Raw JSON
{
"containers": {
"cna": {
"affected": [
{
"product": "Macos Tahoe",
"vendor": "Apple",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-08-17-2026-3 macOS Tahoe 26.6.2\n\nmacOS Tahoe 26.6.2 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/148281.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAudio\nAvailable for: macOS Tahoe\nImpact: An app may be able to leak sensitive user information\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-65339: Meta Red Team X - Nik Tsytsarkin\n\nImageIO\nAvailable for: macOS Tahoe\nImpact: Processing an image may lead to a denial-of-service\nDescription: The issue was addressed with improved checks.\nCVE-2026-65347: Geonha Lee (@leegn4a)\n\nImageIO\nAvailable for: macOS Tahoe\nImpact: Processing an image may lead to arbitrary code execution\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-65346: Meta Red Team X - Nik Tsytsarkin\n\nIOGPUFamily\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64788: f00l (@PPPF00L) and 3ndy1(@_3ndy1) and Minghao\nLin@Y1nkoc and 云散花折, Arjanit Isufi\n\nKernel\nAvailable for: macOS Tahoe\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-65343: Drinor Selmanaj (Sentry), Surya Narayan Kushwaha\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination or\nread kernel memory\nDescription: An out-of-bounds read was addressed with improved input\nvalidation.\nCVE-2026-65349: an anonymous researcher\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-65330: Bhaswanth Chigurupati, Billy Jheng Bing Jhong and Pan\nZhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nWebKit Bugzilla: 317632\nCVE-2026-64784: Janggoon Lee of Out of Bounds, OpenAI Codex Security -\nAmy Burnett\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 313452\nCVE-2026-43795: wwwlk\nWebKit Bugzilla: 318348\nCVE-2026-65338: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 318405\nCVE-2026-65341: Henock Habte\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nWebKit Bugzilla: 321480\nCVE-2026-64782: Seonwook Kim, Shubham Chaskar, lattice, Josef Korbel\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 321484\nCVE-2026-64781: Thomas Guillem\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: This issue was addressed through improved state management.\nWebKit Bugzilla: 321517\nCVE-2026-65351: Niels Hofmans\nWebKit Bugzilla: 316996\nCVE-2026-65340: Claudio Bozzato and Francesco Benvenuto of Cisco Talos,\nJosef Korbel (Citadelo)\nWebKit Bugzilla: 317142\nCVE-2026-65337: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317349\nCVE-2026-65336: Josef Korbel\nWebKit Bugzilla: 316723\nCVE-2026-65335: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317603\nCVE-2026-65333: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317450\nCVE-2026-65332: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317611\nCVE-2026-65331: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 316347\nCVE-2026-64715: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved checks.\nWebKit Bugzilla: 316918\nCVE-2026-64780: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption issue was addressed with improved state\nmanagement.\nWebKit Bugzilla: 316791\nCVE-2026-65334: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nWebKit Bugzilla: 317317\nCVE-2026-43794: Dung Do (@_piers2) of Calif.io\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process termination\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313703\nCVE-2026-64787: 杉山 壮太, Shubham Chaskar\n\nWebKit History\nAvailable for: macOS Tahoe\nImpact: Visiting a maliciously crafted website may leak sensitive data\nDescription: The issue was addressed with improved checks.