VULNARCHIVE

GCVE-1988-2026-0395

APPLE-SA-09-14-2026-5 macOS Sequoia 15.8

Description (en)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

APPLE-SA-09-14-2026-5 macOS Sequoia 15.8

macOS Sequoia 15.8 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149043.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Accelerate Framework
Available for: macOS Sequoia
Impact: Processing a maliciously crafted image may lead to unexpected
process termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-86882: Peter Malone

Accessibility
Available for: macOS Sequoia
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved data protection.
CVE-2026-43664: Stuart Wallace, Rosyna Keller of Totally Not Malicious
Software, Jian Lee (@speedyfriend433), Ilya Andr (andrd3v), Gongyu Ma
(@Mezone0), David Strnadel, Daniel Febrero, CJ Vana, Asaf Cohen

APFS
Available for: macOS Sequoia
Impact: An application may be able to access restricted files
Description: A permissions issue was addressed with improved path
validation.
CVE-2026-86910: an anonymous researcher

APFS
Available for: macOS Sequoia
Impact: An app may be able to cause unexpected system termination or
write kernel memory
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84523: Cem Onat Karagun, an anonymous researcher

AppKit
Available for: macOS Sequoia
Impact: An app may be able to access protected user data
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-84587: an anonymous researcher

Apple Account
Available for: macOS Sequoia
Impact: An app may be able to use the Sign In With Apple authentication
flow to access the user's Apple Account
Description: An authentication issue was addressed with improved state
management.
CVE-2026-20683: Lehan Dilusha Jayasingha (Sri Lanka), Jasminder Pal
Singh, Dem0ns (@天府简易信工作室), Abdelhak Kherroubi

Apple Neural Engine
Available for: macOS Sequoia
Impact: An app may be able to cause unexpected system termination
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-65408: tamdao

AppleAVD
Available for: macOS Sequoia
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-65407: Franco Belman at Blackwing Intelligence

AppleDouble
Available for: macOS Sequoia
Impact: Mounting a disk image with maliciously crafted files may lead to
unexpected system termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84519: Richard Zana

AppleMobileFileIntegrity
Available for: macOS Sequoia
Impact: A malicious app may be able to break out of its sandbox
Description: A validation issue existed in the entitlement verification.
This issue was addressed with improved validation of the process
entitlement.
CVE-2026-65381: Mickey Jin (@patch1t)

ATS
Available for: macOS Sequoia
Impact: An app may be able to read files outside of its sandbox
Description: A permissions issue was addressed by removing the
vulnerable code.
CVE-2026-43763: Pavan Nallamothu, Jared Reyes

ATS
Available for: macOS Sequoia
Impact: An app may be able to access user-sensitive data
Description: A logging issue was addressed with improved data redaction.
CVE-2026-84525: D4rthL

ATS
Available for: macOS Sequoia
Impact: An app may be able to access sensitive user data
Description: A permissions issue was addressed with improved validation.
CVE-2026-65342: Mohamad Dawoud / Abodi Dawoud, Ahmed Alwardani

Audio
Available for: macOS Sequoia
Impact: An app may be able to leak sensitive user information
Description: A logic issue was addressed with improved checks.
CVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik
Tsytsarkin

AuthKit
Available for: macOS Sequoia
Impact: A local app may be able to read a persistent account identifier
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-84583: Zhongcheng Li from IES Red Team

autofs
Available for: macOS Sequoia
Impact: An attacker with control of a network directory server may be
able to execute arbitrary code with root privileges
Description: A path traversal issue was addressed with improved path
validation.
CVE-2026-84568: Mr.Gedik (@h4ck2s3c) of Turkish Technology

autofs
Available for: macOS Sequoia
Impact: An app may be able to bypass Gatekeeper checks
Description: A logic issue was addressed with improved checks.
CVE-2026-84570: Mr.Gedik (@h4ck2s3c)

Automator
Available for: macOS Sequoia
Impact: An app may be able to break out of its sandbox
Description: An authorization issue was addressed with improved state
management.
CVE-2026-84535: Sindre Sorhus, Oren Yomtov, Morris Richman
(@morrisinlife), Kun Peeks (@SwayZGl1tZyyy)

AVEVideoEncoder
Available for: macOS Sequoia
Impact: An app may be able to cause unexpected system termination
Description: A type confusion issue was addressed with improved memory
handling.
CVE-2026-84616: Peter Malone

AVEVideoEncoder
Available for: macOS Sequoia
Impact: A sandboxed app may be able to execute arbitrary code with
kernel privileges
Description: A race condition was addressed with improved state
management.
CVE-2026-84607: Ruslan Dautov

