Raw JSON
{
"containers": {
"cna": {
"affected": [
{
"product": "Macos Sonoma",
"vendor": "Apple",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-02-11-2026-5 macOS Sonoma 14.8.4\n\nmacOS Sonoma 14.8.4 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/126350.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAppleMobileFileIntegrity\nAvailable for: macOS Sonoma\nImpact: An app may be able to access sensitive user data\nDescription: An injection issue was addressed with improved validation.\nCVE-2026-20624: Mickey Jin (@patch1t)\n\nAppleMobileFileIntegrity\nAvailable for: macOS Sonoma\nImpact: An app may be able to access sensitive user data\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-20625: Mickey Jin (@patch1t), Ryan Dowd (@_rdowd)\n\nCFNetwork\nAvailable for: macOS Sonoma\nImpact: A remote user may be able to write arbitrary files\nDescription: A path handling issue was addressed with improved logic.\nCVE-2026-20660: Amy (amys.website)\n\nCompression\nAvailable for: macOS Sonoma\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2025-43403: Mickey Jin (@patch1t)\n\nCoreAudio\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted media file may lead to\nunexpected app termination or corrupt process memory\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-20611: Anonymous working with Trend Micro Zero Day Initiative\n\nCoreMedia\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted file may lead to a denial-of-\nservice or potentially disclose memory contents\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-20609: Yiğit Can YILMAZ (@yilmazcanyigit)\n\nCoreServices\nAvailable for: macOS Sonoma\nImpact: An app may be able to gain root privileges\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-20617: Gergely Kalman (@gergely_kalman), Csaba Fitzl\n(@theevilbit) of Iru\n\nCoreServices\nAvailable for: macOS Sonoma\nImpact: An app may be able to gain root privileges\nDescription: A path handling issue was addressed with improved\nvalidation.\nCVE-2026-20615: Csaba Fitzl (@theevilbit) of Iru and Gergely Kalman\n(@gergely_kalman)\n\nCoreServices\nAvailable for: macOS Sonoma\nImpact: An app may be able to access sensitive user data\nDescription: A logic issue was addressed with improved validation.\nCVE-2025-46283: an anonymous researcher\n\nCoreServices\nAvailable for: macOS Sonoma\nImpact: An app may be able to access sensitive user data\nDescription: An issue existed in the handling of environment variables.\nThis issue was addressed with improved validation.\nCVE-2026-20627: an anonymous researcher\n\nFile Bookmark\nAvailable for: macOS Sonoma\nImpact: An app may be able to access user-sensitive data\nDescription: A path handling issue was addressed with improved logic.\nCVE-2025-43417: Ron Elemans\n\nGPU Drivers\nAvailable for: macOS Sonoma\nImpact: An attacker may be able to cause unexpected system termination\nor read kernel memory\nDescription: An out-of-bounds read issue was addressed with improved\ninput validation.\nCVE-2026-20620: Murray Mike\n\nImageIO\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted media file may lead to\nunexpected app termination or corrupt process memory\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2025-43338: 이동하 (Lee Dong Ha) of SSA Lab\n\nImageIO\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted image may result in disclosure\nof process memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-20634: George Karchemsky (@gkarchemsky) working with Trend\nMicro Zero Day Initiative\n\nImageIO\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted image may lead to disclosure of\nuser information\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-20675: George Karchemsky (@gkarchemsky) working with Trend\nMicro Zero Day Initiative\n\nKernel\nAvailable for: macOS Sonoma\nImpact: An attacker in a privileged network position may be able to\nintercept network traffic\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-20671: Xin'an Zhou, Juefei Pu, Zhutian Liu, Zhiyun Qian,\nZhaowei Tan, Srikanth V. Krishnamurthy, Mathy Vanhoef\n\nlibexpat\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted file may lead to a denial-of-\nservice\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2025-59375\n\nlibnetcore\nAvailable for: macOS Sonoma\nImpact: An attacker in a privileged network position may be able to\nintercept network traffic\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-20671: