Apple
macOS Sonoma 14.8.8
128072 Jul 27, 2026 Source: Vendor
Imported by the Apple release catcher from https://support.apple.com/en-us/128072. 127 CVE entries, 12 additional recognitions. Available for: macOS Sonoma. Draft — review before publishing.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://support.apple.com/en-us/128072
Are you credited here?
Sign in and claim your line: it is yours immediately, no review queue.
The name the vendor printed stays next to your handle for anyone to check against the advisory above,
and any member who thinks a claim is wrong can refute it.
Credited
227 lines
Showing 1–50 of 227 · page 1 of 5
CVE-2026-43749
BR2026-0000-004579
Accounts
unclaimed
An app may be able to gain root privileges
Credited as Adam Franke
CVE-2026-43749
BR2026-0000-004580
Accounts
unclaimed
An app may be able to gain root privileges
Credited as Trung Nguyen (@everping) of CyStack
CVE-2026-43749
BR2026-0000-004581
Accounts
unclaimed
An app may be able to gain root privileges
Credited as Ashish Kunwar
CVE-2026-64767
BR2026-0000-004582
afpfs
unclaimed
A remote attacker may be able to cause unexpected system termination or corrupt kernel memory
Credited as Dave G.
CVE-2026-23918
BR2026-0000-004583
apache
unclaimed
A remote attacker may be able to cause a denial-of-service
Credited as Юлия Мерцалова
CVE-2026-64695
BR2026-0000-004584
APFS
unclaimed
A remote user may be able to cause unexpected system termination or corrupt kernel memory
Credited as Peter Malone
CVE-2026-43801
BR2026-0000-004585
App Store
unclaimed
An app may be able to access sensitive user data
Credited as Rahul Raj
CVE-2026-43781
BR2026-0000-004586
Apple Account
unclaimed
An app may be able to access sensitive user data
Credited as Pinak Oza
CVE-2026-64737
BR2026-0000-004587
Apple Account
unclaimed
A malicious app may be able to break out of its sandbox
Credited as Robert Mindo
CVE-2026-43681
BR2026-0000-004588
AppleRAID
unclaimed
A local user may be able to read kernel memory
Credited as impost0r (ret2plt)
CVE-2026-43681
BR2026-0000-004589
AppleRAID
unclaimed
A local user may be able to read kernel memory
Credited as David Ige - Beryllium Security
CVE-2026-43672
BR2026-0000-004590
Assets
unclaimed
A malicious application may be able to bypass Privacy preferences
Credited as 이재영
CVE-2026-43763
BR2026-0000-004591
ATS
✓ Claimed by @pavanchow
vendor credited Pavan Nallamothu
An app may be able to read files outside of its sandbox
Credited as Pavan Nallamothu
CVE-2026-43763
BR2026-0000-004592
ATS
unclaimed
An app may be able to read files outside of its sandbox
Credited as Jared Reyes
CVE-2026-64702
BR2026-0000-004593
Audio
unclaimed
An app may be able to break out of its sandbox
Credited as John Lussier
CVE-2026-64725
BR2026-0000-004594
Audio
unclaimed
An app may be able to cause a denial-of-service
Credited as Seonung Park
CVE-2026-64725
BR2026-0000-004595
Audio
unclaimed
An app may be able to cause a denial-of-service
Credited as ALTV!ST (altvi.st/)
CVE-2026-64747
BR2026-0000-004596
AVEVideoEncoder
unclaimed
An app may be able to execute arbitrary code with kernel privileges
Credited as Franco Belman at Blackwing Intelligence
CVE-2026-64762
BR2026-0000-004597
AVEVideoEncoder
unclaimed
An app may be able to cause unexpected system termination
Credited as Franco Belman at Blackwing Intelligence
CVE-2026-64762
BR2026-0000-004598
AVEVideoEncoder
unclaimed
An app may be able to cause unexpected system termination
Credited as Dun
CVE-2026-64707
BR2026-0000-004599
BackgroundAssets
unclaimed
An app may be able to delete files for which it does not have permission
Credited as YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab
CVE-2026-28849
BR2026-0000-004600
BOM
unclaimed
A maliciously crafted ZIP archive may bypass Gatekeeper checks
Credited as Andreas Jaegersberger
CVE-2026-28849
BR2026-0000-004601
BOM
unclaimed
A maliciously crafted ZIP archive may bypass Gatekeeper checks
Credited as Ro Achterberg of Nosebeard Labs
CVE-2026-64698
BR2026-0000-004602
