visionOS 27
149038
Summary
No separate summary was provided in the collected bulletin.
View 25 component changes
Audio
Available for: macOS Tahoe
Impact: An app may be able to leak sensitive user information
Description: A logic issue was addressed with improved checks.
CVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik Tsytsarkin
Authentication Services
Available for: macOS Tahoe
Impact: A website may be able to determine a user's IP address with Private Relay turned on
Description: An information disclosure issue was addressed with improved state management.
CVE-2026-65355: Xint Code
ImageIO
Available for: macOS Tahoe
Impact: Processing an image may lead to a denial-of-service
Description: The issue was addressed with improved checks.
CVE-2026-65347: Geonha Lee (@leegn4a)
ImageIO
Available for: macOS Tahoe
Impact: Processing an image may lead to arbitrary code execution
Description: An integer overflow was addressed with improved input validation.
CVE-2026-65346: Meta Red Team X - Nik Tsytsarkin
IOGPUFamily
Available for: macOS Tahoe
Impact: Processing maliciously crafted web content may lead to memory corruption
Description: The issue was addressed with improved memory handling.
CVE-2026-64788: an anonymous researcher, f00l (@PPPF00L) and 3ndy1(@_3ndy1) and Minghao Lin@Y1nkoc and 云散花折, Arjanit Isufi
IOMobileFrameBuffer
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination or corrupt kernel memory
Description: An out-of-bounds access issue was addressed with improved bounds checking.
CVE-2026-64736: Ruslan Dautov, hxr1
Kernel
Available for: macOS Tahoe
Impact: A remote attacker may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory management.
CVE-2026-65343: Drinor Selmanaj (Sentry), Surya Narayan Kushwaha
Kernel
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination or read kernel memory
Description: An out-of-bounds read was addressed with improved input validation.
CVE-2026-65349: an anonymous researcher
Kernel
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination or corrupt kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-65330: Ashish Kunwar, Mikhail Lozhnikov of Positive Technologies, Bhaswanth Chigurupati, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.
CVE-2026-28935: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.
WebKit
Available for: macOS Tahoe
Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash
Description: An out-of-bounds access issue was addressed with improved bounds checking.
CVE-2026-64784: Janggoon Lee of Out of Bounds, OpenAI Codex Security - Amy Burnett
WebKit
Available for: macOS Tahoe
Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash
Description: The issue was addressed with improved memory handling.
CVE-2026-43795: wwwlk
CVE-2026-65338: OpenAI Codex Security - Amy Burnett
WebKit
Available for: macOS Tahoe
Impact: Processing maliciously crafted web content may lead to memory corruption
Description: The issue was addressed with improved memory handling.
CVE-2026-65341: Henock Habte
WebKit
Available for: macOS Tahoe
Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash
Description: A memory corruption vulnerability was addressed with improved locking.
CVE-2026-64782: Charles Kern, Shubham Chaskar, Seonwook Kim, lattice, Josef Korbel
WebKit
Available for: macOS Tahoe
Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash
Description: The issue was addressed with improved input validation.
CVE-2026-64781: Thomas Guillem
WebKit
Available for: macOS Tahoe
Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash
Description: This issue was addressed through improved state management.
CVE-2026-65351: Niels Hofmans
CVE-2026-65340: Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Josef Korbel (Citadelo)
CVE-2026-65337: OpenAI Codex Security - Amy Burnett
CVE-2026-65336: Josef Korbel
CVE-2026-65335: OpenAI Codex Security - Amy Burnett
CVE-2026-65333: OpenAI Codex Security - Amy Burnett
CVE-2026-65332: Kun Peeks (@SwayZGl1tZyyy), OpenAI Codex Security - Amy Burnett
CVE-2026-65331: OpenAI Codex Security - Amy Burnett
WebKit
Available for: macOS Tahoe
Impact: Processing maliciously crafted web content may lead to an unexpected process crash
Description: A use-after-free issue was addressed with improved memory management.
CVE-2026-64715: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative
WebKit
Available for: macOS Tahoe
Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash
Description: The issue was addressed with improved checks.
CVE-2026-64780: OpenAI Codex Security - Amy Burnett
WebKit
Available for: macOS Tahoe
Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash
Description: A memory corruption issue was addressed with improved state management.
CVE-2026-65334: OpenAI Codex Security - Amy Burnett
WebKit
Available for: macOS Tahoe
Impact: Processing maliciously crafted web content may lead to memory corruption
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2026-43794: Dung Do (@_piers2) of Calif.io
WebKit
Available for: macOS Tahoe
Impact: Processing maliciously crafted web content may lead to an unexpected process termination
Description: A use-after-free issue was addressed with improved memory management.
CVE-2026-64787: 杉山 壮太, Shubham Chaskar
WebKit
Available for: macOS Tahoe
Impact: A website may be able to determine a user's IP address with Private Relay turned on
Description: An information disclosure issue was addressed with improved state management.
CVE-2026-65352: Talal Haj Bakry and Tommy Mysk of Mysk Inc. @mysk_co
WebKit History
Available for: macOS Tahoe
Impact: Visiting a maliciously crafted website may leak sensitive data
Description: The issue was addressed with improved checks.
CVE-2026-64778: Mohit Negi
WebKit Storage
Available for: macOS Tahoe
Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash
Description: A memory corruption vulnerability was addressed with improved locking.
CVE-2026-64779: Shubham Chaskar, Tommy DeVoss from Braze Security Team (@thedawgyg)
WebRTC
Available for: macOS Tahoe
Impact: Processing maliciously crafted web content may lead to memory corruption
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-65391: Myungyong Lee
WebRTC
Available for: macOS Tahoe
Impact: Processing maliciously crafted web content may lead to memory corruption
Description: An integer overflow was addressed with improved input validation.
CVE-2026-65390: Kwak Kiyong (@Pwnkai23), Song Nuri
Products covered
macOS Tahoe
Remediation
Separate remediation guidance was not included in the collected bulletin.
CVEs in this advisory 34
CVE-2026-65339CVE-2026-65355CVE-2026-65347CVE-2026-65346CVE-2026-64788CVE-2026-64736CVE-2026-65343CVE-2026-65349CVE-2026-65330CVE-2026-28935CVE-2026-64784CVE-2026-43795CVE-2026-65338CVE-2026-65341CVE-2026-64782CVE-2026-64781CVE-2026-65351CVE-2026-65340CVE-2026-65337CVE-2026-65336CVE-2026-65335CVE-2026-65333CVE-2026-65332CVE-2026-65331CVE-2026-64715CVE-2026-64780CVE-2026-65334CVE-2026-43794CVE-2026-64787CVE-2026-65352CVE-2026-64778CVE-2026-64779CVE-2026-65391CVE-2026-65390
Updates
- Published by Apple Security Releases
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.