Home / mailings APPLE-SA-07-27-2026-2 macOS Tahoe 26.6
Posted on 28 July 2026
Apple Security-announceAPPLE-SA-07-27-2026-2 macOS Tahoe 26.6
macOS Tahoe 26.6 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/128067.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accounts
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: An access issue was addressed with additional sandbox
restrictions.
CVE-2026-43819: Omar Cerrito
Accounts
Available for: macOS Tahoe
Impact: An app may be able to gain root privileges
Description: A parsing issue in the handling of directory paths was
addressed with improved path validation.
CVE-2026-43749: Adam Franke, Ashish Kunwar, Trung Nguyen (@everping) of
CyStack
Accounts Framework
Available for: macOS Tahoe
Impact: An app may be able to fingerprint the user
Description: This issue was addressed with improved data protection.
CVE-2026-64733: Rosyna Keller of Totally Not Malicious Software
(paradisefacade.com)
afpfs
Available for: macOS Tahoe
Impact: A remote attacker may be able to cause unexpected system
termination or corrupt kernel memory
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-64767: Dave G.
apache
Available for: macOS Tahoe
Impact: A remote attacker may be able to cause a denial-of-service
Description: This is a vulnerability in open source code and Apple
Software is among the affected projects. The CVE-ID was assigned by a
third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2026-23918: =D0=AE=D0=BB=D0=B8=D1=8F =D0=9C=D0=B5=D1=80=D1=86=D0=B0=D0==BB=D0=BE=D0=B2=D0=B0
APFS
Available for: macOS Tahoe
Impact: A remote user may be able to cause unexpected system termination
or corrupt kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64695: Peter Malone
App Store
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved checks.
CVE-2026-43801: Rahul Raj
Apple Account
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: A race condition was addressed with improved state
handling.
CVE-2026-43781: Pinak Oza
Apple Account
Available for: macOS Tahoe
Impact: A malicious app may be able to break out of its sandbox
Description: An authorization issue was addressed with improved state
management.
CVE-2026-64737: Robert Mindo
Apple Neural Engine
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43748: an anonymous researcher, tamdao, Franco Belman at
Blackwing Intelligence
Apple Neural Engine
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-28928: Dun
AppleDouble
Available for: macOS Tahoe
Impact: Processing a maliciously crafted file may lead to unexpected app
termination or arbitrary code execution
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-43776: Irvin Wang, Peter Malone, Nicolas Rabrenovic
AppleRAID
Available for: macOS Tahoe
Impact: A local user may be able to read kernel memory
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-43681: impost0r (ret2plt), David Ige - Beryllium Security
Assets
Available for: macOS Tahoe
Impact: A malicious application may be able to bypass Privacy
preferences
Description: An authorization issue was addressed with improved state
management.
CVE-2026-43672: =EC=9D=B4=EC=9E=AC=EC=98=81
ATS
Available for: macOS Tahoe
Impact: An app may be able to read files outside of its sandbox
Description: A permissions issue was addressed by removing the
vulnerable code.
CVE-2026-43763: Pavan Nallamothu, Jared Reyes
Audio
Available for: macOS Tahoe
Impact: An app may be able to break out of its sandbox
Description: An access issue was addressed with additional sandbox
restrictions.
CVE-2026-64702: John Lussier
Audio
Available for: macOS Tahoe
Impact: An app may be able to cause a denial-of-service
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)
AuthKit
Available for: macOS Tahoe
Impact: An app may be able to fingerprint the user
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-43730: David Strnadel
AVEVideoEncoder
Available for: macOS Tahoe
Impact: An app may be able to execute arbitrary code with kernel
privileges
Description: A buffer overflow was addressed with improved size
validation.
CVE-2026-64747: Franco Belman at Blackwing Intelligence
AVEVideoEncoder
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-64762: Dun, Franco Belman at Blackwing Intelligence
BackgroundAssets
Available for: macOS Tahoe
Impact: An app may be able to delete files for which it does not have
permission
Description: A permissions issue was addressed with improved validation.
CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab
cd9660
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination or
read kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64698: an anonymous researcher, Richard Zana, Nathaniel Oh
(@calysteon), Peter Malone
CloudAttestation
Available for: macOS Tahoe
Impact: A maliciously crafted app may be able to bypass code signing
enforcement
Description: A validation issue was addressed with improved input
sanitization.
CVE-2026-43813: Anton Pakhunov
Contacts
Available for: macOS Tahoe
Impact: An app may be able to add contacts without user authorization
Description: An authorization issue was addressed with improved
validation.
CVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel
Febrero
Contacts
Available for: macOS Tahoe
Impact: Processing a maliciously crafted contact may leak sensitive data
Description: The issue was addressed with improved checks.
CVE-2026-64734: Daniel Williams
Contacts
Available for: macOS Tahoe
Impact: An app may be able to access information about a user's contacts
Description: This issue was addressed with improved checks.
CVE-2026-43797: Arni Hardarson (Neonix Security)
Control Center
Available for: macOS Tahoe
Impact: An app may be able to access user-sensitive data
Description: A logic issue was addressed with improved validation.
CVE-2026-43756: =EC=9D=B4=EC=9E=AC=EC=98=81
Core Services
Available for: macOS Tahoe
Impact: An app may be able to gain root privileges
Description: A race condition was addressed with improved state
handling.
CVE-2026-43693: Gergely Kalman (@gergely_kalman)
CoreAudio
Available for: macOS Tahoe
Impact: Processing a maliciously crafted audio file may corrupt process
memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative
CoreAudio
Available for: macOS Tahoe
Impact: Processing an audio stream in a maliciously crafted media file
may terminate the process
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43744: Mathis Mansi=C3=A8re, an anonymous researcher
CoreAudio
Available for: macOS Tahoe
Impact: A remote attacker may be able to cause unexpected system
termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43803: Rahul Raj
CoreMedia
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: An authorization issue was addressed with improved state
management.
CVE-2026-43775: Csaba Fitzl (@theevilbit) of Iru
CVE-2026-43759: =EC=9D=B4=EC=9E=AC=EC=98=81, Rajdip Dey Sarkar, Arni =Hardarson (Neonix Security)
CoreMedia
Available for: macOS Tahoe
Impact: Processing a maliciously crafted video file may lead to
unexpected app termination
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2026-43711: James Duffy (@0x4A616D657344)
CoreVideo
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43802: an anonymous researcher
Crash Reporter
Available for: macOS Tahoe
Impact: An app may be able to leak sensitive user information
Description: A privacy issue was addressed by removing sensitive data.
CVE-2026-64710: Matthew Schneider
CUPS
Available for: macOS Tahoe
Impact: A malicious app may be able to gain root privileges
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-39875: Dallas Dubs, Aaron Grattafiori - NVIDIA AI Red Team,
XBreach.ai, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
CUPS
Available for: macOS Tahoe
Impact: An app may be able to gain root privileges
Description: An injection issue was addressed with improved validation.
CVE-2026-43698: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
curl
Available for: macOS Tahoe
Impact: Authentication credentials may be sent to a server on another
origin
Description: This is a vulnerability in open source code and Apple
Software is among the affected projects. The CVE-ID was assigned by a
third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2026-3784
CVE-2026-3783
Data Detectors UI
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: An authorization issue was addressed with improved state
management.
CVE-2026-43758: HvxyZLF
DesktopServices
Available for: macOS Tahoe
Impact: An app may bypass Gatekeeper checks
Description: A file quarantine bypass was addressed with additional
checks.
CVE-2026-64708: Lance Cain - Offensive Security Engineer, SpecterOps
Inc.
Disk Images
Available for: macOS Tahoe
Impact: An app may be able to disclose kernel memory
Description: The issue was addressed with improved bounds checks.
CVE-2026-64776: Hyunwoo Kim (@v4bel)
Disk Images
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-64694: Gil Portnoy & Henry
Disk Images
Available for: macOS Tahoe
Impact: Parsing a maliciously crafted file may lead to an unexpected app
termination
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-43747: Anthony Laou Hine Tsuei (@anarcheuz)
Disk Images
Available for: macOS Tahoe
Impact: An app may be able to bypass network restrictions
Description: A permissions issue was addressed with additional sandbox
restrictions.
CVE-2026-28945: Ayaan Ahmad
DriverKit
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: An issue existed in the handling of environment variables.
This issue was addressed with improved validation.
CVE-2026-43793: erdene-och Byambabayar
DriverKit
Available for: macOS Tahoe
Impact: An attacker with physical access to a locked device may be able
to view sensitive user information
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-43753: Niels Hofmans
Foundation
Available for: macOS Tahoe
Impact: A malicious app may be able to access protected user data
Description: The issue was addressed with improved input sanitization.
CVE-2026-43714: an anonymous researcher
Game Center
Available for: macOS Tahoe
Impact: A malicious app may be able to break out of its sandbox
Description: A parsing issue in the handling of directory paths was
addressed with improved path validation.
