Apple Patches Six Vulnerabilities in macOS, watchOS, and Container Tech
Apple Inc. released patches for six vulnerabilities in macOS, watchOS, and container technologies, disclosed August 20-21, 2026, addressing issues from data exposure to denial-of-service.
Key findings
- Apple patched six vulnerabilities across macOS, watchOS, and container tech disclosed August 20-21, 2026.
- Issues include unauthorized contact viewing, unexpected app termination, and potential memory exhaustion.
- Network vulnerabilities allow for unauthenticated stack writes and denial-of-service via crafted frames.
- Affected products include macOS Sequoia/Sonoma/Tahoe, watchOS, and container environments.
- Patches are available in watchOS 26.4, macOS 15.7.5/14.8.5/26.4, container 1.2.0, swift-nio-ssh 0.14.1, and swift-nio 2.101.0.
On August 20-21, 2026, Apple Inc. addressed a batch of six vulnerabilities across its product ecosystem, including macOS, watchOS, and container technologies. The disclosures, spanning a six-hour window, highlight issues ranging from low-severity permission errors to medium-severity denial-of-service and information disclosure vulnerabilities. These findings underscore the ongoing need for vigilance in software security across diverse platforms.
Several vulnerabilities stem from insufficient permission checks or improper handling of data, potentially leading to unauthorized access or system instability. CVE-2026-43679, a low-severity issue affecting watchOS 26.4, allows an attacker with physical access to a locked Apple Watch to view user contacts due to inadequate permission checking. Similarly, CVE-2026-20679 in macOS Sequoia, Sonoma, and Tahoe versions (15.7.5, 14.8.5, and 26.4 respectively) could lead to unexpected application termination when processing a maliciously crafted file, addressed by improved checks.
More critical issues were also part of this disclosure batch. CVE-2026-64773, affecting container technology, could allow an attacker to exploit a host's forwarding process by buffering an unbounded amount of client data in memory, potentially leading to resource exhaustion. CVE-2026-64777, a medium-severity vulnerability in container version 1.2.0, permits a malicious builder peer to request arbitrary files from the host by name, even if they are outside the intended build context.
Network-related vulnerabilities were also present. CVE-2026-43798, impacting applications built on swift-nio-ssh, could be exploited by an unauthenticated network attacker to perform an out-of-bounds stack write with attacker-controlled content and length via a crafted SSH message. This is fixed in swift-nio-ssh version 0.14.1. Another network-related vulnerability, CVE-2026-43678, a medium-severity issue in swift-nio versions prior to 2.101.0, allows an unauthenticated remote peer to crash any NIOWebSocket-based server with a single frame, leading to dropped connections until the process restarts.
Apple has addressed these vulnerabilities through software updates. Users are advised to update their macOS, watchOS, and container environments to the latest versions to mitigate these risks. The timely patching of these diverse issues reflects the continuous effort required to maintain the security posture of complex software ecosystems. Staying informed about these disclosures and applying updates promptly is crucial for protecting user data and system integrity.