS, iPadOS, macOS, and tvOS lets a locally installed app reach sensitive user data that should be fenced off by the platform's state and sandbox checks. The flaw is a local, low-privilege issue (CVSS 5.5, AV:L/PR:L) requiring a malicious or compromised app already running on the device — no network vector and no user interaction beyond launching the app. Apple has shipped fixes in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, and tvOS 27; EPSS is very low (0.17%, 6th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis.
Local applications on macOS releases prior to Golden Gate 27 can bypass the Apple Intelligence security and consent prompts, evading the authorization gate that is supposed to require explicit approval before protected Apple Intelligence functionality is reached. Exploitation is not remote: an attacker must first get a malicious or abusable app onto the machine and running under normal user privileges (CVSS AV:L/PR:L, no user interaction at exploit time), and it is only meaningful where Apple Intelligence is present and enabled. The issue is a low-urgency local authorization flaw rather than an emergency - CVSS 5.5, EPSS 0.15% (5th percentile), no CISA KEV listing, and no public exploit identified at time of analysis - though Apple has addressed it with improved state management in macOS Golden Gate 27.
An out-of-bounds read in Apple's kernel, fixed across iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27, allows a locally installed application to disclose kernel memory to user space. The flaw (CWE-125) stems from insufficient input validation in a kernel code path reached by app-supplied data, and yields high confidentiality impact only - no integrity or availability loss. Apple has released patches for all affected platforms; EPSS is very low (0.15%, 5th percentile), and there is no public exploit code or CISA KEV listing at time of analysis.
Improper certificate validation in Apple macOS allows an attacker positioned on the network path between the victim and a remote endpoint to intercept and potentially modify traffic that should have been protected by TLS. The flaw affects macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate versions before 27, and is rated CVSS 4.8 (network vector but high attack complexity), with an EPSS score of only 0.12% (2nd percentile) and no public exploit or CISA KEV listing at time of analysis. Apple addressed the issue with improved certificate validation in the three corresponding releases, so the primary defense is straightforward patching; no public exploit code has been identified.
An authorization issue was addressed with improved access control. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data.
A file quarantine bypass was addressed with additional checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27, watchOS 27. An archive may be able to bypass Gatekeeper.
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination.
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27. Processing a maliciously crafted file may lead to unexpected app termination.
A race condition was addressed with improved state handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.
A heap buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27, watchOS 27. Processing a maliciously crafted file may lead to unexpected app termination.
An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27. Opening a maliciously crafted file may cause unexpected process termination or disclose process memory.
An authorization issue was addressed with improved entitlement checks. This issue is fixed in macOS Golden Gate 27. An app may be able to capture Touch Bar content without authorization.
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted font file may lead to unexpected app termination.
This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data.
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination or read kernel memory.
A logging issue was addressed with improved data redaction. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access user-sensitive data.
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Processing a maliciously crafted 3D file may lead to an out-of-bounds read.
Network traffic integrity can be silently undermined on unpatched Apple platforms - iOS and iPadOS before 27, macOS Golden Gate before 27, tvOS before 27, and watchOS before 27 - by an unauthenticated attacker who already holds a privileged on-path network position between the device and its peer. Apple fixed the underlying cryptographic weakness through improved integrity checks in the 27-generation releases, restoring the guarantee that intercepted traffic cannot be modified undetected. Exploitation is constrained by the adjacency requirement (AV:A) and high attack complexity (AC:H), EPSS is only 0.17% (7th percentile), and no public exploit code has been identified at time of analysis.
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27. An app may be able to modify a file it only had permission to read.
An uninitialized memory issue was addressed with improved memory initialization. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may result in disclosure of process memory.
An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to access sensitive user data.
This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data.
A memory-safety defect (out-of-bounds read, CWE-125) in Apple's iOS, iPadOS, macOS, tvOS, visionOS, and watchOS can be triggered by a locally running application and causes an unexpected system termination - a denial-of-service/availability impact with no confidentiality or integrity loss. Affected versions are those prior to the fixed releases: iOS/iPadOS before 26.7 (and before 27), macOS before Sequoia 15.8, before Tahoe 26.7, and before Golden Gate 27, plus tvOS, visionOS, and watchOS before 27. Exploitation requires the attacker to already have a malicious app running on the device with its own app-level privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, scored 5.5); no public exploit code has been identified at time of analysis, EPSS is low at 0.21% (11th percentile), and there is no CISA KEV entry. Apple has released patched versions, so the practical exposure is limited to unpatched devices running a hostile app - a low-to-moderate priority issue.