CVE-2026-64740: Manuel Fernandez (Stackhopper Security)
Game Center
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved data protection.
CVE-2026-43796: Ilya Andr (andrd3v) of Positive Technologies, Stanislav
Jelezoglo
GPU Drivers
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: A buffer overflow was addressed with improved size
validation.
CVE-2026-64691: Somair Ansar, Josh Maine of Calif.io, Johnny Franks
(@zeroxjf), hxr1, Alexandre Soleiman, Alexander Tarasikov and Ruslan
Dautov, Ruslan Dautov
Heimdal
Available for: macOS Tahoe
Impact: An app may be able to cause a denial-of-service
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-64692: Redon Gashi
HFS
Available for: macOS Tahoe
Impact: A remote user may be able to cause unexpected system termination
or corrupt kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43682: Trung Nguyen (@everping) of CyStack, Dave G., Nicolas
Rabrenovic, Atul R V & Ashmit Sharma, Peter Malone
HFS
Available for: macOS Tahoe
Impact: Processing a maliciously crafted image may lead to arbitrary
code execution
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-28981: Hcamael and =E7=AB=A0=E9=B1=BC=E5=93=A5@aipy ==EF=BC=88aipyaipy.com=EF=BC=89, Aswin Kumar
Gokulakannan, Surya Narayan Kushwaha, Dun
HFS
Available for: macOS Tahoe
Impact: Mounting a maliciously crafted disk image may cause unexpected
system termination or corrupt kernel memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-43773: Richard Zana, Peter Malone, Surya Narayan Kushwaha,
Hyunwoo Kim (@v4bel), Cem Onat Karagun
HFS
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: The issue was addressed with improved memory handling.
CVE-2026-43767: Hyunwoo Kim (@v4bel)
HFS
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-43764: Tristan Madani (@TristanInSec) from Talence Security
HFS
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64697: Peter Malone
HFS
Available for: macOS Tahoe
Impact: An attacker may be able to cause unexpected system termination
or corrupt kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43710: Peter Malone
ImageIO
Available for: macOS Tahoe
Impact: Processing a maliciously crafted texture may lead to unexpected
app termination
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day
Initiative
ImageIO
Available for: macOS Tahoe
Impact: Processing a maliciously crafted image may lead to arbitrary
code execution
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-43818: an anonymous researcher
ImageIO
Available for: macOS Tahoe
Impact: Processing a maliciously crafted image may corrupt process
memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64716: Arni Hardarson, Jonathan Alush-Aben, Peter Malone
ImageIO
Available for: macOS Tahoe
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: The issue was addressed with improved bounds checks.
CVE-2026-64758: =EC=A7=84=EA=B7=9C=EC=A0=95 (Gyujeong Jin, @G1uN4sh)
ImageIO
Available for: macOS Tahoe
Impact: Processing a maliciously crafted file may lead to a
denial-of-service
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-64754: PETOWORKS=EC=9D=98 Bugeun Choi (@Bugeun), Rahul Raj
ImageIO
Available for: macOS Tahoe
Impact: Processing a maliciously crafted image may lead to a
denial-of-service
Description: A type confusion issue was addressed with improved checks.
CVE-2026-64693: Geonha Lee (@leegn4a)
IOKit
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination or
write kernel memory
Description: A race condition was addressed with improved state
handling.
CVE-2026-43805: =EC=9D=B4=EC=9E=AC=EC=98=81
Kernel
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved checks.
CVE-2026-43782: Igor Ushakov
Kernel
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64749: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)
of STAR Labs SG Pte. Ltd., Ashish Kunwar, Hiroki Imai (LAC Co., Ltd.),
hxr1
Kernel
Available for: macOS Tahoe
Impact: An app may be able to disclose kernel memory
Description: An information leakage was addressed with additional
validation.
CVE-2026-64744: Ryan Hileman via Xint Code (xint.io)
Kernel
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-43778: f0r of MurphySec, Feng Xue and XGPT of ThreatBook,
Mahmoud Abdelmoniem, an anonymous researcher, Wang Yu, Lyutoon, Hiroki
Imai (LAC Co., Ltd.), DARKNAVY (@DarkNavyOrg), F=C3=A1bio Lu=C3=ADs =@scanpt,
Nicolas Rabrenovic
Kernel
Available for: macOS Tahoe
Impact: A remote user may be able to cause unexpected system termination
or corrupt kernel memory
Description: A race condition was addressed with improved locking.
