Apple macOS Macintosh Operating System
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Apple macOS.
Recent Apple macOS Security Advisories
| Advisory | Title | Published |
|---|---|---|
| 149228 | macOS Tahoe 26.7.1 - Apple Security Content | September 28, 2026 |
| 149229 | macOS Sequoia 15.8.1 - Apple Security Content | September 28, 2026 |
| 149035 | macOS Golden Gate 27 - Apple Security Content | September 14, 2026 |
| 149042 | macOS Tahoe 26.7 - Apple Security Content | September 14, 2026 |
| 149043 | macOS Sequoia 15.8 - Apple Security Content | September 14, 2026 |
| 148281 | macOS Tahoe 26.6.2 - Apple Security Content | August 17, 2026 |
| 148171 | macOS Sequoia 15.7.9 - Apple Security Content | August 6, 2026 |
| 148170 | macOS Tahoe 26.6.1 - Apple Security Content | August 6, 2026 |
| 148172 | macOS Sonoma 14.8.9 - Apple Security Content | August 6, 2026 |
| 128072 | macOS Sonoma 14.8.8 - Apple Security Content | July 27, 2026 |
Known Exploited Apple macOS Vulnerabilities
The following Apple macOS vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| Apple macOS Improper Authentication Vulnerability |
Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials. CVE-2026-65400 |
August 18, 2026 |
| Apple macOS Use-After-Free Vulnerability |
Apple macOS contains a use-after-free vulnerability that could allow for privilege escalation. CVE-2019-8526 Exploit Probability: 0.7% |
April 17, 2023 |
| Apple macOS Out-of-Bounds Write Vulnerability |
macOS Monterey contains an out-of-bounds write vulnerability that could allow an application to execute arbitrary code with kernel privileges. CVE-2022-22675 Exploit Probability: 12.5% |
April 4, 2022 |
| Apple macOS Out-of-Bounds Read Vulnerability |
macOS Monterey contains an out-of-bounds read vulnerability that could allow an application to read kernel memory. CVE-2022-22674 Exploit Probability: 1.1% |
April 4, 2022 |
| Apple macOS Input Validation Error |
A malicious application may be able to bypass Privacy preferences. Apple is aware of a report that this issue may have been actively exploited. CVE-2021-30713 Exploit Probability: 7.0% |
November 3, 2021 |
| Apple macOS Policy Subsystem Gatekeeper Bypass |
A malicious application may bypass Gatekeeper checks. Apple is aware of a report that this issue may have been actively exploited. CVE-2021-30657 Exploit Probability: 68.5% |
November 3, 2021 |
The vulnerability CVE-2021-30657: Apple macOS Policy Subsystem Gatekeeper Bypass is in the top 1% of the currently known exploitable vulnerabilities. The vulnerability CVE-2022-22675: Apple macOS Out-of-Bounds Write Vulnerability is in the top 5% of the currently known exploitable vulnerabilities.
Apple macOS EOL Dates
Ensure that you are using a supported version of Apple macOS. Here are some end of life, and end of support dates for Apple macOS.