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A local app may be able to read a persistent account identifier.
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Connecting to a malicious SMB server may lead to unexpected system termination.
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination or write kernel memory.
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sonoma 14.8.8. An app may be able to access sensitive user data.
An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. A malicious shortcut may be able to send messages without user confirmation.
An authentication issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27. An attacker with physical access to an unlocked device may be able to view Wi-Fi passwords without authentication.
A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access protected user data.
This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, visionOS 27. An app may be able to cause a denial-of-service.
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A malicious application may be able to determine a user's current location.
Local directory-path traversal in Apple macOS allows an app already running on the host to reach and read sensitive user data outside the directory it is permitted to access. The root cause is insufficient validation of directory paths (CWE-22), and Apple has remediated it in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27. Exploitation requires the attacker to already have code running as a low-privileged local application (AV:L, PR:L) with no user interaction, and no public exploit code has been identified at time of analysis; with an EPSS score of 0.19% (9th percentile) and no CISA KEV listing, this is a genuine but low-to-moderate priority issue rather than an urgent one.
A use-after-free (CWE-416) in Apple's memory management code allows a locally running application on iOS, iPadOS, macOS, tvOS, visionOS and watchOS to crash the affected system, producing an unexpected termination or reboot. The flaw affects all platforms before the fixed releases (iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27) and rates CVSS 5.5 (AV:L/PR:L/UI:N, availability-only impact). No public exploit code or active exploitation has been identified, and EPSS is low at 0.21% (11th percentile), so this is a patched, availability-only issue rather than an urgent remote-code-execution threat.
Improper memory handling in Apple iOS, iPadOS, and macOS lets a locally running application trigger an unexpected system termination, crashing the device or the operating system; affected versions are iOS/iPadOS prior to 26.7 or 27, and macOS prior to Golden Gate 27, Sequoia 15.8, and Tahoe 26.7. The only prerequisite is the ability to run a malicious or malformed app on the target device (local access, PR:L, no user interaction and no network reachability), and the demonstrated impact is limited to availability - no code execution, privilege escalation, or data access. No public exploit identified at time of analysis, no evidence of active exploitation (not in CISA KEV), EPSS is 0.20% (10th percentile), and vendor patches have been released.
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, watchOS 27. An app may be able to access sensitive user data.
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious app may be able to break out of its sandbox.
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27. Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure.
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, visionOS 27, watchOS 27. An app may be able to access sensitive user data.
An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, tvOS 27, visionOS 27. An app may be able to access sensitive user data.
An out-of-bounds write in Apple macOS is triggered when a user connects to a malicious WebDAV server, resulting in unexpected application termination. The flaw affects macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27, and is reachable over the network with no privileges required but with user interaction (the victim must initiate the WebDAV connection). Apple addressed it by removing the vulnerable code and shipped fixes in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27; no public exploit code or active exploitation has been identified at time of analysis, and the CVSS 3.1 score is 6.5 with availability-only impact.
A heap buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Mounting a maliciously crafted volume may lead to unexpected system termination.
An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, watchOS 27. An app may be able to access Bluetooth device information.
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination or corrupt kernel memory.
Bypass of on-device network restrictions in Apple iOS/iPadOS, macOS Golden Gate, visionOS, and watchOS builds prior to version 27 allows a locally installed, already-running app to reach network resources the operating system should have blocked, producing low confidentiality and low integrity impact with no availability effect. Exploitation requires an app that is already installed and executing with normal, authenticated app privileges on the target device (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, score 4.4); there is no remote or unauthenticated attack path, no public exploit identified at time of analysis, and EPSS is a low 0.21% (11th percentile). Apple has shipped vendor-released fixes in iOS 27, iPadOS 27, macOS Golden Gate 27, visionOS 27, and watchOS 27.
A local race condition (CWE-362) in Apple macOS allows any locally running application to trigger unexpected system termination on affected hosts. The flaw affects macOS versions prior to Tahoe 26.7 and Golden Gate 27, is availability-only (C:N/I:N/A:H), and requires local app execution with no user interaction and no privilege escalation. Apple has released fixed versions; there is no public exploit identified, no CISA KEV listing, and EPSS is only 0.16% (5th percentile), indicating low real-world exploitation pressure.