CVE-2026-28982: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)
of STAR Labs SG Pte. Ltd., Adam Doup=C3=A9 of ASU SEFCOM
Kernel
Available for: macOS Tahoe
Impact: An app may be able to disclose kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64709: Pasquale Scola, Billy Jheng Bing Jhong and Pan Zhenpeng
(@Peterpan0927) of STAR Labs SG Pte. Ltd.
Kernel
Available for: macOS Tahoe
Impact: A remote attacker may be able to bypass network filters
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2026-64735: Gor Aleksanyan
Kernel
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43739: impost0r (ret2plt), Ruslan Dautov, Aleksandr Tarasikov,
jay, Dhiyanesh Selvaraj (@redroot97), Vinay Kumar Rasala (Xplo8E) from
Appknox, Lyutoon, DongJun Kim (smlijun) with UIUC, Hwiwon Lee (hwiwonl)
with UIUC, Jongseong Kim (nevul37) with UIUC, Younggi Park (grill66)
with UIUC, Peter Malone, an anonymous researcher, Hari Shanmugam (The
Hxr1), Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR
Labs SG Pte. Ltd., Marco Grassi, Dun, Daniele Castronovo, Michal
Kosiorek
CVE-2026-43816: Josh Maine of Calif.io, Ruslan Dautov, =EC=9E=AC=EC=98=81 ==EC=A0=95, @rootxran
(Rao Ali Nawaz), Chanwit Muenprakoddee (ChemIndy), an anonymous
researcher, Ye Zhang (@VAR10CK) of Baidu Security, Franco Belman at
Blackwing Intelligence, Christian Figueroa, Johnny Franks (@zeroxjf),
Ashmit Sharma & Atul RV, Peter Malone, Muhamad Syaiful, Muneeb Amin
Bhat, Dhiyanesh Selvaraj (@redroot97), Ali Marzouq, Bountyy Oy - Mihalis
Haatainen, Huy Nguyen (@34306) of Calif.io
Kernel
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-43822: Eddy Tsalolikhin, Michal Kosiorek
CVE-2026-64729: Josh Maine of Calif.io, beist, Adam Doup=C3=A9 of ASU =SEFCOM,
Dun, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR
Labs SG Pte. Ltd., Johnny Franks (@zeroxjf)
CVE-2026-43814: Somair Ansar, Huy Nguyen (@34306) of Calif.io
CVE-2026-64700: Asjid Kalam (@odinshell)
CVE-2026-43799: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)
of STAR Labs SG Pte. Ltd.
Kernel
Available for: macOS Tahoe
Impact: Connecting to a malicious NFS server may lead to kernel memory
corruption
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-28931: Redon Gashi, Abhijeet Singh (linkedin.com/in/abhiunix/),
Peter Malone, Omar Cerrito
Kernel
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-43817: Huy Nguyen (@34306) of Calif.io
CVE-2026-43809: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)
of STAR Labs SG Pte. Ltd.
CVE-2026-43757: Wang Yu, Billy Jheng Bing Jhong and Pan Zhenpeng
(@Peterpan0927) of STAR Labs SG Pte. Ltd.
Kernel
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-43769: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)
of STAR Labs SG Pte. Ltd.
Kernel
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: A type confusion issue was addressed with improved memory
handling.
CVE-2026-64727: Ye Zhang (@VAR10CK) of Baidu Security
Kernel
Available for: macOS Tahoe
Impact: A remote user may be able to cause unexpected system termination
or corrupt kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43810: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)
of STAR Labs SG Pte. Ltd.
Kernel
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: A memory initialization issue was addressed with improved
memory handling.
CVE-2026-64775: Ryan Hileman via Xint Code (xint.io)
Kernel
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: A logic issue was addressed with improved checks.
CVE-2026-64723: Ji'an Zhou, Mingxuan Yang, Ye Zhang
Kernel
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: A race condition was addressed with improved state
handling.
CVE-2026-64720: an anonymous researcher, Asjid Kalam (@odinshell), Jian
Zhou and Ye Zhang
Kernel
Available for: macOS Tahoe
Impact: An app may be able to leak sensitive kernel state
Description: This issue was addressed with improved redaction of
sensitive information.
CVE-2026-43754: Calif Research, Ernesto Mart=C3=ADnez Garc=C3=ADa
Kernel
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination or
write kernel memory
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-64751: N.M.Praveen Nawarathne (@zblockrat)
Kernel
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: This issue was addressed through improved state management.