BackgroundAssets
Available for: macOS Sequoia
Impact: An app may be able to access sensitive user data
Description: A logic issue was addressed with improved validation.
CVE-2026-65406: Ye Zhang (@VAR10CK) of Baidu Security

Bluetooth
Available for: macOS Sequoia
Impact: A remote attacker may be able to cause unexpected app
termination or arbitrary code execution
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-65414

cd9660
Available for: macOS Sequoia
Impact: An app may be able to cause unexpected system termination
Description: The issue was addressed with improved memory handling.
CVE-2026-84567: Sanny Mitra, Sihyun Roh (Compsec, SNU), ngockhanh from
Cystack, 정우 하 (@0xfa11babe), Suresh Sundaram, Surej Sekhar, Kun Peeks
(@SwayZGl1tZyyy), Hari Shanmugam (The Hxr1), Ataberk Yavuzer

copyfile
Available for: macOS Sequoia
Impact: An archive may be able to bypass Gatekeeper
Description: A file quarantine bypass was addressed with additional
checks.
CVE-2026-65399: Rishabh Jain (rjcyber) of cyberplanet, Pasquale Scola,
an anonymous researcher

Core Bluetooth
Available for: macOS Sequoia
Impact: An app may be able to access Bluetooth device information
Description: An authorization issue was addressed with improved state
management.
CVE-2026-86891: Dawuge of Shuffle Team

CoreDrag
Available for: macOS Sequoia
Impact: An app may be able to cause unexpected process termination or
disclose process memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-43683: Nathaniel Oh (@calysteon)

CoreMedia
Available for: macOS Sequoia
Impact: An app may be able to access user-sensitive data
Description: An access issue was addressed with additional sandbox
restrictions.
CVE-2026-43789: 이재영

CoreMedia
Available for: macOS Sequoia
Impact: Processing a maliciously crafted video file may lead to
unexpected app termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-65344: Siyeong kim

CoreMedia
Available for: macOS Sequoia
Impact: A sandboxed process may be able to circumvent sandbox
restrictions
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-86876: Chris Bailey - Short Circuit

CoreMedia Video Toolbox
Available for: macOS Sequoia
Impact: Processing a maliciously crafted video file may lead to
unexpected app termination or corrupt process memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43702: Nathaniel Oh (@calysteon)

CoreML
Available for: macOS Sequoia
Impact: A sandboxed app may be able to access restricted files
Description: A permissions issue was addressed with improved path
validation.
CVE-2026-84624: AL Najafi, tamdao

CoreMotion
Available for: macOS Sequoia
Impact: An app may be able to access motion data from headphones without
user consent
Description: An authorization issue was addressed with improved
validation.
CVE-2026-43737: Stuart Wallace

CoreServices
Available for: macOS Sequoia
Impact: An app may be able to bypass Privacy preferences
Description: A permissions issue was addressed with improved state
management.
CVE-2026-84574: Mickey Jin (@patch1t)

CoreServices
Available for: macOS Sequoia
Impact: A malicious application may be able to access restricted files
Description: A permissions issue was addressed with improved validation.
CVE-2026-84559: Ryan Hughes

CoreServices
Available for: macOS Sequoia
Impact: An app may be able to gain root privileges
Description: This issue was addressed with additional entitlement
checks.
CVE-2026-43786: Kujtim Kryeziu (Sentry)

CoreText
Available for: macOS Sequoia
Impact: Processing web content may lead to a denial-of-service
Description: A null pointer dereference was addressed with improved
input validation.
CVE-2026-65412: Pavan Nallamothu

CoreTypes
Available for: macOS Sequoia
Impact: A malicious app may be able to break out of its sandbox
Description: A validation issue existed in the entitlement verification.
This issue was addressed with improved validation of the process
entitlement.
CVE-2026-65381: Mickey Jin (@patch1t)

CoreUI
Available for: macOS Sequoia
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84575: Mustafa Calap (@ordinal0, dbg.re)

CoreUI
Available for: macOS Sequoia
Impact: Processing a maliciously crafted asset catalog may lead to
unexpected process termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84511: stratan (@5tratan), Rahul Raj

CUPS
Available for: macOS Sequoia
Impact: An app may be able to cause unexpected system termination
Description: A logic issue was addressed with improved checks.
CVE-2026-84563: Yongyue WANG AKA Brian.W of OKX security, Omar Cerrito