\nWebKit Bugzilla: 315528\nCVE-2026-64778: Mohit Negi\n\nWebKit Storage\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nWebKit Bugzilla: 321485\nCVE-2026-64779: Shubham Chaskar, Tommy DeVoss from Braze Security Team\n(@thedawgyg)\n\nAdditional recognition\n\nCompression\nWe would like to acknowledge Tommy DeVoss from Braze Security Team\n(@thedawgyg) for their assistance.\n\nlibcryptex\nWe would like to acknowledge Ashish Kunwar for their assistance.\n\nWebKit\nWe would like to acknowledge Henock Habte for their assistance.\n\nmacOS Tahoe 26.6.2 may be obtained from the Mac App Store or Apple's\nSoftware Downloads web site: https://support.apple.com/downloads/\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple's Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmqDg+oACgkQ4Ifiq8DH\n7PWG8RAAj5K07fb3nf4q9cM3iv9IMLsix0MY6YmhhmzMyuNt1RCOrYRYlKbupgI4\n0ANdkreGcpUwdDLUmJGG4NZY172uOolWCa46PvI5XD6Obikp4REYndtn7ohOYRx1\n1haRwYVAWi6oe5PVQB6WUUA7jI2cIEba3ZIoK0eSjVtuurZEslq6nBIImyFuDesU\n/u7LaSnfkazIALDREjhUF/6Ii1xm3qZr5P4h6k9uK4+wcMoBOQHUXdJymT/jNa+d\n8A384E2Mc/y93ya6DQDCoZzshhiWzA9B0jd+pEefKrSZBpVhzVniAlXAS1nqQN+n\nbZjSjT6NTAQ5QsttEu5Ki8VXy1MnknUHE0WgG94qQCqHndIo1XEScBmdk8VPffht\noE5v8zQ5rJkLFu4zriTtWx4JmgI6TukwgvQOLA8AtfW19VJbamqDKkQHMrtF6hNG\nDtgFA9+ooFwZEwlyieW46HrvQqZ596IVDgdaTOoVJa12osQpSfGp46qYtej4waWU\nKqr3LSva5E/kw9jpLrIua0Tfjd0yluqXS7IziACFo1T836WFyl09eg+rhCutXHB/\nQgcAuDG+hVl59tclNWBVQDHoLsENfpK9ujExnS1h8d3fLhAScxRM+2j/nNByNsat\nUfzl4d8RejGkpvrjp/+IVL5iyDg0XuDLZ45X3aa6jbN+HbwropA=\n=n5Vc\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:50:23Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/44"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/44"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/148281"
},
{
"url": "https://support.apple.com/downloads/"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/44"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-08-17-2026-3 macOS Tahoe 26.6.2",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-43794",
"type": "related"
},
{
"destId": "CVE-2026-43795",
"type": "related"
},
{
"destId": "CVE-2026-64715",
"type": "related"
},
{
"destId": "CVE-2026-64778",
"type": "related"
},
{
"destId": "CVE-2026-64779",
"type": "related"
},
{
"destId": "CVE-2026-64780",
"type": "related"
},
{
"destId": "CVE-2026-64781",
"type": "related"
},
{
"destId": "CVE-2026-64782",
"type": "related"
},
{
"destId": "CVE-2026-64784",
"type": "related"
},
{
"destId": "CVE-2026-64787",
"type": "related"
},
{
"destId": "CVE-2026-64788",
"type": "related"
},
{
"destId": "CVE-2026-65330",
"type": "related"
},
{
"destId": "CVE-2026-65331",
"type": "related"
},
{
"destId": "CVE-2026-65332",
"type": "related"
},
{
"destId": "CVE-2026-65333",
"type": "related"
},
{
"destId": "CVE-2026-65334",
"type": "related"
},
{
"destId": "CVE-2026-65335",
"type": "related"
},
{
"destId": "CVE-2026-65336",
"type": "related"
},
{
"destId": "CVE-2026-65337",
"type": "related"
},
{
"destId": "CVE-2026-65338",
"type": "related"
},
{
"destId": "CVE-2026-65339",
"type": "related"
},
{
"destId": "CVE-2026-65340",
"type": "related"
},
{
"destId": "CVE-2026-65341",
"type": "related"
},
{
"destId": "CVE-2026-65343",
"type": "related"
},
{
"destId": "CVE-2026-65346",
"type": "related"
},
{
"destId": "CVE-2026-65347",
"type": "related"
},
{
"destId": "CVE-2026-65349",
"type": "related"
},
{
"destId": "CVE-2026-65351",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0286",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/44",
"automated": true,
"contentSha256": "e3a4df71fa6333a412bb8c1d65c5707dbaebe35105df29945390db6bcf38320d",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/44",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-17T22:02:19Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T11:40:45Z",
"dateUpdated": "2026-09-11T11:50:23Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0286"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}