cd9660
unclaimed
An app may be able to cause unexpected system termination or read kernel memory
Credited as Richard Zana
CVE-2026-64698
BR2026-0000-004603
cd9660
unclaimed
An app may be able to cause unexpected system termination or read kernel memory
Credited as Peter Malone
CVE-2026-64698
BR2026-0000-004604
cd9660
unclaimed
An app may be able to cause unexpected system termination or read kernel memory
Credited as Nathaniel Oh (@calysteon)
CVE-2026-64734
BR2026-0000-004605
Contacts
unclaimed
Processing a maliciously crafted contact may leak sensitive data
Credited as Daniel Williams
CVE-2026-43756
BR2026-0000-004606
Control Center
unclaimed
An app may be able to access user-sensitive data
Credited as 이재영
CVE-2026-43693
BR2026-0000-004607
Core Services
unclaimed
An app may be able to gain root privileges
Credited as Gergely Kalman (@gergely_kalman)
CVE-2026-43673
BR2026-0000-004608
CoreAudio
unclaimed
Processing a maliciously crafted audio file may corrupt process memory
Credited as Anonymous working with TrendAI Zero Day Initiative
CVE-2026-43744
BR2026-0000-004609
CoreAudio
unclaimed
Processing an audio stream in a maliciously crafted media file may terminate the process
Credited as Mathis Mansière
CVE-2026-43803
BR2026-0000-004610
CoreAudio
unclaimed
A remote attacker may be able to cause unexpected system termination
Credited as Rahul Raj
CVE-2026-43711
BR2026-0000-004611
CoreMedia
unclaimed
Processing a maliciously crafted video file may lead to unexpected app termination
Credited as James Duffy (@0x4A616D657344)
CVE-2026-28936
BR2026-0000-004612
CoreServices
unclaimed
Processing a maliciously crafted file may lead to unexpected app termination
Credited as Andreas Jaegersberger
CVE-2026-28936
BR2026-0000-004613
CoreServices
unclaimed
Processing a maliciously crafted file may lead to unexpected app termination
Credited as Ro Achterberg of Nosebeard Labs
CVE-2026-43738
BR2026-0000-004614
CoreUI
unclaimed
Processing a maliciously crafted asset catalog may result in disclosure of process memory
Credited as Peter Malone
CVE-2026-64710
BR2026-0000-004615
Crash Reporter
unclaimed
An app may be able to leak sensitive user information
Credited as Matthew Schneider
CVE-2026-39875
BR2026-0000-004616
CUPS
unclaimed
A malicious app may be able to gain root privileges
Credited as XBreach.ai
CVE-2026-39875
BR2026-0000-004617
CUPS
unclaimed
A malicious app may be able to gain root privileges
Credited as Dallas Dubs
CVE-2026-39875
BR2026-0000-004618
CUPS
unclaimed
A malicious app may be able to gain root privileges
Credited as Andreas Jaegersberger
CVE-2026-39875
BR2026-0000-004619
CUPS
unclaimed
A malicious app may be able to gain root privileges
Credited as Ro Achterberg of Nosebeard Labs
CVE-2026-39875
BR2026-0000-004620
CUPS
unclaimed
A malicious app may be able to gain root privileges
Credited as Aaron Grattafiori - NVIDIA AI Red Team
CVE-2026-43698
BR2026-0000-004621
CUPS
unclaimed
An app may be able to gain root privileges
Credited as Andreas Jaegersberger
CVE-2026-43698
BR2026-0000-004622
CUPS
unclaimed
An app may be able to gain root privileges
Credited as Ro Achterberg of Nosebeard Labs
CVE-2026-43758
BR2026-0000-004623
Data Detectors UI
unclaimed
An app may be able to access sensitive user data
Credited as HvxyZLF
CVE-2026-64708
BR2026-0000-004624
DesktopServices
unclaimed
An app may bypass Gatekeeper checks
Credited as Lance Cain - Offensive Security Engineer
CVE-2026-64708
BR2026-0000-004625
DesktopServices
unclaimed
An app may bypass Gatekeeper checks
Credited as SpecterOps Inc.
CVE-2026-28926
BR2026-0000-004626
Disk Images
unclaimed
An app may be able to elevate privileges
Credited as Jonathan Bar Or (@yo_yo_yo_jbo)
CVE-2026-43747
BR2026-0000-004627
Disk Images
unclaimed
Parsing a maliciously crafted file may lead to an unexpected app termination
Credited as Anthony Laou Hine Tsuei (@anarcheuz)
CVE-2026-64694
BR2026-0000-004628
Disk Images
unclaimed
An app may be able to cause unexpected system termination
Credited as Gil Portnoy