CUPS
Available for: macOS Sequoia
Impact: An app may be able to access sensitive user data
Description: An authorization issue was addressed with improved state
management.
CVE-2026-84540: Yongyue WANG AKA Brian.W of OKX security, 章鱼哥@aipy
(aipyaipy.com), instantraaamen (github.com/instantraaamen) Contact:
masa.shiramizu () gmail com

CUPS
Available for: macOS Sequoia
Impact: An attacker in a privileged network position may be able to
cause a denial-of-service
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-84554: Meshaal @ Darkcov, Joseph Shamoon

CUPS
Available for: macOS Sequoia
Impact: A remote user may cause an unexpected app termination or
arbitrary code execution
Description: A validation issue was addressed with improved input
sanitization.
CVE-2026-43692: Aaron Grattafiori - NVIDIA AI Red Team

CUPS
Available for: macOS Sequoia
Impact: An app may be able to gain elevated privileges
Description: A path handling issue was addressed with improved
validation.
CVE-2026-64790: Aaron Grattafiori - NVIDIA AI Red Team

CUPS
Available for: macOS Sequoia
Impact: An app may be able to gain root privileges
Description: A path handling issue was addressed with improved
validation.
CVE-2026-43691: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs

CUPS
Available for: macOS Sequoia
Impact: Processing a maliciously crafted file may result in unexpected
app termination or disclosure of process memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-84516: 章鱼哥@aipy (aipyaipy.com)