A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, visionOS 27. An app may be able to bypass certain Privacy preferences.
A race condition was addressed with improved state handling. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.
A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may lead to unexpected app termination.
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted 3D scene may lead to unexpected process termination.
An out-of-bounds write in the Apple macOS kernel allows a locally running application to corrupt kernel memory, potentially causing unexpected system termination or arbitrary kernel memory writes. The flaw affects macOS releases prior to Sequoia 15.8, Tahoe 26.7, and Golden Gate 27, with a CVSS base score of 6.1 (AV:L/AC:L/PR:L/UI:N) reflecting the requirement for local code execution with attacker-controlled privileges. No public exploit code has been identified at time of analysis, and EPSS probability is very low (0.16%, 6th percentile), suggesting targeted rather than opportunistic exploitation; CISA KEV does not list this CVE.
An information disclosure issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to disclose kernel memory.
An out-of-bounds write in Apple macOS (all versions prior to macOS 27 'Golden Gate') allows a maliciously crafted disk image to corrupt kernel memory when mounted, causing unexpected system termination. Apple addressed the flaw by removing the vulnerable code rather than adding a bounds check, and a vendor patch is available in macOS 27. There is no CISA KEV listing and no public exploit code identified at time of analysis; EPSS is very low at 0.14% (4th percentile), so exploitation appears opportunistic at most.
The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination.
Loading maliciously crafted web content in Apple's WebKit engine can crash the renderer or host process on Safari, iOS/iPadOS, macOS, tvOS, visionOS and watchOS builds earlier than the version 27 releases, producing a denial-of-service condition rather than code execution or data exposure. The flaw is a state-management logic error in the type-confusion class (CWE-843), and it is reachable from a remote web-content delivery path, so exploitation hinges on getting a victim to open a hostile page or embed WebKit content. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; EPSS is only 0.14% (4th percentile), and Apple has shipped fixed '27' releases across all affected platforms, so the practical risk is moderate and availability-only. Note that Apple's published vector lists PR:L/UI:N while our assessment uses PR:N/UI:R, a contradiction worth confirming with the vendor.
A use-after-free in macOS memory management allows a locally running application to crash the operating system, resulting in unexpected termination and loss of unsaved work. The flaw affects macOS Tahoe before 26.6, macOS Sequoia before 15.7.8, and macOS Sonoma before 14.8.8, with exploitation requiring only low privileges (CVSS PR:L) and no additional user interaction. Apple has released fixes (patch available per vendor advisories), and although EPSS is very low at 0.19% (9th percentile) with no CISA KEV listing, no public exploit code identified at time of analysis, the flaw is a memory-safety bug that carries inherent risk of escalation beyond a simple denial of service.
Gatekeeper enforcement in Apple macOS can be bypassed by a malicious application that is delivered locally and opened by the user, letting the app run without satisfying macOS's normal code-signing and notarization checks. The flaw is a logic error (CWE-693, protection mechanism failure) affecting macOS builds prior to Golden Gate 27, Sequoia 15.8, Tahoe 26.6 and Tahoe 26.7; CVSS 5.5 reflects an integrity-only, non-privileged local impact that requires user interaction and grants no direct privilege escalation or confidentiality loss. No public exploit code has been identified at time of analysis and EPSS is low at 0.21% (11th percentile), so the practical value of the bug is as a stage in a broader malware delivery chain rather than a standalone compromise.
An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An app may be able to fingerprint the device.
A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app with root privileges may be able to read uninitialized kernel memory.
A correctness issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.8.8. An attacker with physical access may be able to silently persist an Apple Account on an erased device.
The issue was addressed with improved authentication. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.6. An app may be able to cause unexpected system termination.
Apps already running on macOS versions prior to Golden Gate 27 can modify Privacy (TCC) preferences they are not authorized to change, letting a malicious app grant itself access to consent-gated resources such as the camera, microphone, or other protected data without ever prompting the user. The root cause is an incorrect-authorization weakness (CWE-863) that Apple addressed by adding restrictions to the permission check, so exploitation is not remote: the attacker must first deliver and run code on the host (AV:L, PR:L, UI:N), making this primarily a post-compromise, integrity-only escalation of an app's privacy privileges (C:N/I:H/A:N). EPSS is only 0.17% (7th percentile), there is no CISA KEV entry and no public exploit identified at time of analysis, and a vendor-released fix exists in macOS Golden Gate 27.