| Release | EOL Date | Status |
|---|---|---|
| 27 | - |
Active
|
| 26 | - |
Active
|
| 15 | - |
Active
|
| 14 | September 14, 2026 |
EOL
Apple macOS 14 became EOL in 2026. |
| 13 | September 15, 2025 |
EOL
Apple macOS 13 became EOL in 2025. |
| 12 | September 16, 2024 |
EOL
Apple macOS 12 became EOL in 2024. |
| 11 | February 2, 2026 |
EOL
Apple macOS 11 became EOL in 2026. |
| 10.15 | February 2, 2026 |
EOL
Apple macOS 10.15 became EOL in 2026. |
| 10.14 | October 25, 2021 |
EOL
Apple macOS 10.14 became EOL in 2021. |
| 10.13 | December 1, 2020 |
EOL
Apple macOS 10.13 became EOL in 2020. |
| 10.12 | October 1, 2019 |
EOL
Apple macOS 10.12 became EOL in 2019. |
| 10.11 | December 1, 2018 |
EOL
Apple macOS 10.11 became EOL in 2018. |
| 10.9 | December 1, 2016 |
EOL
Apple macOS 10.9 became EOL in 2016. |
| 10.8 | August 13, 2015 |
EOL
Apple macOS 10.8 became EOL in 2015. |
| 10.7 | October 4, 2012 |
EOL
Apple macOS 10.7 became EOL in 2012. |
| 10.6 | July 25, 2011 |
EOL
Apple macOS 10.6 became EOL in 2011. |
| 10.5 | August 13, 2009 |
EOL
Apple macOS 10.5 became EOL in 2009. |
| 10.4 | November 14, 2007 |
EOL
Apple macOS 10.4 became EOL in 2007. |
| 10.3 | April 15, 2005 |
EOL
Apple macOS 10.3 became EOL in 2005. |
| 10.2 | October 3, 2003 |
EOL
Apple macOS 10.2 became EOL in 2003. |
By the Year
In 2026 there have been 769 vulnerabilities in Apple macOS with an average score of 6.6 out of ten. Last year, in 2025 macOS had 679 security vulnerabilities published. That is, 90 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.03.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 769 | 6.65 |
| 2025 | 679 | 6.62 |
| 2024 | 543 | 6.42 |
| 2023 | 427 | 6.73 |
| 2022 | 381 | 7.10 |
| 2021 | 500 | 6.99 |
| 2020 | 342 | 7.31 |
| 2019 | 305 | 7.62 |
| 2018 | 89 | 7.25 |
It may take a day or so for new macOS vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Apple macOS Security Vulnerabilities
macOS OOB Write in Sequoia/Tahoe (before 15.8/26.7)
CVE-2026-86981
5.5 - Medium
- October 20, 2026
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination.
Memory Corruption
macOS Golden Gate 27 Privacy Flaw: App Access to Sensitive Data
CVE-2026-86979
5.5 - Medium
- October 20, 2026
A privacy issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27. An app may be able to access sensitive user data.
Information Disclosure
Apple iOS 27 App Data Leakage via Improper State Mngmt
CVE-2026-86976
5.5 - Medium
- October 20, 2026
An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. An app may be able to access sensitive user data.
AuthZ
Apple OS Image Decoder OOB Read CVE-2026-86975
CVE-2026-86975
4.3 - Medium
- October 20, 2026
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may lead to unexpected process termination.
Out-of-bounds Read
Apple OS Double Free Vulnerability (iOS 26.7+, macOS Sequoia 15.8+)
CVE-2026-86962
5.5 - Medium
- October 20, 2026
A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.
Double-free
Apple iOS/iPadOS/macOS 27 Sandbox Breakout Race Condition
CVE-2026-86961
- October 20, 2026
A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious app may be able to break out of its sandbox.
Apple iOS/macos Input Validation Bug (before 26.7)
CVE-2026-86959
- October 20, 2026
An input validation issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Processing a maliciously crafted image may lead to unexpected process termination.
Apple OS OOB Read Fixed in iOS 26.7, iPadOS 26.7, macOS Sequoia 15.8
CVE-2026-86957
6.5 - Medium
- October 20, 2026
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An attacker in wireless proximity may be able to cause unexpected system termination.
Out-of-bounds Read
Apple OS OOB Write in System Libraries
CVE-2026-86953
4.6 - Medium
- October 20, 2026
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An attacker in physical proximity may be able to cause a denial-of-service.
Memory Corruption
Apple macOS Sequoia 15.8 OOB Write CVE-2026-86944
CVE-2026-86944
- October 20, 2026
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination.
macOS Kernel Mem Disclosure (CVE202686940)
CVE-2026-86940
- October 20, 2026
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27. An app may be able to disclose kernel memory.
macOS Golden Gate Entitlement Escalation (CVE-2026-86935)
CVE-2026-86935
- October 20, 2026
This issue was addressed by removing additional entitlements. This issue is fixed in macOS Golden Gate 27. An app may be able to access user-sensitive data.
macOS Golden Gate Sandbox Restriction Issue Allows Contact Data Access
CVE-2026-86933
- October 20, 2026
A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27. An app may be able to access information about a user's contacts.
