VULNARCHIVE

GCVE-1988-2026-0402

APPLE-SA-09-28-2026-2 macOS Tahoe 26.7.1

Description (en)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

APPLE-SA-09-28-2026-2 macOS Tahoe 26.7.1

macOS Tahoe 26.7.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149228.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

CoreGraphics
Available for: macOS Tahoe
Impact: Processing a maliciously crafted file may lead to arbitrary code
execution. Apple is aware of a report that this issue may have been
exploited in an extremely sophisticated attack against specific targeted
individuals on versions of iOS before iOS 27.
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-86950: Meta Product Security

macOS Tahoe 26.7.1 may be obtained from the Mac App Store or
Apple's Software Downloads web site:
https://support.apple.com/downloads/

All information is also posted on the Apple Security Releases
web site: https://support.apple.com/100100.

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmq62tkACgkQ4Ifiq8DH
7PW9ehAArJ/eLh9DDNyANMqDrBPnJJAsv+nkLEU7mhFhMGwCxaRJJ5FidwZWLbqK
7ZtP4+7ggey1mb1MU/gkAVClkM2jGzizbQSfMqnnMmHWkHrIiHV16KTnXCUvxBiU
XbA0pPpLMtudscS7EumH9phCwMIDMdESSRC12OQcExqeZ2QCxkMZ8k8nvkpMA/SH
inRklHdBoTcCUMNw6c354mVO/GpeyCbjScwg35DTabqwgxlH7eDTjAlw+0zHcxpc
rHawS2lUvjVNIenl7/j4fQgYr1g6UPYiPB5xb31vncDmWcx/y5JFJUSgyQde0Q51
VOH58EplvBuAIY8/otFqYiTX0IsWMn5C7NVY5Yt+biRE7fLgPgTo8GblQi6KMEzt
dmUaCXV0/XuOXvJFr6jiCxkjmH3c+oTB63feSoX2tywUApLgIUSD9gYfA6Gu8TMy
IT20xrcf61ffcc+pstKI5MY2P2mI1YVpZ142aDe0n0M7x0lMLddcVfm4QAp+v4Lt
/Bpap7EFrAa3+r1k/L68c2Ui/c5sFyvjQI2Gg3x6NViHIOhlKSwvGytj8DL5YivJ
OsNT8PtvdmaFwLTo+41dy7+vTfP28OKwAlJFxDe+qWhylXfjPXSDni5HPUpc77mG
lzj/fuXRmIDT79u0uQYq+BhWdIbhHjH0f4xGl14ELrf66ZuRPtY=
=yI+o
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

References

Raw JSON
{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Macos Tahoe",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-09-28-2026-2 macOS Tahoe 26.7.1\n\nmacOS Tahoe 26.7.1 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/149228.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nCoreGraphics\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted file may lead to arbitrary code\nexecution. Apple is aware of a report that this issue may have been\nexploited in an extremely sophisticated attack against specific targeted\nindividuals on versions of iOS before iOS 27.\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-86950: Meta Product Security\n\nmacOS Tahoe 26.7.1 may be obtained from the Mac App Store or\nApple's Software Downloads web site:\nhttps://support.apple.com/downloads/\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple's Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmq62tkACgkQ4Ifiq8DH\n7PW9ehAArJ/eLh9DDNyANMqDrBPnJJAsv+nkLEU7mhFhMGwCxaRJJ5FidwZWLbqK\n7ZtP4+7ggey1mb1MU/gkAVClkM2jGzizbQSfMqnnMmHWkHrIiHV16KTnXCUvxBiU\nXbA0pPpLMtudscS7EumH9phCwMIDMdESSRC12OQcExqeZ2QCxkMZ8k8nvkpMA/SH\ninRklHdBoTcCUMNw6c354mVO/GpeyCbjScwg35DTabqwgxlH7eDTjAlw+0zHcxpc\nrHawS2lUvjVNIenl7/j4fQgYr1g6UPYiPB5xb31vncDmWcx/y5JFJUSgyQde0Q51\nVOH58EplvBuAIY8/otFqYiTX0IsWMn5C7NVY5Yt+biRE7fLgPgTo8GblQi6KMEzt\ndmUaCXV0/XuOXvJFr6jiCxkjmH3c+oTB63feSoX2tywUApLgIUSD9gYfA6Gu8TMy\nIT20xrcf61ffcc+pstKI5MY2P2mI1YVpZ142aDe0n0M7x0lMLddcVfm4QAp+v4Lt\n/Bpap7EFrAa3+r1k/L68c2Ui/c5sFyvjQI2Gg3x6NViHIOhlKSwvGytj8DL5YivJ\nOsNT8PtvdmaFwLTo+41dy7+vTfP28OKwAlJFxDe+qWhylXfjPXSDni5HPUpc77mG\nlzj/fuXRmIDT79u0uQYq+BhWdIbhHjH0f4xGl14ELrf66ZuRPtY=\n=yI+o\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:32Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/90"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/90"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/149228"
        },
        {
          "url": "https://support.apple.com/downloads/"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/90"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-09-28-2026-2 macOS Tahoe 26.7.1",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-86950",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0402",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/90",
            "automated": true,
            "contentSha256": "f9d1aeab2a8f9f6f771471bff834af697a083f489cebd66ede25997566384cec",
            "evidenceScore": 6,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/90",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-28T22:13:29Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:32Z",
    "dateUpdated": "2026-10-02T04:57:32Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0402"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}