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A local attacker may be able to cause unexpected system termination or corrupt kernel memory.
A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker in a privileged network position may be able to leak sensitive user information.
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. Processing maliciously crafted NTLM input may lead to unexpected app termination.
A permissions issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data.
An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to access sensitive user data.
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to access sensitive user data.
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected process termination or disclose process memory.
A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to bypass Gatekeeper checks.
Arbitrary file read in Apple macOS allows a locally running malicious or compromised application to bypass path-handling input sanitization and read files the operating system should have denied it, exposing potentially sensitive user or system data. Exploitation requires the attacker to already have code execution on the host - a local, low-privileged app context (PR:L) with no further user interaction - and the impact is confined to confidentiality, with no integrity or availability effect. The flaw is moderate severity (EPSS 0.19%, 9th percentile) with no public exploit identified at time of analysis, and it is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27.
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A local user may be able to cause unexpected system termination or read kernel memory.
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, macOS Golden Gate 27. Processing a maliciously crafted image may lead to unexpected app termination.
A race condition was addressed with improved state handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination or corrupt kernel memory.
Processing maliciously crafted web content in Apple's WebKit-based browser stack can disclose sensitive user information across Safari 27, iOS/iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27 and earlier. Apple classifies the root cause as an improper privilege management (permissions) issue and fixed it by removing the vulnerable code rather than adding a check, per the vendor advisories referenced for CVE-2026-64753. Real-world urgency is currently low: EPSS is 0.14% (4th percentile), there is no CISA KEV listing or public exploit identified at time of analysis, and CISA's SSVC assessment is exploitation:none / automatable:no / technical impact:partial, while a vendor patch is already available.
A path traversal issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, watchOS 27. An app may be able to modify protected system files.
This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to disclose kernel memory.
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination.
Double-free memory corruption in Apple macOS (all versions prior to macOS Golden Gate 27) is reachable by a locally installed or executed untrusted application, which can then trigger unexpected system termination and a local denial of service; confidentiality and integrity are unaffected and there is no remote or network-triggered path. Exploitation requires the attacker to already be able to run code as an application on the target Mac (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, i.e. local, low-privilege context), which is the primary limiting factor against real-world abuse; no public exploit identified at time of analysis and EPSS is very low at 0.14% (4th percentile).
An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to identify what other apps a user has installed.
Connecting an attacker-controlled hardware accessory to an unpatched iPhone, iPad, or Mac can drive a memory corruption fault that terminates the system (unexpected system termination) in iOS/iPadOS before 26.7 and before 27, and in macOS Tahoe before 26.7 and macOS Golden Gate before 27. The vendor describes the root cause as insufficient input validation (CWE-20) on data supplied by the attached peripheral; the vector requires no privileges on the target device (PR:N) but does require the victim to physically attach the malicious accessory and to interact with it (UI:R), and the impact is availability-only with no confidentiality or integrity loss. Apple has released fixes (iOS/iPadOS 26.7 and 27, macOS Tahoe 26.7 and macOS Golden Gate 27), the vendor score is 5.5, EPSS is 0.15% (5th percentile), and there is no CISA KEV listing and no public exploit identified at time of analysis.
An unauthenticated attacker positioned within radio range of an Apple iPhone or iPad can send specially crafted wireless input that causes the device to terminate unexpectedly (crash/restart), due to an input validation failure in the affected platform. The flaw is rated CVSS 6.5 (AV:A, A:H) and affects iOS and iPadOS before version 27; Apple has released a fixed version and no public exploit code or active exploitation has been identified (EPSS 0.14%, 4th percentile). Impact is limited to availability - there is no confidentiality or integrity impact.
An out-of-bounds write in Apple's image processing pipeline (CWE-787) allows a maliciously crafted image to corrupt memory when it is viewed on affected Apple platforms. Apple addressed the flaw with improved bounds checking in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, and visionOS 27. The CVSS 3.1 base score of 6.5 reflects a network-delivered attack requiring the victim to open the image (UI:R), with impact limited to availability (C:N/I:N/A:H); EPSS is very low at 0.18% (7th percentile) and there is no public exploit identified at time of analysis.
This issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27, watchOS 27. An app may be able to access sensitive user data.
A locally installed application on macOS versions prior to macOS Golden Gate 27 can bypass Gatekeeper code-origin and notarization checks, weakening the platform control that is supposed to stop untrusted apps from launching. The flaw is assessed at CVSS 4.4 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), meaning it requires local presence and normal user privileges, and the resulting impact is limited to partial confidentiality and integrity loss rather than code execution or denial of service. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing); EPSS is only 0.18% (8th percentile), and Apple has released a fix in macOS Golden Gate 27. Per the independent assessment, this is a genuinely low-priority issue despite the 'Authentication Bypass' tag.
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to read device name.
Processing a maliciously crafted file on Apple macOS versions below Golden Gate 27 can crash the affected component, causing a denial-of-service, and may potentially leak partial memory contents. The bug is an integer overflow (CWE-190) corrected through improved input validation, and exploitation requires a local victim to actually open or handle the attacker-supplied file, so both a local attack vector and user interaction are prerequisites. Severity is assessed as moderate (assessed CVSS 6.6-level, availability-high with limited-confidentiality impact); EPSS is low at 0.17% (7th percentile), CISA SSVC records no exploitation, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Local information disclosure in Apple macOS before Golden Gate 27 allows an installed app to bypass system pasteboard sandbox restrictions and read sensitive pasteboard data, resulting in confidentiality impact only. The flaw is not remotely exploitable; it requires attacker-controlled code already running locally, typically a malicious or compromised app that the user has installed and launched. Apple fixed it in macOS Golden Gate 27, and no public exploit was identified at time of analysis (EPSS 0.17%, CVSS 5.5 Medium).
A malicious application running on Apple macOS (versions prior to 27) or watchOS (versions prior to 27) can leak sensitive user information because the operating system fails to properly manage internal state. Apple addressed the flaw in macOS Golden Gate 27 and watchOS 27, so all earlier releases on both platforms remain exposed. The issue is rated CVSS 5.5 (local vector, low privileges, high confidentiality impact), EPSS is only 0.16% (5th percentile), and there is no public exploit code identified at time of analysis.
Incorrect authorization handling in Apple's iOS, iPadOS, macOS, and tvOS lets a locally installed app reach sensitive user data that should be fenced off by the platform's state and sandbox checks. The flaw is a local, low-privilege issue (CVSS 5.5, AV:L/PR:L) requiring a malicious or compromised app already running on the device — no network vector and no user interaction beyond launching the app. Apple has shipped fixes in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, and tvOS 27; EPSS is very low (0.17%, 6th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis.
Local applications on macOS releases prior to Golden Gate 27 can bypass the Apple Intelligence security and consent prompts, evading the authorization gate that is supposed to require explicit approval before protected Apple Intelligence functionality is reached. Exploitation is not remote: an attacker must first get a malicious or abusable app onto the machine and running under normal user privileges (CVSS AV:L/PR:L, no user interaction at exploit time), and it is only meaningful where Apple Intelligence is present and enabled. The issue is a low-urgency local authorization flaw rather than an emergency - CVSS 5.5, EPSS 0.15% (5th percentile), no CISA KEV listing, and no public exploit identified at time of analysis - though Apple has addressed it with improved state management in macOS Golden Gate 27.
An out-of-bounds read in Apple's kernel, fixed across iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27, allows a locally installed application to disclose kernel memory to user space. The flaw (CWE-125) stems from insufficient input validation in a kernel code path reached by app-supplied data, and yields high confidentiality impact only - no integrity or availability loss. Apple has released patches for all affected platforms; EPSS is very low (0.15%, 5th percentile), and there is no public exploit code or CISA KEV listing at time of analysis.
Improper certificate validation in Apple macOS allows an attacker positioned on the network path between the victim and a remote endpoint to intercept and potentially modify traffic that should have been protected by TLS. The flaw affects macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate versions before 27, and is rated CVSS 4.8 (network vector but high attack complexity), with an EPSS score of only 0.12% (2nd percentile) and no public exploit or CISA KEV listing at time of analysis. Apple addressed the issue with improved certificate validation in the three corresponding releases, so the primary defense is straightforward patching; no public exploit code has been identified.