Xin'an Zhou, Juefei Pu, Zhutian Liu, Zhiyun Qian,\nZhaowei Tan, Srikanth V. Krishnamurthy, Mathy Vanhoef\n\nlibxpc\nAvailable for: macOS Sonoma\nImpact: An app may be able to break out of its sandbox\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-20667: an anonymous researcher\n\nMail\nAvailable for: macOS Sonoma\nImpact: Turning off \"Load remote content in messages” may not apply to\nall mail previews\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-20673: an anonymous researcher\n\nMessages\nAvailable for: macOS Sonoma\nImpact: A shortcut may be able to bypass sandbox restrictions\nDescription: A race condition was addressed with improved handling of\nsymbolic links.\nCVE-2026-20677: Ron Masas of BreakPoint.SH\n\nModel I/O\nAvailable for: macOS Sonoma\nImpact: Processing a maliciously crafted USD file may lead to unexpected\napp termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-20616: Michael DePlante (@izobashi) of Trend Micro Zero Day\nInitiative\n\nMulti-Touch\nAvailable for: macOS Sonoma\nImpact: A malicious HID device may cause an unexpected process crash\nDescription: The issue was addressed with improved bounds checks.\nCVE-2025-43533: Google Threat Analysis Group\nCVE-2025-46300: Google Threat Analysis Group\nCVE-2025-46301: Google Threat Analysis Group\nCVE-2025-46302: Google Threat Analysis Group\nCVE-2025-46303: Google Threat Analysis Group\nCVE-2025-46304: Google Threat Analysis Group\nCVE-2025-46305: Google Threat Analysis Group\n\nPackageKit\nAvailable for: macOS Sonoma\nImpact: An attacker with root privileges may be able to delete protected\nsystem files\nDescription: This issue was addressed through improved state management.\nCVE-2025-46310: Mickey Jin (@patch1t)\n\nRemote Management\nAvailable for: macOS Sonoma\nImpact: An app may be able to gain root privileges\nDescription: A path handling issue was addressed with improved\nvalidation.\nCVE-2026-20614: Gergely Kalman (@gergely_kalman)\n\nSandbox\nAvailable for: macOS Sonoma\nImpact: An app may be able to break out of its sandbox\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-20628: Noah Gregory (wts.dev)\n\nSecurity\nAvailable for: macOS Sonoma\nImpact: A remote attacker may be able to cause a denial-of-service\nDescription: A logic issue was addressed with improved checks.\nCVE-2025-46290: Bing Shi, Wenchao Li and Xiaolong Bai of Alibaba Group,\nand Luyi Xing of Indiana University Bloomington\n\nShortcuts\nAvailable for: macOS Sonoma\nImpact: An app may be able to access sensitive user data\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-20653: Enis Maholli (enismaholli.com)\n\nSpotlight\nAvailable for: macOS Sonoma\nImpact: A sandboxed app may be able to access sensitive user data\nDescription: The issue was addressed with additional restrictions on the\nobservability of app states.\nCVE-2026-20680: an anonymous researcher\n\nSpotlight\nAvailable for: macOS Sonoma\nImpact: An app may be able to access sensitive user data\nDescription: A privacy issue was addressed with improved checks.\nCVE-2026-20612: Mickey Jin (@patch1t)\n\nStoreKit\nAvailable for: macOS Sonoma\nImpact: An app may be able to identify what other apps a user has\ninstalled\nDescription: A privacy issue was addressed with improved checks.\nCVE-2026-20641: Gongyu Ma (@Mezone0)\n\nUIKit\nAvailable for: macOS Sonoma\nImpact: An app may be able to bypass certain Privacy preferences\nDescription: This issue was addressed by removing the vulnerable code.\nCVE-2026-20606: LeminLimez\n\nVoice Control\nAvailable for: macOS Sonoma\nImpact: An app may be able to crash a system process\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-20605: @cloudlldb of @pixiepointsec\n\nWi-Fi\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-20621: Wang Yu of Cyberserval\n\nWindowServer\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause unexpected system termination or\ncorrupt process memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2025-43402: @cloudlldb of @pixiepointsec\n\nWindowServer\nAvailable for: macOS Sonoma\nImpact: An app may be able to cause a denial-of-service\nDescription: The issue was addressed with improved handling of caches.\nCVE-2026-20602: @cloudlldb of @pixiepointsec\n\nAdditional recognition\n\nCoreServices\nWe would like to acknowledge Golden Helm Securities, YingQi Shi\n(@Mas0nShi) of DBAppSecurity's WeBin lab, Csaba Fitzl (@theevilbit) of\nIru and Gergely Kalman (@gergely_kalman) for their assistance.