macOS vulnerabilities

1,185 known vulnerabilities in macOS from Apple. 1,173 are rated high or critical, and 78 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  macOS: Improper Access Control

  CVE-2026-65362Sep 14, 2026Apple

  This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges.

• 7.1 High severity

  iOS and iPadOS: Out-of-bounds Read

  CVE-2026-65359Sep 14, 2026Apple

  An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A local user may be able to

• 7.8 High severity

  iOS and iPadOS: Buffer Copy without Checking Size of Input

  CVE-2026-65357Sep 14, 2026Apple

  The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination or write kernel memory.

• 8.2 High severity

  iOS and iPadOS: Improper Privilege Management

  CVE-2026-65354Sep 14, 2026Apple

  A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious app may be able to break out of its sandbox.

• 7.8 High severity

  iOS and iPadOS: Out-of-bounds Write

  CVE-2026-65344Sep 14, 2026Apple

  An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27. Processing a maliciously crafted

• 7.5 High severity

  macOS: Missing Authorization

  CVE-2026-65342Sep 14, 2026Apple

  A permissions issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data.

• 7.8 High severity

  macOS: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-64790Sep 14, 2026Apple

  A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain elevated privileges.

• 7.3 High severity

  iOS and iPadOS: Out-of-bounds Write

  CVE-2026-64752Sep 14, 2026Apple

  A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Processing a maliciously crafted image may lead to arbitrary code execution.

• 7.1 High severity

  iOS and iPadOS: Out-of-bounds Read

  CVE-2026-64736Sep 14, 2026Apple

  An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination

• 7.8 High severity

  macOS: Improper Access Control

  CVE-2026-64712Sep 14, 2026Apple

  This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges.

• 7.8 High severity

  macOS: Improper Handling of Insufficient Permissions or Privileges

  CVE-2026-64701Sep 14, 2026Apple

  A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. A malicious app may be able to gain root privileges.

• 8.8 High severity

  macOS: Out-of-bounds Write

  CVE-2026-43815Sep 14, 2026Apple

  A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. Connecting to a malicious afpfs server may lead to kernel memory corruption.

• 9.1 Critical severity

  macOS: Out-of-bounds Write

  CVE-2026-43790Sep 14, 2026Apple

  The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.

• 7.5 High severity

  macOS: Missing Authorization

  CVE-2026-43789Sep 14, 2026Apple

  An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access user-sensitive data.

• 7.8 High severity

  macOS: Improper Handling of Insufficient Permissions or Privileges

  CVE-2026-43786Sep 14, 2026Apple

  This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges.

• 7.8 High severity

  iOS and iPadOS: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-43702Sep 14, 2026Apple

  The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, iOS 26.7 and iPadOS 26.7, macOS Sequoia 15.8, macOS Tahoe 26.6, macOS Tahoe 26.7, tvOS 26.6, watchOS 26.6. Processing a maliciously crafted video file may l

• 7.1 High severity

  macOS: Out-of-bounds Read

  CVE-2026-43697Sep 14, 2026Apple

  An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Processing a maliciously crafted 3D file may lead to an out-of-bounds read.

• 8.8 High severity

  A validation issue was addressed with improved input sanitization.

  CVE-2026-43692Sep 14, 2026Apple

  A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A remote user may cause an unexpected app termination or arbitrary code execution.

• 7.8 High severity

  macOS: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-43691Sep 14, 2026Apple

  A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges.

• 7.8 High severity

  iOS and iPadOS: Missing Authorization

  CVE-2026-43689Sep 14, 2026Apple

  A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. A malicious app may be able to gain root privileges.

• 7.8 High severity

  iOS and iPadOS: Improper Restriction of Rendered UI Layers or Frames

  CVE-2026-43688Sep 14, 2026Apple

  A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. Processing a maliciously crafted file may lead to unexpected app termination.

• 8.8 High severity

  iOS and iPadOS: Use After Free

  CVE-2026-43686Sep 14, 2026Apple

  A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Connecting to a malicious

• 7.8 High severity

  iOS and iPadOS: Use After Free

  CVE-2026-43684Sep 14, 2026Apple

  A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, macOS Golden Gate 27, macOS Sequoia 15.8. An app may be able to cause unexpected system termination or corrupt kernel memory.

• 7.1 High severity

  macOS: Out-of-bounds Read

  CVE-2026-43683Sep 14, 2026Apple

  An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected process termination or disclose process memory.

• 7.5 High severity

  iOS and iPadOS: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-28935Sep 14, 2026Apple

  The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination or corrupt kernel me

• 7.1 High severity

  iOS and iPadOS: Improper Authentication

  CVE-2026-20683Sep 14, 2026Apple

  An authentication issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. An app may be able to use the Sign In With Apple authentication flow to

• 8.8 High severity

  Safari: Protection Mechanism Failure

  CVE-2026-43670Aug 25, 2026Apple

  A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5. Processing maliciously crafted web content may bypa

• 8.8 High severity

  iOS and iPadOS: Integer Overflow or Wraparound

  CVE-2026-65346Aug 17, 2026Apple

  An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Processing an image may lead to arbitrary code execution.

• 7.5 High severity

  iOS and iPadOS: Use After Free

  CVE-2026-65343Aug 17, 2026Apple

  A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. A remote attacker may be able to cause unexpected system termination.

• 8.8 High severity

  Safari: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-43794Aug 17, 2026Apple

  A memory corruption issue was addressed with improved memory handling. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web

• 9.8 Critical severity

  Apple macOS Improper Authentication Exploited

  CVE-2026-65400Aug 6, 2026AppleEPSS 18.1%

  An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, macOS Tahoe 26.7. An attacker on the network may be able to authenticate to Screen

• 8.8 High severity

  Safari: Use After Free

  CVE-2026-64783Jul 27, 2026Apple

  A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected Safari crash

• 9.8 Critical severity

  iOS and iPadOS: Improper Initialization

  CVE-2026-64775Jul 27, 2026Apple

  A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpec

• 9.8 Critical severity

  iOS and iPadOS: Integer Overflow or Wraparound

  CVE-2026-64774Jul 27, 2026Apple

  An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may be a

• 9.8 Critical severity

  iOS and iPadOS: Out-of-bounds Write

  CVE-2026-64772Jul 27, 2026Apple

  An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may be able to cause

• 9.8 Critical severity

  iOS and iPadOS: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-64771Jul 27, 2026Apple

  A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may be able to cause unexpected

• 9.8 Critical severity

  iOS and iPadOS: Out-of-bounds Write

  CVE-2026-64770Jul 27, 2026Apple

  An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker

• 9.8 Critical severity

  iOS and iPadOS: Out-of-bounds Write

  CVE-2026-64769Jul 27, 2026Apple

  An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker

• 8.1 High severity

  iOS and iPadOS: Out-of-bounds Read

  CVE-2026-64768Jul 27, 2026Apple

  An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker

• 9.8 Critical severity

  macOS: Buffer Copy without Checking Size of Input

  CVE-2026-64767Jul 27, 2026Apple

  A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sequoia 15.8.2, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A remote attacker may be able to cause unexpected system termination or corrupt kernel memo