An authorization issue was addressed with improved access control. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data.
A file quarantine bypass was addressed with additional checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27, watchOS 27. An archive may be able to bypass Gatekeeper.
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination.
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27. Processing a maliciously crafted file may lead to unexpected app termination.
A race condition was addressed with improved state handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.
A heap buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27, watchOS 27. Processing a maliciously crafted file may lead to unexpected app termination.
An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27. Opening a maliciously crafted file may cause unexpected process termination or disclose process memory.
An authorization issue was addressed with improved entitlement checks. This issue is fixed in macOS Golden Gate 27. An app may be able to capture Touch Bar content without authorization.
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted font file may lead to unexpected app termination.
This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data.
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination or read kernel memory.
A logging issue was addressed with improved data redaction. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access user-sensitive data.
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Processing a maliciously crafted 3D file may lead to an out-of-bounds read.
Network traffic integrity can be silently undermined on unpatched Apple platforms - iOS and iPadOS before 27, macOS Golden Gate before 27, tvOS before 27, and watchOS before 27 - by an unauthenticated attacker who already holds a privileged on-path network position between the device and its peer. Apple fixed the underlying cryptographic weakness through improved integrity checks in the 27-generation releases, restoring the guarantee that intercepted traffic cannot be modified undetected. Exploitation is constrained by the adjacency requirement (AV:A) and high attack complexity (AC:H), EPSS is only 0.17% (7th percentile), and no public exploit code has been identified at time of analysis.
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27. An app may be able to modify a file it only had permission to read.
An uninitialized memory issue was addressed with improved memory initialization. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may result in disclosure of process memory.
An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to access sensitive user data.
This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data.
A memory-safety defect (out-of-bounds read, CWE-125) in Apple's iOS, iPadOS, macOS, tvOS, visionOS, and watchOS can be triggered by a locally running application and causes an unexpected system termination - a denial-of-service/availability impact with no confidentiality or integrity loss. Affected versions are those prior to the fixed releases: iOS/iPadOS before 26.7 (and before 27), macOS before Sequoia 15.8, before Tahoe 26.7, and before Golden Gate 27, plus tvOS, visionOS, and watchOS before 27. Exploitation requires the attacker to already have a malicious app running on the device with its own app-level privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, scored 5.5); no public exploit code has been identified at time of analysis, EPSS is low at 0.21% (11th percentile), and there is no CISA KEV entry. Apple has released patched versions, so the practical exposure is limited to unpatched devices running a hostile app - a low-to-moderate priority issue.
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A local app may be able to read a persistent account identifier.
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Connecting to a malicious SMB server may lead to unexpected system termination.
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination or write kernel memory.
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sonoma 14.8.8. An app may be able to access sensitive user data.
An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. A malicious shortcut may be able to send messages without user confirmation.
An authentication issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27. An attacker with physical access to an unlocked device may be able to view Wi-Fi passwords without authentication.
A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access protected user data.
This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, visionOS 27. An app may be able to cause a denial-of-service.
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A malicious application may be able to determine a user's current location.
Local directory-path traversal in Apple macOS allows an app already running on the host to reach and read sensitive user data outside the directory it is permitted to access. The root cause is insufficient validation of directory paths (CWE-22), and Apple has remediated it in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27. Exploitation requires the attacker to already have code running as a low-privileged local application (AV:L, PR:L) with no user interaction, and no public exploit code has been identified at time of analysis; with an EPSS score of 0.19% (9th percentile) and no CISA KEV listing, this is a genuine but low-to-moderate priority issue rather than an urgent one.
A use-after-free (CWE-416) in Apple's memory management code allows a locally running application on iOS, iPadOS, macOS, tvOS, visionOS and watchOS to crash the affected system, producing an unexpected termination or reboot. The flaw affects all platforms before the fixed releases (iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27) and rates CVSS 5.5 (AV:L/PR:L/UI:N, availability-only impact). No public exploit code or active exploitation has been identified, and EPSS is low at 0.21% (11th percentile), so this is a patched, availability-only issue rather than an urgent remote-code-execution threat.