CVE-2026-64721: Lukas Gerlach
libarchive
Available for: macOS Tahoe
Impact: Processing a maliciously crafted file may result in disclosure
of process memory
Description: This is a vulnerability in open source code and Apple
Software is among the affected projects. The CVE-ID was assigned by a
third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2026-4424
libc
Available for: macOS Tahoe
Impact: A malicious app may be able to break out of its sandbox
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-28973: an anonymous researcher
Libnotify
Available for: macOS Tahoe
Impact: An attacker may be able to cause unexpected app termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-64739: Feng Xue and XGPT of ThreatBook, Dun
LoginWindow
Available for: macOS Tahoe
Impact: An attacker with physical access to a locked device may be able
to view sensitive user information
Description: An authorization issue was addressed with improved state
management.
CVE-2026-43766: Amy (amys.website)
Managed Configuration
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: An authorization issue was addressed with improved state
management.
CVE-2026-64743: Daniel Febrero
Maps
Available for: macOS Tahoe
Impact: A malicious app may be able to break out of its sandbox
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-64738: Nathaniel Oh (@calysteon), Robert Mindo
mDNSResponder
Available for: macOS Tahoe
Impact: A local attacker may be able to cause a denial of service
Description: A denial of service issue was addressed by removing the
vulnerable code.
CVE-2026-43806: He Wei (=E3=82=AE=E3=82=AB=E3=82=AF), =E7=AB=A0=E9=B1=BC=E5==93=A5 (@aipy) of aipyaipy.com, Jex Amro, Cem
Onat Karagun
mDNSResponder
Available for: macOS Tahoe
Impact: An attacker on the local network may be able to cause a
denial-of-service
Description: The issue was addressed with improved memory handling.
CVE-2026-64724: Daisuke Hatakeyama (@SYZD Research)
MediaRemote
Available for: macOS Tahoe
Impact: An app may be able to gain root privileges
Description: A path handling issue was addressed with improved
validation.
CVE-2026-43723: Richard Zana, Andreas Jaegersberger & Ro Achterberg of
Nosebeard Labs
Metal
Available for: macOS Tahoe
Impact: A malicious app may be able to corrupt memory of a system
process
Description: The issue was addressed with improved memory handling.
CVE-2026-28911: yk lin of @pixiepointsec
Model I/O
Available for: macOS Tahoe
Impact: Processing a maliciously crafted image may corrupt process
memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43733: Michael DePlante (@izobashi) of TrendAI Zero Day
Initiative
CVE-2026-43729: Michael DePlante (@izobashi) of TrendAI Zero Day
Initiative
Model I/O
Available for: macOS Tahoe
Impact: A remote attacker may be able to cause unexpected application
termination or heap corruption
Description: An out-of-bounds write issue was addressed with improved
input validation.
CVE-2026-64772: stratan (@5tratan), wh0am1i
Model I/O
Available for: macOS Tahoe
Impact: A remote attacker may be able to cause unexpected application
termination or heap corruption
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-64771: wh0am1i
Model I/O
Available for: macOS Tahoe
Impact: Processing a 3D model may result in disclosure of process memory
Description: A buffer overflow issue was addressed with improved memory
handling.
CVE-2026-64722: wh0am1i
Model I/O
Available for: macOS Tahoe
Impact: A remote attacker may be able to cause unexpected application
termination or heap corruption
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-64774: stratan (@5tratan)
Model I/O
Available for: macOS Tahoe
Impact: A remote attacker may be able to cause unexpected application
termination or heap corruption
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-64770: stratan (@5tratan)
CVE-2026-64769: stratan (@5tratan)
Model I/O
Available for: macOS Tahoe
Impact: A remote attacker may cause an unexpected app termination
Description: An out-of-bounds read issue was addressed with improved
input validation.
CVE-2026-64768: stratan (@5tratan)
Net-SNMP
Available for: macOS Tahoe
Impact: An app may be able to cause a denial-of-service
Description: A stack overflow was addressed with improved input
validation.
CVE-2026-43771: Robert Tran
NetFSFramework
Available for: macOS Tahoe
Impact: An app may be able to break out of its sandbox
Description: A path traversal issue was addressed with improved input
validation.
CVE-2026-43772: Mickey Jin (@patch1t)
NSColorPanel
Available for: macOS Tahoe
Impact: An app may be able to leak sensitive user information
Description: This issue was addressed with additional entitlement
checks.