\n\nKernel\nWe would like to acknowledge Xinru Chi of Pangu Lab for their\nassistance.\n\nlibpthread\nWe would like to acknowledge Fabiano Anemone for their assistance.\n\nWindowServer\nWe would like to acknowledge @cloudlldb of @pixiepointsec for their\nassistance.\n\nmacOS Sonoma 14.8.4 may be obtained from the Mac App Store or\nApple's Software Downloads web site:\nhttps://support.apple.com/downloads/\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple's Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmmNDuMACgkQ4Ifiq8DH\n7PUmMxAAq8it0sd0gK1w9S2xoe38FkzhkMJuHadqwCu330uZde5QELWM5FyMxzjD\nXQIScVmW3bUoliku+JMOlTzbt1E8fOAId1BDtanLYBlCCvLf42s8Atl3yeqSn5nb\nXl2WkYp9krNHTLT2okP3e5wKV26WKaEKyzNDjf/3zgPcPO23O/RXtALB69eKUH1i\ncjFk5yBRQQLG6eNq89nkJS3xheGhnRhotI5RVg+xWDXIEMDz+ohiu9BqGZtBPelZ\n28fUO1ifND/3Vx8GmMJYKQtJYCrsEHup4VlPEGtw36tj9wUsFtBA3vf9gtYLqrCR\nHlVjpatTuoXYmhfcVMrtKEKf+VYzP163PM0kUmpJw8cOT+RAdPUaKBsozRIZSjDJ\nrIjxuea87IdvCF7v7NRi6fjLh9kfuYKZnoPTlZHytbenYFXqpyccvIIfgv43AJTG\n9phCTDSx0PFSIVwHbN5EpDEHhNw77k+dFlk47GcUUDPdakGS+QR9aZ9L1sQri8E/\nB14npkcwBq4b7gg57SK6+XvMiSXNHKTIMLsG7twTt6/7TKcS6NWgR3pbPxtjLOOB\nEJVipxm5iMzW9iHXsyhAayE/suUbJp8HYDCx3XoROPdq+qs9uaMS9qTxyupJ5U8H\nlftrbN0qKdNA0lpRx6F9Jo6sAZP1d940aSD/LnDLMF9vhOcxR6Q=\n=HT2I\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:11:46Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/25"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Feb/25"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/126350"
},
{
"url": "https://support.apple.com/downloads/"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Feb/25"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-02-11-2026-5 macOS Sonoma 14.8.4",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2025-43338",
"type": "related"
},
{
"destId": "CVE-2025-43402",
"type": "related"
},
{
"destId": "CVE-2025-43403",
"type": "related"
},
{
"destId": "CVE-2025-43417",
"type": "related"
},
{
"destId": "CVE-2025-43533",
"type": "related"
},
{
"destId": "CVE-2025-46283",
"type": "related"
},
{
"destId": "CVE-2025-46290",
"type": "related"
},
{
"destId": "CVE-2025-46300",
"type": "related"
},
{
"destId": "CVE-2025-46301",
"type": "related"
},
{
"destId": "CVE-2025-46302",
"type": "related"
},
{
"destId": "CVE-2025-46303",
"type": "related"
},
{
"destId": "CVE-2025-46304",
"type": "related"
},
{
"destId": "CVE-2025-46305",
"type": "related"
},
{
"destId": "CVE-2025-46310",
"type": "related"
},
{
"destId": "CVE-2025-59375",
"type": "related"
},
{
"destId": "CVE-2026-20602",
"type": "related"
},
{
"destId": "CVE-2026-20605",
"type": "related"
},
{
"destId": "CVE-2026-20606",
"type": "related"
},
{
"destId": "CVE-2026-20609",
"type": "related"
},
{
"destId": "CVE-2026-20611",
"type": "related"
},
{
"destId": "CVE-2026-20612",
"type": "related"
},
{
"destId": "CVE-2026-20614",
"type": "related"
},
{
"destId": "CVE-2026-20615",
"type": "related"
},
{
"destId": "CVE-2026-20616",
"type": "related"
},
{
"destId": "CVE-2026-20617",
"type": "related"
},
{
"destId": "CVE-2026-20620",
"type": "related"
},
{
"destId": "CVE-2026-20621",
"type": "related"
},
{
"destId": "CVE-2026-20624",
"type": "related"
},
{
"destId": "CVE-2026-20625",
"type": "related"
},
{
"destId": "CVE-2026-20627",
"type": "related"
},
{
"destId": "CVE-2026-20628",
"type": "related"
},
{
"destId": "CVE-2026-20634",
"type": "related"
},
{
"destId": "CVE-2026-20641",
"type": "related"
},
{
"destId": "CVE-2026-20653",
"type": "related"
},
{
"destId": "CVE-2026-20660",
"type": "related"
},
{
"destId": "CVE-2026-20667",
"type": "related"
},
{
"destId": "CVE-2026-20671",
"type": "related"
},
{
"destId": "CVE-2026-20673",
"type": "related"
},
{
"destId": "CVE-2026-20675",
"type": "related"
},
{
"destId": "CVE-2026-20677",
"type": "related"
},
{
"destId": "CVE-2026-20680",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0220",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/25",
"automated": true,
"contentSha256": "79e2a5781a7939fdaa4084081e401a3637424868d9ae5bd55a8ae15638907e8b",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/25",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-02-12T00:04:38Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T07:57:43Z",
"dateUpdated": "2026-09-11T11:11:46Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0220"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}