Improper memory handling in Apple iOS, iPadOS, and macOS lets a locally running application trigger an unexpected system termination, crashing the device or the operating system; affected versions are iOS/iPadOS prior to 26.7 or 27, and macOS prior to Golden Gate 27, Sequoia 15.8, and Tahoe 26.7. The only prerequisite is the ability to run a malicious or malformed app on the target device (local access, PR:L, no user interaction and no network reachability), and the demonstrated impact is limited to availability - no code execution, privilege escalation, or data access. No public exploit identified at time of analysis, no evidence of active exploitation (not in CISA KEV), EPSS is 0.20% (10th percentile), and vendor patches have been released.
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, watchOS 27. An app may be able to access sensitive user data.
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious app may be able to break out of its sandbox.
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27. Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure.
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, visionOS 27, watchOS 27. An app may be able to access sensitive user data.
An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, tvOS 27, visionOS 27. An app may be able to access sensitive user data.
An out-of-bounds write in Apple macOS is triggered when a user connects to a malicious WebDAV server, resulting in unexpected application termination. The flaw affects macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27, and is reachable over the network with no privileges required but with user interaction (the victim must initiate the WebDAV connection). Apple addressed it by removing the vulnerable code and shipped fixes in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27; no public exploit code or active exploitation has been identified at time of analysis, and the CVSS 3.1 score is 6.5 with availability-only impact.
A heap buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Mounting a maliciously crafted volume may lead to unexpected system termination.
An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, watchOS 27. An app may be able to access Bluetooth device information.
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination or corrupt kernel memory.
Bypass of on-device network restrictions in Apple iOS/iPadOS, macOS Golden Gate, visionOS, and watchOS builds prior to version 27 allows a locally installed, already-running app to reach network resources the operating system should have blocked, producing low confidentiality and low integrity impact with no availability effect. Exploitation requires an app that is already installed and executing with normal, authenticated app privileges on the target device (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, score 4.4); there is no remote or unauthenticated attack path, no public exploit identified at time of analysis, and EPSS is a low 0.21% (11th percentile). Apple has shipped vendor-released fixes in iOS 27, iPadOS 27, macOS Golden Gate 27, visionOS 27, and watchOS 27.
A local race condition (CWE-362) in Apple macOS allows any locally running application to trigger unexpected system termination on affected hosts. The flaw affects macOS versions prior to Tahoe 26.7 and Golden Gate 27, is availability-only (C:N/I:N/A:H), and requires local app execution with no user interaction and no privilege escalation. Apple has released fixed versions; there is no public exploit identified, no CISA KEV listing, and EPSS is only 0.16% (5th percentile), indicating low real-world exploitation pressure.
A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, visionOS 27. An app may be able to bypass certain Privacy preferences.
A race condition was addressed with improved state handling. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.
A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may lead to unexpected app termination.
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted 3D scene may lead to unexpected process termination.
An out-of-bounds write in the Apple macOS kernel allows a locally running application to corrupt kernel memory, potentially causing unexpected system termination or arbitrary kernel memory writes. The flaw affects macOS releases prior to Sequoia 15.8, Tahoe 26.7, and Golden Gate 27, with a CVSS base score of 6.1 (AV:L/AC:L/PR:L/UI:N) reflecting the requirement for local code execution with attacker-controlled privileges. No public exploit code has been identified at time of analysis, and EPSS probability is very low (0.16%, 6th percentile), suggesting targeted rather than opportunistic exploitation; CISA KEV does not list this CVE.
An information disclosure issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to disclose kernel memory.
An out-of-bounds write in Apple macOS (all versions prior to macOS 27 'Golden Gate') allows a maliciously crafted disk image to corrupt kernel memory when mounted, causing unexpected system termination. Apple addressed the flaw by removing the vulnerable code rather than adding a bounds check, and a vendor patch is available in macOS 27. There is no CISA KEV listing and no public exploit code identified at time of analysis; EPSS is very low at 0.14% (4th percentile), so exploitation appears opportunistic at most.
The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination.
Loading maliciously crafted web content in Apple's WebKit engine can crash the renderer or host process on Safari, iOS/iPadOS, macOS, tvOS, visionOS and watchOS builds earlier than the version 27 releases, producing a denial-of-service condition rather than code execution or data exposure. The flaw is a state-management logic error in the type-confusion class (CWE-843), and it is reachable from a remote web-content delivery path, so exploitation hinges on getting a victim to open a hostile page or embed WebKit content. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; EPSS is only 0.14% (4th percentile), and Apple has shipped fixed '27' releases across all affected platforms, so the practical risk is moderate and availability-only. Note that Apple's published vector lists PR:L/UI:N while our assessment uses PR:N/UI:R, a contradiction worth confirming with the vendor.