CVE-2026-64711: Koh M. Nakagawa (@tsunek0h) of FFRI Security, Inc.
PackageKit
Available for: macOS Tahoe
Impact: A user may be able to elevate privileges
Description: A logic issue was addressed with improved restrictions.
CVE-2026-28912: Matej Moravec (@MacejkoMoravec)
PackageKit
Available for: macOS Tahoe
Impact: An app may be able to modify protected parts of the file system
Description: This issue was addressed with improved handling of
symlinks.
CVE-2026-43765: Mickey Jin (@patch1t)
Printing
Available for: macOS Tahoe
Impact: A malicious app may be able to break out of its sandbox
Description: A path handling issue was addressed with improved
validation.
CVE-2026-64731: Sindre Sorhus, Richard Zana
Pro Res
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-43812: Francisco Knabe
quarantine
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination or
write kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43694: Hcamael and =E7=AB=A0=E9=B1=BC=E5=93=A5@aipy ==EF=BC=88aipyaipy.com=EF=BC=89, JC Alvarado of
Stripe, Jacob Hazak
Remote Management
Available for: macOS Tahoe
Impact: A malicious app may be able to gain root privileges
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-39874: @pixiepointsec
Safari
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: An authorization issue was addressed with improved state
management.
CVE-2026-43792: Ilya Andr (andrd3v)
SceneKit
Available for: macOS Tahoe
Impact: Processing a maliciously crafted file may lead to unexpected app
termination or arbitrary code execution
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-64766: stratan (@5tratan)
CVE-2026-64765: stratan (@5tratan)
SceneKit
Available for:
Impact: Processing a maliciously crafted file may lead to unexpected app
termination or arbitrary code execution
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-64764: stratan (@5tratan)
SceneKit
Available for: macOS Tahoe
Impact: Processing a maliciously crafted file may lead to unexpected app
termination or arbitrary code execution
Description: An out-of-bounds write issue was addressed by removing the
vulnerable code.
CVE-2026-64763: stratan (@5tratan)
Screen Sharing Server
Available for: macOS Tahoe
Impact: An app may be able to intercept network connections intended for
another process
Description: A logic issue was addressed with improved restrictions.
CVE-2026-43779: Dave G., Asaf Cohen
Screen Sharing Server
Available for: macOS Tahoe
Impact: A remote attacker may be able to cause a denial of service
Description: This issue was addressed with improved input validation.
CVE-2026-43777: Junming C.(Chapoly1305)
Screen Sharing Server
Available for: macOS Tahoe
Impact: An app may be able to access user-sensitive data
Description: An access issue was addressed with improved access
restrictions.
CVE-2026-43760: Alfredo Pesoli (@__rev) of Bynar.io, wdszzml and Atuin
Automated Vulnerability Discovery Engine
Security
Available for: macOS Tahoe
Impact: An attacker may be able to modify the state of the Keychain
Description: This issue was addressed through improved state management.
CVE-2026-43728: Bob Gendler of the National Institute of Standards and
Technology
SecurityAgent
Available for: macOS Tahoe
Impact: An app may be able to gain root privileges
Description: A race condition was addressed with improved state
management.
CVE-2026-43755: Mickey Jin (@patch1t)
Siri
Available for: macOS Tahoe
Impact: A person with physical access to a locked device may be able to
access contacts and photos
Description: This issue was addressed with additional restrictions on
the lock screen.
CVE-2026-64745: Vivek Dhar, ASI (RM) in Border Security Force, FTR HQ
BSF Kashmir
Siri
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: An information disclosure issue was addressed by removing
the vulnerable code.
CVE-2026-43800: Stanislav Jelezoglo
SMB
Available for: macOS Tahoe
Impact: Connecting to a malicious SMB server may lead to unexpected
system termination
Description: The issue was addressed with improved memory handling.
CVE-2026-39873: Peter Malone
SMB
Available for: macOS Tahoe
Impact: A remote user may be able to cause unexpected system termination
or corrupt kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64696: Feng Xue and XGPT of ThreatBook, Peter Malone
SMB
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: A type confusion issue was addressed with improved memory
handling.
CVE-2026-64704: Claudio Bozzato and Francesco Benvenuto of Cisco Talos,
Aswin Kumar Gokulakannan, Kitten Food, Peter Malone, Calif.io in
collaboration with Claude and Anthropic Research
Spotlight
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-43774: Csaba Fitzl (@theevilbit) of Iru
StorageKit
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: A race condition was addressed with additional validation.
