Raw JSON
{
"containers": {
"cna": {
"affected": [
{
"product": "Macos Tahoe",
"vendor": "Apple",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-05-11-2026-6 macOS Tahoe 26.5\n\nmacOS Tahoe 26.5 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/127115.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccelerate\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-28991: Seiji Sakurai (@HeapSmasher)\n\nAccounts\nAvailable for: macOS Tahoe\nImpact: An app may be able to bypass certain Privacy preferences\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28988: Asaf Cohen\n\nAPFS\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28959: Dave G.\n\nApp Intents\nAvailable for: macOS Tahoe\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A logic issue was addressed with improved restrictions.\nCVE-2026-28995: Vamshi Paili, Tony Gorez (@tonygo_) for Reverse Society\n\nAppleJPEG\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted image may lead to a\ndenial-of-service\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-1837\n\nAppleJPEG\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted media file may lead to\nunexpected app termination or corrupt process memory\nDescription: A memory corruption issue was addressed with improved input\nvalidation.\nCVE-2026-28956: impost0r (ret2plt)\n\nAudio\nAvailable for: macOS Tahoe\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-39869: David Ige of Beryllium Security\n\nCoreMedia\nAvailable for: macOS Tahoe\nImpact: An app may be able to access private information\nDescription: This issue was addressed through improved state management.\nCVE-2026-28922: Arni Hardarson\n\nCoreServices\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved checks.\nCVE-2026-28936: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\nCoreSymbolication\nAvailable for: macOS Tahoe\nImpact: Parsing a maliciously crafted file may lead to an unexpected app\ntermination\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-28918: Niels Hofmans, Anonymous working with TrendAI Zero Day\nInitiative\n\nCUPS\nAvailable for: macOS Tahoe\nImpact: An app may be able to gain root privileges\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-28915: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\nFileProvider\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with additional validation.\nCVE-2026-43659: Alex Radocea\n\nGPU Drivers\nAvailable for: macOS Tahoe\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28923: Kun Peeks (@SwayZGl1tZyyy)\n\nHFS\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28925: Aswin Kumar Gokula Kannan, Dave G.\n\nImageIO\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: A buffer overflow issue was addressed with improved memory\nhandling.\nCVE-2026-43661: an anonymous researcher\n\nImageIO\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-28977: Suresh Sundaram\n\nImageIO\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-28990: Jiri Ha, Arni Hardarson\n\nInstaller\nAvailable for: macOS Tahoe\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28978: wdszzml and Atuin Automated Vulnerability Discovery\nEngine\n\nIOHIDFamily\nAvailable for: macOS Tahoe\nImpact: An attacker may be able to cause unexpected app termination\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nCVE-2026-28992: Johnny Franks (@zeroxjf)\n\nIOHIDFamily\nAvailable for: macOS Tahoe\nImpact: An app may be able to determine kernel memory layout\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28943: Google Threat Analysis Group\n\nIOKit\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28969: Mihalis Haatainen, Ari Hawking, Ashish Kunwar\n\nIOSurfaceAccelerator\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination or\nread kernel memory\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43655: Somair Ansar and an anonymous researcher\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43654: Vaagn Vardanian, Nathaniel Oh (@calysteon)\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to modify protected parts of the file system\nDescription: A denial of service issue was addressed by removing the\nvulnerable code.\nCVE-2026-28908: beist\n\nKernel\nAvailable for: macOS Tahoe\nImpact: A maliciously crafted disk image may bypass Gatekeeper checks\nDescription: A file quarantine bypass was addressed with additional\nchecks.\nCVE-2026-28954: Yiğit Can YILMAZ (@yilmazcanyigit)\n\nKernel\nAvailable for: macOS Tahoe\nImpact: A local user may be able to cause unexpected system termination\nor read kernel memory\nDescription: A buffer overflow was addressed with improved input\nvalidation.