A use-after-free in macOS memory management allows a locally running application to crash the operating system, resulting in unexpected termination and loss of unsaved work. The flaw affects macOS Tahoe before 26.6, macOS Sequoia before 15.7.8, and macOS Sonoma before 14.8.8, with exploitation requiring only low privileges (CVSS PR:L) and no additional user interaction. Apple has released fixes (patch available per vendor advisories), and although EPSS is very low at 0.19% (9th percentile) with no CISA KEV listing, no public exploit code identified at time of analysis, the flaw is a memory-safety bug that carries inherent risk of escalation beyond a simple denial of service.
Gatekeeper enforcement in Apple macOS can be bypassed by a malicious application that is delivered locally and opened by the user, letting the app run without satisfying macOS's normal code-signing and notarization checks. The flaw is a logic error (CWE-693, protection mechanism failure) affecting macOS builds prior to Golden Gate 27, Sequoia 15.8, Tahoe 26.6 and Tahoe 26.7; CVSS 5.5 reflects an integrity-only, non-privileged local impact that requires user interaction and grants no direct privilege escalation or confidentiality loss. No public exploit code has been identified at time of analysis and EPSS is low at 0.21% (11th percentile), so the practical value of the bug is as a stage in a broader malware delivery chain rather than a standalone compromise.
An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An app may be able to fingerprint the device.
A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app with root privileges may be able to read uninitialized kernel memory.
A correctness issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.8.8. An attacker with physical access may be able to silently persist an Apple Account on an erased device.
The issue was addressed with improved authentication. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.6. An app may be able to cause unexpected system termination.
Apps already running on macOS versions prior to Golden Gate 27 can modify Privacy (TCC) preferences they are not authorized to change, letting a malicious app grant itself access to consent-gated resources such as the camera, microphone, or other protected data without ever prompting the user. The root cause is an incorrect-authorization weakness (CWE-863) that Apple addressed by adding restrictions to the permission check, so exploitation is not remote: the attacker must first deliver and run code on the host (AV:L, PR:L, UI:N), making this primarily a post-compromise, integrity-only escalation of an app's privacy privileges (C:N/I:H/A:N). EPSS is only 0.17% (7th percentile), there is no CISA KEV entry and no public exploit identified at time of analysis, and a vendor-released fix exists in macOS Golden Gate 27.
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A local attacker may be able to cause unexpected system termination or corrupt kernel memory.
A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker in a privileged network position may be able to leak sensitive user information.
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. Processing maliciously crafted NTLM input may lead to unexpected app termination.
A permissions issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data.
An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to access sensitive user data.
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to access sensitive user data.
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected process termination or disclose process memory.
A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to bypass Gatekeeper checks.
Arbitrary file read in Apple macOS allows a locally running malicious or compromised application to bypass path-handling input sanitization and read files the operating system should have denied it, exposing potentially sensitive user or system data. Exploitation requires the attacker to already have code execution on the host - a local, low-privileged app context (PR:L) with no further user interaction - and the impact is confined to confidentiality, with no integrity or availability effect. The flaw is moderate severity (EPSS 0.19%, 9th percentile) with no public exploit identified at time of analysis, and it is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27.
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A local user may be able to cause unexpected system termination or read kernel memory.
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, macOS Golden Gate 27. Processing a maliciously crafted image may lead to unexpected app termination.
A race condition was addressed with improved state handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination or corrupt kernel memory.
Processing maliciously crafted web content in Apple's WebKit-based browser stack can disclose sensitive user information across Safari 27, iOS/iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27 and earlier. Apple classifies the root cause as an improper privilege management (permissions) issue and fixed it by removing the vulnerable code rather than adding a check, per the vendor advisories referenced for CVE-2026-64753. Real-world urgency is currently low: EPSS is 0.14% (4th percentile), there is no CISA KEV listing or public exploit identified at time of analysis, and CISA's SSVC assessment is exploitation:none / automatable:no / technical impact:partial, while a vendor patch is already available.
A path traversal issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, watchOS 27. An app may be able to modify protected system files.