CUPS
Available for: macOS Sequoia
Impact: An application 

References

Raw JSON
{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Macos Sequoia",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-09-14-2026-5 macOS Sequoia 15.8\n\nmacOS Sequoia 15.8 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/149043.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccelerate Framework\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted image may lead to unexpected\nprocess termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-86882: Peter Malone\n\nAccessibility\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43664: Stuart Wallace, Rosyna Keller of Totally Not Malicious\nSoftware, Jian Lee (@speedyfriend433), Ilya Andr (andrd3v), Gongyu Ma\n(@Mezone0), David Strnadel, Daniel Febrero, CJ Vana, Asaf Cohen\n\nAPFS\nAvailable for: macOS Sequoia\nImpact: An application may be able to access restricted files\nDescription: A permissions issue was addressed with improved path\nvalidation.\nCVE-2026-86910: an anonymous researcher\n\nAPFS\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84523: Cem Onat Karagun, an anonymous researcher\n\nAppKit\nAvailable for: macOS Sequoia\nImpact: An app may be able to access protected user data\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-84587: an anonymous researcher\n\nApple Account\nAvailable for: macOS Sequoia\nImpact: An app may be able to use the Sign In With Apple authentication\nflow to access the user's Apple Account\nDescription: An authentication issue was addressed with improved state\nmanagement.\nCVE-2026-20683: Lehan Dilusha Jayasingha (Sri Lanka), Jasminder Pal\nSingh, Dem0ns (@天府简易信工作室), Abdelhak Kherroubi\n\nApple Neural Engine\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-65408: tamdao\n\nAppleAVD\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-65407: Franco Belman at Blackwing Intelligence\n\nAppleDouble\nAvailable for: macOS Sequoia\nImpact: Mounting a disk image with maliciously crafted files may lead to\nunexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84519: Richard Zana\n\nAppleMobileFileIntegrity\nAvailable for: macOS Sequoia\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A validation issue existed in the entitlement verification.\nThis issue was addressed with improved validation of the process\nentitlement.\nCVE-2026-65381: Mickey Jin (@patch1t)\n\nATS\nAvailable for: macOS Sequoia\nImpact: An app may be able to read files outside of its sandbox\nDescription: A permissions issue was addressed by removing the\nvulnerable code.\nCVE-2026-43763: Pavan Nallamothu, Jared Reyes\n\nATS\nAvailable for: macOS Sequoia\nImpact: An app may be able to access user-sensitive data\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-84525: D4rthL\n\nATS\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: A permissions issue was addressed with improved validation.\nCVE-2026-65342: Mohamad Dawoud / Abodi Dawoud, Ahmed Alwardani\n\nAudio\nAvailable for: macOS Sequoia\nImpact: An app may be able to leak sensitive user information\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik\nTsytsarkin\n\nAuthKit\nAvailable for: macOS Sequoia\nImpact: A local app may be able to read a persistent account identifier\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-84583: Zhongcheng Li from IES Red Team\n\nautofs\nAvailable for: macOS Sequoia\nImpact: An attacker with control of a network directory server may be\nable to execute arbitrary code with root privileges\nDescription: A path traversal issue was addressed with improved path\nvalidation.\nCVE-2026-84568: Mr.Gedik (@h4ck2s3c) of Turkish Technology\n\nautofs\nAvailable for: macOS Sequoia\nImpact: An app may be able to bypass Gatekeeper checks\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-84570: Mr.Gedik (@h4ck2s3c)\n\nAutomator\nAvailable for: macOS Sequoia\nImpact: An app may be able to break out of its sandbox\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-84535: Sindre Sorhus, Oren Yomtov, Morris Richman\n(@morrisinlife), Kun Peeks (@SwayZGl1tZyyy)\n\nAVEVideoEncoder\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: A type confusion issue was addressed with improved memory\nhandling.\nCVE-2026-84616: Peter Malone\n\nAVEVideoEncoder\nAvailable for: macOS Sequoia\nImpact: A sandboxed app may be able to execute arbitrary code with\nkernel privileges\nDescription: A race condition was addressed with improved state\nmanagement.\nCVE-2026-84607: Ruslan Dautov\n\nBackgroundAssets\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: A logic issue was addressed with improved validation.\nCVE-2026-65406: Ye Zhang (@VAR10CK) of Baidu Security\n\nBluetooth\nAvailable for: macOS Sequoia\nImpact: A remote attacker may be able to cause unexpected app\ntermination or arbitrary code execution\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-65414\n\ncd9660\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-84567: Sanny Mitra, Sihyun Roh (Compsec, SNU), ngockhanh from\nCystack, 정우 하 (@0xfa11babe), Suresh Sundaram, Surej Sekhar, Kun Peeks\n(@SwayZGl1tZyyy), Hari Shanmugam (The Hxr1), Ataberk Yavuzer\n\ncopyfile\nAvailable for: macOS Sequoia\nImpact: An archive may be able to bypass Gatekeeper\nDescription: A file quarantine bypass was addressed with additional\nchecks.\nCVE-2026-65399: Rishabh Jain (rjcyber) of cyberplanet, Pasquale Scola,\nan anonymous researcher\n\nCore Bluetooth\nAvailable for: macOS Sequoia\nImpact: An app may be able to access Bluetooth device information\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-86891: Dawuge of Shuffle Team\n\nCoreDrag\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected process termination or\ndisclose process memory\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43683: Nathaniel Oh (@calysteon)\n\nCoreMedia\nAvailable for: macOS Sequoia\nImpact: An app may be able to access user-sensitive data\nDescription: An access issue was addressed with additional sandbox\nrestrictions.\nCVE-2026-43789: 이재영\n\nCoreMedia\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-65344: Siyeong kim\n\nCoreMedia\nAvailable for: macOS Sequoia\nImpact: A sandboxed process may be able to circumvent sandbox\nrestrictions\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-86876: Chris Bailey - Short Circuit\n\nCoreMedia Video Toolbox\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination or corrupt process memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43702: Nathaniel Oh (@calysteon)\n\nCoreML\nAvailable for: macOS Sequoia\nImpact: A sandboxed app may be able to access restricted files\nDescription: A permissions issue was addressed with improved path\nvalidation.\nCVE-2026-84624: AL Najafi, tamdao\n\nCoreMotion\nAvailable for: macOS Sequoia\nImpact: An app may be able to access motion data from headphones without\nuser consent\nDescription: An authorization issue was addressed with improved\nvalidation.\nCVE-2026-43737: Stuart Wallace\n\nCoreServices\nAvailable for: macOS Sequoia\nImpact: An app may be able to bypass Privacy preferences\nDescription: A permissions issue was addressed with improved state\nmanagement.\nCVE-2026-84574: Mickey Jin (@patch1t)\n\nCoreServices\nAvailable for: macOS Sequoia\nImpact: A malicious application may be able to access restricted files\nDescription: A permissions issue was addressed with improved validation.\nCVE-2026-84559: Ryan Hughes\n\nCoreServices\nAvailable for: macOS Sequoia\nImpact: An app may be able to gain root privileges\nDescription: This issue was addressed with additional entitlement\nchecks.\nCVE-2026-43786: Kujtim Kryeziu (Sentry)\n\nCoreText\nAvailable for: macOS Sequoia\nImpact: Processing web content may lead to a denial-of-service\nDescription: A null pointer dereference was addressed with improved\ninput validation.\nCVE-2026-65412: Pavan Nallamothu\n\nCoreTypes\nAvailable for: macOS Sequoia\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A validation issue existed in the entitlement verification.\nThis issue was addressed with improved validation of the process\nentitlement.\nCVE-2026-65381: Mickey Jin (@patch1t)\n\nCoreUI\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84575: Mustafa Calap (@ordinal0, dbg.re)\n\nCoreUI\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted asset catalog may lead to\nunexpected process termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84511: stratan (@5tratan), Rahul Raj\n\nCUPS\nAvailable for: macOS Sequoia\nImpact: An app may be able to cause unexpected system termination\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-84563: Yongyue WANG AKA Brian.W of OKX security, Omar Cerrito\n\nCUPS\nAvailable for: macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-84540: Yongyue WANG AKA Brian.W of OKX security, 章鱼哥@aipy\n(aipyaipy.com), instantraaamen (github.com/instantraaamen) Contact:\nmasa.shiramizu () gmail com\n\nCUPS\nAvailable for: macOS Sequoia\nImpact: An attacker in a privileged network position may be able to\ncause a denial-of-service\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-84554: Meshaal @ Darkcov, Joseph Shamoon\n\nCUPS\nAvailable for: macOS Sequoia\nImpact: A remote user may cause an unexpected app termination or\narbitrary code execution\nDescription: A validation issue was addressed with improved input\nsanitization.\nCVE-2026-43692: Aaron Grattafiori - NVIDIA AI Red Team\n\nCUPS\nAvailable for: macOS Sequoia\nImpact: An app may be able to gain elevated privileges\nDescription: A path handling issue was addressed with improved\nvalidation.\nCVE-2026-64790: Aaron Grattafiori - NVIDIA AI Red Team\n\nCUPS\nAvailable for: macOS Sequoia\nImpact: An app may be able to gain root privileges\nDescription: A path handling issue was addressed with improved\nvalidation.\nCVE-2026-43691: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\nCUPS\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted file may result in unexpected\napp termination or disclosure of process memory\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-84516: 章鱼哥@aipy (aipyaipy.com)\n\nCUPS\nAvailable for: macOS Sequoia\nImpact: An application "
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:30Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/57"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/57"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/149043"