CVE-2026-43770: Tien-Chih Lin of CyCraft Technology
udf
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: The issue was addressed with improved memory handling.
CVE-2026-43768: Hyunwoo Kim (@v4bel)
WebDAV
Available for: macOS Tahoe
Impact: An app may be able to cause a denial-of-service
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-64703: Bruce Dang of Calif.io in collaboration with Claude and
Anthropic Research
WebDAV
Available for: macOS Tahoe
Impact: An app may be able to disclose kernel memory
Description: A memory initialization issue was addressed with improved
memory handling.
CVE-2026-64699: Bruce Dang of Calif.io
WebKit
Available for: macOS Tahoe
Impact: Processing maliciously crafted web content may result in the
disclosure of process memory
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 308046
CVE-2026-43740: Arni Hardarson, Nathaniel Oh (@calysteon)
WebKit
Available for: macOS Tahoe
Impact: Websites may know if the user has visited a given link
Description: This issue was addressed with improved checks.
WebKit Bugzilla: 316827
CVE-2026-64713: Kwak Kiyong, Song Nuri
WebKit
Available for: macOS Tahoe
Impact: Visiting a website that frames malicious content may lead to UI
spoofing
Description: The issue was addressed with improved UI.
WebKit Bugzilla: 311660
CVE-2026-64730: Kagami Rosylight of Mozilla
WebKit
Available for: macOS Tahoe
Impact: Maliciously crafted web content may violate iframe sandboxing
policy
Description: A permissions issue was addressed with improved validation.
WebKit Bugzilla: 313220
CVE-2026-64728: an anonymous researcher
WebKit
Available for: macOS Tahoe
Impact: Processing maliciously crafted web content may lead to an
unexpected Safari crash
Description: A use-after-free issue was addressed with improved memory
management.
WebKit Bugzilla: 313521
CVE-2026-64783: =E6=9D=89=E5=B1=B1 =E5=A3=AE=E5=A4=AA, lattice, Behzad =Najjarpour Jabbari (@_G4ru_),
Junyeong Lee, Mooth.ai, OGINOME Tomohito, Using GLM =46rom Z.AI, Gia Bui
(@yabeow) from Calif.io
WebKit
Available for: macOS Tahoe
Impact: Processing maliciously crafted web content may lead to an
unexpected Safari crash
Description: A memory corruption issue was addressed with improved state
management.
WebKit Bugzilla: 315082
CVE-2026-64757: Milad Nasr and Nicholas Carlini with Claude, Anthropic
WebKit
Available for: macOS Tahoe
Impact: Visiting a website may lead to an app denial-of-service
Description: This issue was addressed through improved state management.
WebKit Bugzilla: 316816
CVE-2026-43804: Heiko Kiesel of SEEMOO, TU Darmstadt
WebKit
Available for: macOS Tahoe
Impact: An app may be able to read files outside of its sandbox
Description: An access issue was addressed with improved access
restrictions.
WebKit Bugzilla: 314867
CVE-2026-43821: Brian Carpenter
WebKit Canvas
Available for: macOS Tahoe
Impact: Processing maliciously crafted web content may lead to an
unexpected Safari crash
Description: A use-after-free issue was addressed with improved memory
management.
WebKit Bugzilla: 313935
CVE-2026-64718: OGINOME Tomohito, an anonymous researcher
WebRTC
Available for: macOS Tahoe
Impact: Processing maliciously crafted web content may lead to an
unexpected Safari crash
Description: An out-of-bounds access issue was addressed with improved
bounds checking.
WebKit Bugzilla: 319404
CVE-2026-64719: Shaheen Fazim
Wi-Fi
Available for: macOS Tahoe
Impact: An attacker in physical proximity may be able to corrupt process
memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64726: Mathis Mansi=C3=A8re, Peter Malone
Wi=E2=80=91Fi
Available for: macOS Tahoe
Impact: An app may be able to execute arbitrary code out of its sandbox
or with certain elevated privileges
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-43750: an anonymous researcher
xar
Available for: macOS Tahoe
Impact: An app may be able to cause a denial of service
Description: A logic issue existed resulting in memory corruption. This
was addressed with improved state management.
CVE-2026-28932: Mathis Mansi=C3=A8re
Additional recognition
Audio
We would like to acknowledge Niels Hofmans for their assistance.
copyfile
We would like to acknowledge Keisuke Hosoda for their assistance.
CoreAnalytics
We would like to acknowledge Alan Banderas (@creeper4004) for their
assistance.