Authorization Issue in macOS Golden Gate 27 Allows App Access to Sensitive Data
CVE-2026-86932
5.5 - Medium
- October 20, 2026
An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to access sensitive user data.
AuthZ
macOS Golden Gate Path Handling Flaw Exposing Protected Data
CVE-2026-86928
5.5 - Medium
- October 20, 2026
A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27. An app may be able to access protected user data.
Directory traversal
Apple iOS/iPadOS/macOS VisionOS Stack Overflow via Paired Bluetooth (pre-26.7/27)
CVE-2026-86919
- October 20, 2026
A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. An attacker with a paired Bluetooth device may be able to execute arbitrary code.
iOS 26.7/27 Permissions Flaw: Local Attacker Can Overwrite Files
CVE-2026-86921
6.2 - Medium
- October 20, 2026
A permissions issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. A local attacker may be able to overwrite restricted files.
Improper Privilege Management
Safari Type Confusion Vulnerability Arbitrary Code Execution
CVE-2026-86922
8.8 - High
- October 20, 2026
A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Processing maliciously crafted web content may lead to arbitrary code execution.
Object Type Confusion
macOS Golden Gate Race Condition App Crash
CVE-2026-86915
- October 20, 2026
A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27. An app may be able to cause unexpected system termination.
Apple OS Image Parser OOB Write Causing App Crash (CVE-2026-86918)
CVE-2026-86918
- October 20, 2026
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may lead to unexpected app termination.
Apple iOS/iPadOS UAF Media Parsing (fixed 26.7/27)
CVE-2026-86913
- October 20, 2026
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.
Apple macOS Info Disclosure via State Mgmt flaw (pre-27/15.8/26.7)
CVE-2026-86914
- October 20, 2026
An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive network connection information.
macOS Entitlement Check Bypass: Admin App Alters System Keychain 15.7/26.6
CVE-2026-86907
- October 20, 2026
An authorization issue was addressed with improved entitlement checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app with admin privileges may be able to modify the System Keychain.
macOS NetFS Integer Underflow (v27+, Sequoia 15.8)
CVE-2026-86871
- October 20, 2026
An integer underflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker with control of a network file server may be able to cause unexpected system termination.
Authentication issue permits user impersonation in macOS before GG27, S15.8, T26.7
CVE-2026-86868
- October 20, 2026
An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker may be able to impersonate other users.
Out-of-Bounds Write in Apple OS (iOS/iPadOS/macOS/tvOS) Fixed in 26.7-27
CVE-2026-84613
- October 20, 2026
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An attacker in radio range may be able to cause unexpected system termination.
Apple OS Privacy Flaw lets Apps Access Sensitive Data - CVE-2026-84582
CVE-2026-84582
- October 20, 2026
A privacy issue was addressed with improved access restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to access sensitive user data.
macOS Network Share File Exec (pre- Golden Gate 27/Sequoia 15.8/Tahoe 26.7)
CVE-2026-84579
- October 20, 2026
A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Opening a file referencing a network share may lead to unexpected software execution.
Memory Corruption CVE-2026-84547 in macOS GoldG<27 Sequoia<15.8 Tahoe<26.7
CVE-2026-84547
- October 20, 2026
A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker in physical proximity may be able to corrupt process memory.