        },
        {
          "url": "https://support.apple.com/downloads/"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/57"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-09-14-2026-5 macOS Sequoia 15.8",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2022-3437",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20683",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28899",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28930",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28934",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28935",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28966",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28968",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28969",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43664",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43677",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43683",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43684",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43686",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43690",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43691",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43692",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43695",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43697",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43702",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43719",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43737",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43741",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43763",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43785",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43786",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43787",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43789",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43790",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43791",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64712",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64736",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64756",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64758",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64790",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65330",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65339",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65342",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65344",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65345",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65346",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65348",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65349",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65358",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65359",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65360",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65361",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65362",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65364",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65365",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65369",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65371",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65374",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65375",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65376",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65377",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65378",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65381",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65382",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65395",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65399",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65402",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65403",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65405",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65406",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65407",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65408",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65409",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65412",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65413",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65414",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84487",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84492",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84497",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84505",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84506",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84507",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84509",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84510",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84511",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84512",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84513",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84514",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84515",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84516",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84517",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84519",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84521",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84523",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84524",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84525",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84526",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84527",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84532",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84534",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84535",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84536",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84537",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84538",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84540",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84541",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84543",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84544",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84546",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84548",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84549",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84550",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84552",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84553",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84554",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84555",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84556",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84559",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84561",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84563",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84564",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84565",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84566",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84567",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84568",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84570",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84572",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84573",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84574",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84575",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84576",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84578",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84580",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84581",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84583",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84587",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84602",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84607",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84609",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84611",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84612",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84616",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84617",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84618",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84619",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84620",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84621",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84622",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84624",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84626",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84630",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84632",
              "type": "related"
            },
            {
              "destId": "CVE-2026-86876",
              "type": "related"
            },
            {
              "destId": "CVE-2026-86881",
              "type": "related"
            },
            {
              "destId": "CVE-2026-86882",
              "type": "related"
            },
            {
              "destId": "CVE-2026-86889",
              "type": "related"
            },
            {
              "destId": "CVE-2026-86891",
              "type": "related"
            },
            {
              "destId": "CVE-2026-86910",
              "type": "related"
            },
            {
              "destId": "CVE-2026-86917",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0395",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/57",
            "automated": true,
            "contentSha256": "2d2290df1e9a0630fae8e581880969ed2cbe2e8e9f7c0f528a773fe4af504171",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/57",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-14T22:07:43Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:30Z",
    "dateUpdated": "2026-10-02T04:57:30Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0395"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}