CoreMedia
We would like to acknowledge yaohway for their assistance.
dcerpc
We would like to acknowledge Surya Narayan Kushwaha for their
assistance.
Disk Images
We would like to acknowledge Jordy Zomer (@pwningsystems), Phillip
Groves, Richard Zana for their assistance.
DriverKit
We would like to acknowledge Niels Hofmans for their assistance.
Foundation
We would like to acknowledge Nick Cook, Sentry Flag for their
assistance.
Heimdal
We would like to acknowledge Surya Narayan Kushwaha for their
assistance.
IOStorageFamily
We would like to acknowledge Aswin Kumar Gokula Kannan, Surya Narayan
Kushwaha, Yatin Taneja for their assistance.
Kernel
We would like to acknowledge Billy Jheng Bing Jhong and Pan Zhenpeng
(@Peterpan0927) of STAR Labs SG Pte. Ltd., Chris Betz, Hiroki Imai (LAC
Co., Ltd.), James Duffy ( @0x4A616D657344 ), Mathis Mansi=C3=A8re, =Tristan
Rousseau, Vladislav Shevchenko (Positive Technologies), Yeojin Kim,
YingMuo (@YingMuo) of DEVCORE Research Team for their assistance.
PluginKit
We would like to acknowledge Asaf Cohen, Ashish Kunwar for their
assistance.
Printing UIKit
We would like to acknowledge Jacolon Walker ( @call_eax ) for their
assistance.
RemoteServiceDiscovery
We would like to acknowledge Maliq Barnard, Tommy DeVoss from Braze
Security Team (@thedawgyg), Willard Jansen for their assistance.
ReplayKit
We would like to acknowledge an anonymous researcher for their
assistance.
Safari Downloads
We would like to acknowledge Alfaz Hossain for their assistance.
Screen Sharing Server
We would like to acknowledge Ayaan Ahmad, XlabAI Team of Tencent Xuanwu
Lab, Atuin Automated Vulnerability Discovery Engine, Guannan Wang,
Zhanpeng Liu, Jiashuo Liang, Guancheng Li for their assistance.
Security
We would like to acknowledge John Lussier, Oleh Konko of 1seal
(1seal.org), alick for their assistance.
Spotlight
We would like to acknowledge Ilya Andr (andrd3v) and nkhmelni for their
assistance.
System Settings
We would like to acknowledge Masaki Moriguchi, Omar Cerrito for their
assistance.
Time Machine
We would like to acknowledge Andreas Jaegersberger & Ro Achterberg of
Nosebeard Labs for their assistance.
WebKit
We would like to acknowledge Jaya Surya Kommireddy, Jaya surya
Kommireddy, Lukas Knittel (@kunte_ctf) of Ruhr-University Bochum, Nikos
Fanourakis of Technical University of Crete, Sotiris Ioannidis of
Technical University of Crete, Panagiotis Ilia of Cyprus University of
Technology, and Kostas Drakonakis of Technical University of Crete, Tony
Gorez (@tonygo_) for Reverse Society, Vitaly Simonovich, Youngjoon Kim
of Team-Atlanta & sslab at Georgia Tech, s3zer0 for their assistance.
WebKit Canvas
We would like to acknowledge Codex Security - Khai Tran, Daisuke
Hatakeyama and Ryohei Ueki (@SYZD Research), David Bors at Snyk Security
Labs, Giovanni Vignone and Robert van Eijk of Octane Security
(octane.security), Kwak Kiyong, Song nuri, Luat Nguyen (CyberJutsu
Academy), Tom Van Goethem, an anonymous researcher, dr3dd for their
assistance.
WebKit Storage
We would like to acknowledge Gurpreet Shergill, Luke Francis, Milad Nasr
and Nicholas Carlini with Claude, Anthropic, Oleh Konko of 1seal
(1seal.org), Vitaly Simonovich for their assistance.
xar
We would like to acknowledge Anurag Bohra of Microsoft, Cem Onat
Karagun, Feng Xue and XGPT of ThreatBook, Kubilay Berk ALKAN, s3zer0 for
their assistance.
XprotectFramework
We would like to acknowledge Ferdous Saljooki (@malwarezoo) of Jamf for
their assistance.
macOS Tahoe 26.6 may be obtained from the Mac App Store or Apple's
Software Downloads web site: https://support.apple.com/downloads/
All information is also posted on the Apple Security Releases
web site: https://support.apple.com/100100.
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