\nCVE-2026-28897: popku1337, Billy Jheng Bing Jhong and Pan Zhenpeng\n(@Peterpan0927) of STAR Labs SG Pte. Ltd., Robert Tran, Aswin kumar\nGokulakannan\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-28952: Calif.io in collaboration with Claude and Anthropic\nResearch\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to gain root privileges\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-28951: Csaba Fitzl (@theevilbit) of Iru\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\ninput validation.\nCVE-2026-28972: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with additional validation.\nCVE-2026-28986: Chris Betz, Tristan Madani (@TristanInSec) from Talence\nSecurity, Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to leak sensitive kernel state\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28987: Dhiyanesh Selvaraj (@redroot97)\n\nLaunchServices\nAvailable for: macOS Tahoe\nImpact: A remote attacker may be able to cause a denial of service\nDescription: A type confusion issue was addressed with improved checks.\nCVE-2026-28983: Ruslan Dautov\n\nMail Drafts\nAvailable for: macOS Tahoe\nImpact: Replying to an email could display remote images in Mail in\nLockdown Mode\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-28929: Yiğit Can YILMAZ (@yilmazcanyigit)\n\nmDNSResponder\nAvailable for: macOS Tahoe\nImpact: An attacker on the local network may be able to cause a\ndenial-of-service\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43653: Atul R V\n\nmDNSResponder\nAvailable for: macOS Tahoe\nImpact: An attacker on the local network may be able to cause a\ndenial-of-service\nDescription: A null pointer dereference was addressed with improved\ninput validation.\nCVE-2026-28985: Omar Cerrito\n\nmDNSResponder\nAvailable for: macOS Tahoe\nImpact: A remote attacker may be able to cause unexpected system\ntermination or corrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43668: Anton Pakhunov, Ricardo Prado\n\nmDNSResponder\nAvailable for: macOS Tahoe\nImpact: An attacker on the local network may be able to cause a\ndenial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43666: Ian van der Wurff (ian.nl)\n\nModel I/O\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted file may lead to a\ndenial-of-service or potentially disclose memory contents\nDescription: The issue was addressed with improved checks.\nCVE-2026-28941: Michael DePlante (@izobashi) of TrendAI Zero Day\nInitiative\n\nModel I/O\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-28940: Michael DePlante (@izobashi) of TrendAI Zero Day\nInitiative\n\nNetwork Extensions\nAvailable for: macOS Tahoe\nImpact: An attacker with physical access to a locked device may be able\nto view sensitive user information\nDescription: This issue was addressed with improved checks.\nCVE-2026-28961: Dan Raviv\n\nNetworking\nAvailable for: macOS Tahoe\nImpact: An attacker may be able to track users through their IP address\nDescription: This issue was addressed through improved state management.\nCVE-2026-28906: Ilya Sc. Jowell A.\n\nQuick Look\nAvailable for: macOS Tahoe\nImpact: Parsing a maliciously crafted file may lead to an unexpected app\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\ninput validation.\nCVE-2026-43656: Peter Malone\n\nSandbox\nAvailable for: macOS Tahoe\nImpact: An app may be able to access protected user data\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-43652: Asaf Cohen\n\nSceneKit\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-39870: Peter Malone\n\nSceneKit\nAvailable for: macOS Tahoe\nImpact: A remote attacker may be able to cause unexpected app\ntermination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28846: Peter Malone\n\nShortcuts\nAvailable for: macOS Tahoe\nImpact: An app may be able to access user-sensitive data\nDescription: This issue was addressed by adding an additional prompt for\nuser consent.\nCVE-2026-28993: Doron Assness\n\nSMB\nAvailable for: macOS Tahoe\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28848: Peter Malone, Dave G. and Alex Radocea of Supernetworks\n\nSpotlight\nAvailable for: macOS Tahoe\nImpact: An app may be able to access protected user data\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28930: Pan ZhenPeng (@P"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:28:19Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/11"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/May/11"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/downloads/"
},
{
"url": "https://support.apple.com/en-us/127115"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/May/11"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-05-11-2026-6 macOS Tahoe 26.5",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-1837",
