macOS Tahoe
by Apple Inc.
CVEs (156)
| CVE | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-43514 | 0.00 | — | 0.00 | Dec 17, 2025 | The issue was addressed with improved handling of caches. This issue is fixed in macOS Tahoe 26.2. An app may be able to access protected user data. | ||
| CVE-2025-46291 | 0.00 | — | 0.00 | Dec 17, 2025 | A logic issue was addressed with improved validation. This issue is fixed in macOS Tahoe 26.2. An app may bypass Gatekeeper checks. | ||
| CVE-2025-43541 | 0.00 | — | 0.00 | Dec 17, 2025 | A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. | ||
| CVE-2025-43467 | 0.00 | — | 0.00 | Dec 12, 2025 | This issue was addressed with improved checks. This issue is fixed in macOS Tahoe 26.1. An app may be able to gain root privileges. | ||
| CVE-2025-43470 | 0.00 | — | 0.00 | Dec 12, 2025 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.1. A standard user may be able to view files made from a disk image belonging to an administrator. | ||
| CVE-2025-43461 | 0.00 | — | 0.00 | Dec 12, 2025 | This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Tahoe 26.1. An app may be able to access protected user data. | ||
| CVE-2025-43506 | 0.00 | — | 0.00 | Dec 12, 2025 | A logic error was addressed with improved error handling. This issue is fixed in macOS Tahoe 26.1. iCloud Private Relay may not activate when more than one user is logged in at the same time. | ||
| CVE-2025-43497 | 0.00 | — | 0.00 | Dec 12, 2025 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to break out of its sandbox. | ||
| CVE-2025-43473 | 0.00 | — | 0.00 | Dec 12, 2025 | This issue was addressed with improved state management. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user data. | ||
| CVE-2025-43388 | 0.00 | — | 0.00 | Dec 12, 2025 | An injection issue was addressed with improved validation. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user data. | ||
| CVE-2025-43404 | 0.00 | — | 0.00 | Dec 12, 2025 | A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user data. | ||
| CVE-2025-43464 | 0.00 | — | 0.00 | Dec 12, 2025 | A denial-of-service issue was addressed with improved input validation. This issue is fixed in macOS Tahoe 26.1. Visiting a website may lead to an app denial-of-service. | ||
| CVE-2025-43390 | 0.00 | — | 0.00 | Nov 4, 2025 | A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.1. An app may be able to access user-sensitive data. | ||
| CVE-2025-43387 | 0.00 | — | 0.00 | Nov 4, 2025 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.1. A malicious app may be able to gain root privileges. | ||
| CVE-2025-43377 | 0.00 | — | 0.00 | Nov 4, 2025 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, macOS Sequoia 15.7.2, macOS Tahoe 26.1. An app may be able to cause a denial-of-service. | ||
| CVE-2025-43481 | 0.00 | — | 0.00 | Nov 4, 2025 | This issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.1. An app may be able to break out of its sandbox. |
- CVE-2025-43514Dec 17, 2025risk 0.00cvss —epss 0.00
The issue was addressed with improved handling of caches. This issue is fixed in macOS Tahoe 26.2. An app may be able to access protected user data.
- CVE-2025-46291Dec 17, 2025risk 0.00cvss —epss 0.00
A logic issue was addressed with improved validation. This issue is fixed in macOS Tahoe 26.2. An app may bypass Gatekeeper checks.
- CVE-2025-43541Dec 17, 2025risk 0.00cvss —epss 0.00
A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
- CVE-2025-43467Dec 12, 2025risk 0.00cvss —epss 0.00
This issue was addressed with improved checks. This issue is fixed in macOS Tahoe 26.1. An app may be able to gain root privileges.
- CVE-2025-43470Dec 12, 2025risk 0.00cvss —epss 0.00
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.1. A standard user may be able to view files made from a disk image belonging to an administrator.
- CVE-2025-43461Dec 12, 2025risk 0.00cvss —epss 0.00
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Tahoe 26.1. An app may be able to access protected user data.
- CVE-2025-43506Dec 12, 2025risk 0.00cvss —epss 0.00
A logic error was addressed with improved error handling. This issue is fixed in macOS Tahoe 26.1. iCloud Private Relay may not activate when more than one user is logged in at the same time.
- CVE-2025-43497Dec 12, 2025risk 0.00cvss —epss 0.00
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to break out of its sandbox.
- CVE-2025-43473Dec 12, 2025risk 0.00cvss —epss 0.00
This issue was addressed with improved state management. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user data.
- CVE-2025-43388Dec 12, 2025risk 0.00cvss —epss 0.00
An injection issue was addressed with improved validation. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user data.
- CVE-2025-43404Dec 12, 2025risk 0.00cvss —epss 0.00
A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user data.
- CVE-2025-43464Dec 12, 2025risk 0.00cvss —epss 0.00
A denial-of-service issue was addressed with improved input validation. This issue is fixed in macOS Tahoe 26.1. Visiting a website may lead to an app denial-of-service.
- CVE-2025-43390Nov 4, 2025risk 0.00cvss —epss 0.00
A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.1. An app may be able to access user-sensitive data.
- CVE-2025-43387Nov 4, 2025risk 0.00cvss —epss 0.00
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.1. A malicious app may be able to gain root privileges.
- CVE-2025-43377Nov 4, 2025risk 0.00cvss —epss 0.00
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, macOS Sequoia 15.7.2, macOS Tahoe 26.1. An app may be able to cause a denial-of-service.
- CVE-2025-43481Nov 4, 2025risk 0.00cvss —epss 0.00
This issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.1. An app may be able to break out of its sandbox.
Page 8 of 8