Apple iOS 27 Access Control Flaw via Caller Validation
CVE-2026-84508
- October 20, 2026
This issue was addressed with improved validation of the caller's access. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, visionOS 27. An app may be able to access protected user data.
macOS Buffer Overflow (pre-27) in size validation
CVE-2026-65396
- October 20, 2026
A buffer overflow was addressed with improved size validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination.
macOS Secure Input State RCE, fixed in 27, 15.8, 26.7
CVE-2026-65379
- October 20, 2026
The issue was addressed with improved handling of secure input state. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data.
macOS Race Condition Bypasses Privacy Prefs (Fixed in 27, 15.8, 26.7)
CVE-2026-65372
- October 20, 2026
A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A malicious application may be able to bypass Privacy preferences.
macOS Access Control Bypass (pre-27 GG, <15.8 SQ)
CVE-2026-65356
- October 20, 2026
An access issue was addressed with improved access controls. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data.
macOS App Bundle Integrity Bypass Allows Malicious App Launch
CVE-2026-28854
- October 20, 2026
The issue was addressed with additional app bundle integrity checks. This issue is fixed in macOS Golden Gate 27. A maliciously modified app may not be prevented from launching.
macOS Sequoia 15.8 Privilege Escalation via Improper Checks
CVE-2026-28853
7.8 - High
- October 20, 2026
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to elevate privileges.
Improper Privilege Management
Apple iOS 26.7.1 OOB Write Arbitrary Code Exec
CVE-2026-86950
8.8 - High
- September 28, 2026
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
Memory Corruption
Apple OSes Type Confusion DFS before 27 via memory handling
CVE-2026-65409
5.5 - Medium
- September 14, 2026
A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause a denial of service.
Object Type Confusion
macOS file permissions issue allows privileged access before 27/15.8
CVE-2026-84559
5.5 - Medium
- September 14, 2026
A permissions issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A malicious application may be able to access restricted files.
Protection Mechanism Failure
macOS 27/15.8/26.7: State Management Logic Issue Allows Protected Data Access
CVE-2026-43741
5.5 - Medium
- September 14, 2026
A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access protected user data.
Authorization
macOS Golden Gate State MGmt Flaw: App Access Sensitive Data
CVE-2026-28937
5.5 - Medium
- September 14, 2026
This issue was addressed through improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to access sensitive user data.
Authorization
Apple OS OOB Write (fixed in iOS 26.7/27)
CVE-2026-86876
5.2 - Medium
- September 14, 2026
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27, watchOS 27. A sandboxed process may be able to circumvent sandbox restrictions.
Memory Corruption
Apple Safari 27: Exfiltration of installed apps via state management
CVE-2026-84518
4.3 - Medium
- September 14, 2026
This issue was addressed through improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious website may be able to determine what apps a user has installed.
External Control of Critical State Data
Privilege Escalation via Entitlement Check Bypass in macOS Golden Gate
CVE-2026-84631
7.8 - High
- September 14, 2026
This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27. An app may be able to gain root privileges.
Improper Handling of Insufficient Permissions or Privileges
Apple macOS Logic Flaw Unexpected Termination (GG 27, Sequoia 15.8, Tahoe 26.7)
CVE-2026-84563
7.5 - High
- September 14, 2026
A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination.
Object Type Confusion
File Write via Malicious Archive in iOS/iPadOS 26.7+, macOS 27+, visionOS 27
CVE-2026-84534
5.5 - Medium
- September 14, 2026
A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. Extracting a maliciously crafted archive may allow an attacker to write arbitrary files.
Directory traversal
macOS Kernel Memory Read via Race Condition (Fixed in 27, 15.8, 26.7)
CVE-2026-43690
4.7 - Medium
- September 14, 2026
A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A local user may be able to read kernel memory.
Race Condition
Race Condition in macOS State Management Enables Sensitive Data Access
CVE-2026-84522
5.9 - Medium
- September 14, 2026
A race condition was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to access sensitive user data.
Race Condition
macOS Gatekeeper Bypass via Logic Issue in State Management
CVE-2026-86909
4.4 - Medium
- September 14, 2026
A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to bypass Gatekeeper checks.
Protection Mechanism Failure
Apple OS kernel use-after-free via NFS (fixed in 26.7/27)
CVE-2026-43686
8.8 - High
- September 14, 2026
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Connecting to a malicious NFS server may lead to kernel memory corruption.
Dangling pointer
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Apple macOS or by Apple? Click the Watch button to subscribe.
