Apple macOS: 25 Coordinated Vulnerabilities Disclosed, Affecting Data Access and System Integrity
Key findings • Apple patched 25 vulnerabilities across its operating systems on October 26, 2026, in a single disclosure event. • Vulnerabilities include potential for arbitrary code executio…
Key findings
- Apple patched 25 vulnerabilities across its operating systems on October 26, 2026, in a single disclosure event.
- Vulnerabilities include potential for arbitrary code execution with kernel privileges and unauthorized access to sensitive data.
- Issues addressed include out-of-bounds reads/writes, use-after-free, buffer overflows, and Gatekeeper bypasses.
- Patches were released for macOS Golden Gate 27/27.2, Sequoia 15.8.2, and Tahoe 26.7.2, among other Apple OS versions.
- No vulnerabilities in this batch were reported as actively exploited in the wild.
On October 26, 2026, Apple Inc. released a significant batch of 25 security advisories addressing vulnerabilities across its operating systems, including macOS, iOS, iPadOS, tvOS, watchOS, and visionOS. The disclosures, all occurring within a two-minute window, highlight a range of issues from potential arbitrary code execution to unauthorized data access and system instability. These vulnerabilities were addressed through improved security measures such as enhanced access restrictions, input validation, and memory management.
Several vulnerabilities fall into common categories. Out-of-bounds read and write issues, often stemming from processing maliciously crafted files, images, or fonts, were addressed with improved bounds checking and input validation. These include CVE-2026-86970, CVE-2026-86942, CVE-2026-86929, CVE-2026-84496, and CVE-2026-64750, which could lead to disclosure of information, denial-of-service, arbitrary code execution, or memory corruption.
Another notable theme involves privacy and access control. Vulnerabilities such as CVE-2026-86990, CVE-2026-86984, CVE-2026-86931, CVE-2026-86920, CVE-2026-86896, CVE-2026-84542, CVE-2026-65397, CVE-2026-65392, CVE-2026-65373, CVE-2026-65363, and CVE-2026-64789 could allow malicious applications to access sensitive user data, camera feeds, contacts, or even gain root privileges, bypassing sandbox restrictions or Gatekeeper checks.
Kernel-level privileges and arbitrary code execution were also addressed. CVE-2026-86916, a use-after-free issue, and CVE-2026-64759, an integer overflow, were patched and could lead to arbitrary code execution with kernel privileges or unexpected system termination. Additionally, CVE-2026-84599 and CVE-2026-65350, related to memory management, could result in kernel memory corruption or system termination.
The batch also included vulnerabilities related to file handling and system integrity. CVE-2026-84610 and CVE-2026-64789 specifically mention bypassing Gatekeeper checks through maliciously crafted archives or disk images, while CVE-2026-84604 and CVE-2026-84627 address buffer overflows that could corrupt process memory or lead to heap corruption.
Apple addressed these vulnerabilities with a range of fixes across its operating systems. Specific versions patched include macOS Golden Gate 27 and 27.2, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2. Other affected systems received updates such as iOS 18.7.11, iOS 26.7.2, iOS 27.2, and corresponding iPadOS versions, as well as tvOS, visionOS, and watchOS updates. While no vulnerabilities in this specific batch were reported as actively exploited in the wild according to Vypr Intelligence, the sheer volume and potential impact underscore the importance of timely patching.
Users of Apple products are strongly advised to update their systems to the latest available versions to mitigate these security risks. The coordinated disclosure of these 25 vulnerabilities highlights Apple's ongoing efforts to maintain the security and integrity of its ecosystem against a wide array of potential threats. The fixes address critical areas including data privacy, system stability, and the prevention of unauthorized code execution.