"type": "related"
},
{
"destId": "CVE-2026-28819",
"type": "related"
},
{
"destId": "CVE-2026-28846",
"type": "related"
},
{
"destId": "CVE-2026-28847",
"type": "related"
},
{
"destId": "CVE-2026-28848",
"type": "related"
},
{
"destId": "CVE-2026-28883",
"type": "related"
},
{
"destId": "CVE-2026-28897",
"type": "related"
},
{
"destId": "CVE-2026-28901",
"type": "related"
},
{
"destId": "CVE-2026-28902",
"type": "related"
},
{
"destId": "CVE-2026-28903",
"type": "related"
},
{
"destId": "CVE-2026-28904",
"type": "related"
},
{
"destId": "CVE-2026-28905",
"type": "related"
},
{
"destId": "CVE-2026-28906",
"type": "related"
},
{
"destId": "CVE-2026-28907",
"type": "related"
},
{
"destId": "CVE-2026-28908",
"type": "related"
},
{
"destId": "CVE-2026-28913",
"type": "related"
},
{
"destId": "CVE-2026-28914",
"type": "related"
},
{
"destId": "CVE-2026-28915",
"type": "related"
},
{
"destId": "CVE-2026-28917",
"type": "related"
},
{
"destId": "CVE-2026-28918",
"type": "related"
},
{
"destId": "CVE-2026-28919",
"type": "related"
},
{
"destId": "CVE-2026-28920",
"type": "related"
},
{
"destId": "CVE-2026-28922",
"type": "related"
},
{
"destId": "CVE-2026-28923",
"type": "related"
},
{
"destId": "CVE-2026-28924",
"type": "related"
},
{
"destId": "CVE-2026-28925",
"type": "related"
},
{
"destId": "CVE-2026-28929",
"type": "related"
},
{
"destId": "CVE-2026-28930",
"type": "related"
},
{
"destId": "CVE-2026-28936",
"type": "related"
},
{
"destId": "CVE-2026-28940",
"type": "related"
},
{
"destId": "CVE-2026-28941",
"type": "related"
},
{
"destId": "CVE-2026-28942",
"type": "related"
},
{
"destId": "CVE-2026-28943",
"type": "related"
},
{
"destId": "CVE-2026-28944",
"type": "related"
},
{
"destId": "CVE-2026-28946",
"type": "related"
},
{
"destId": "CVE-2026-28947",
"type": "related"
},
{
"destId": "CVE-2026-28951",
"type": "related"
},
{
"destId": "CVE-2026-28952",
"type": "related"
},
{
"destId": "CVE-2026-28953",
"type": "related"
},
{
"destId": "CVE-2026-28954",
"type": "related"
},
{
"destId": "CVE-2026-28955",
"type": "related"
},
{
"destId": "CVE-2026-28956",
"type": "related"
},
{
"destId": "CVE-2026-28958",
"type": "related"
},
{
"destId": "CVE-2026-28959",
"type": "related"
},
{
"destId": "CVE-2026-28961",
"type": "related"
},
{
"destId": "CVE-2026-28962",
"type": "related"
},
{
"destId": "CVE-2026-28969",
"type": "related"
},
{
"destId": "CVE-2026-28971",
"type": "related"
},
{
"destId": "CVE-2026-28972",
"type": "related"
},
{
"destId": "CVE-2026-28974",
"type": "related"
},
{
"destId": "CVE-2026-28976",
"type": "related"
},
{
"destId": "CVE-2026-28977",
"type": "related"
},
{
"destId": "CVE-2026-28978",
"type": "related"
},
{
"destId": "CVE-2026-28983",
"type": "related"
},
{
"destId": "CVE-2026-28985",
"type": "related"
},
{
"destId": "CVE-2026-28986",
"type": "related"
},
{
"destId": "CVE-2026-28987",
"type": "related"
},
{
"destId": "CVE-2026-28988",
"type": "related"
},
{
"destId": "CVE-2026-28990",
"type": "related"
},
{
"destId": "CVE-2026-28991",
"type": "related"
},
{
"destId": "CVE-2026-28992",
"type": "related"
},
{
"destId": "CVE-2026-28993",
"type": "related"
},
{
"destId": "CVE-2026-28994",
"type": "related"
},
{
"destId": "CVE-2026-28995",
"type": "related"
},
{
"destId": "CVE-2026-28996",
"type": "related"
},
{
"destId": "CVE-2026-39869",
"type": "related"
},
{
"destId": "CVE-2026-39870",
"type": "related"
},
{
"destId": "CVE-2026-39871",
"type": "related"
},
{
"destId": "CVE-2026-43652",
"type": "related"
},
{
"destId": "CVE-2026-43653",
"type": "related"
},
{
"destId": "CVE-2026-43654",
"type": "related"
},
{
"destId": "CVE-2026-43655",
"type": "related"
},
{
"destId": "CVE-2026-43656",
"type": "related"
},
{
"destId": "CVE-2026-43658",
"type": "related"
},
{
"destId": "CVE-2026-43659",
"type": "related"
},
{
"destId": "CVE-2026-43660",
"type": "related"
},
{
"destId": "CVE-2026-43661",
"type": "related"
},
{
"destId": "CVE-2026-43666",
"type": "related"
},
{
"destId": "CVE-2026-43668",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0333",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/11",
"automated": true,
"contentSha256": "a2ec62f84ae6b32c6685ce18d20de1cbe8d4004a18fd7d143ac89e7ce011eb4b",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/May/11",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-05-11T22:32:57Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-11T07:55:55Z",
"dateUpdated": "2026-09-11T11:28:19Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0333"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}