VYPR
Published Oct 26, 2026· Updated Oct 27, 2026· 1 source

macOS Tahoe: 25 Vulnerabilities Patched Together on October 26, 2026

Key findings • Apple disclosed 25 vulnerabilities in macOS Tahoe and other operating systems on October 26, 2026. • The batch includes buffer overflows, out-of-bounds writes, and use-after-fr…

Key findings

  • Apple disclosed 25 vulnerabilities in macOS Tahoe and other operating systems on October 26, 2026.
  • The batch includes buffer overflows, out-of-bounds writes, and use-after-free vulnerabilities impacting system stability and memory integrity.
  • Several CVEs allow for privilege escalation or unauthorized access to sensitive user data.
  • No vulnerabilities in this batch were reported as actively exploited in the wild.
  • Patches are available, with macOS Tahoe users advised to update to version 26.7.2.

On October 26, 2026, Apple Inc. disclosed a significant batch of 25 vulnerabilities affecting macOS Tahoe, alongside other operating systems including iOS, iPadOS, macOS Golden Gate, macOS Sequoia, tvOS, and visionOS. The vulnerabilities, all disclosed on the same day, range in severity and impact, with several allowing malicious applications to cause unexpected system termination, corrupt kernel memory, or gain unauthorized access to sensitive user data.

The disclosed issues span various bug classes, including buffer overflows, out-of-bounds writes, use-after-free vulnerabilities, null pointer dereferences, and logic issues. Many of these vulnerabilities were addressed with improved memory handling, bounds checking, or input validation.

Several CVEs relate to memory corruption and system stability. CVE-2026-86991, CVE-2026-86972, CVE-2026-86971, CVE-2026-86969, CVE-2026-86964, CVE-2026-84595, CVE-2026-84590, CVE-2026-84539, CVE-2026-84528, CVE-2026-84498, CVE-2026-84495, CVE-2026-113912, and CVE-2026-113907 all involve issues such as buffer overflows, out-of-bounds writes, or use-after-free vulnerabilities that could lead to unexpected process termination or memory corruption.

Other vulnerabilities focus on privilege escalation and unauthorized access. CVE-2026-86939, CVE-2026-86936, CVE-2026-65327, and CVE-2026-113900 describe logic issues or race conditions that could allow a local attacker to elevate privileges or gain root access. Additionally, CVE-2026-86945, CVE-2026-86923, CVE-2026-84528, and CVE-2026-43736 involve permissions or authorization issues that could permit a malicious app to access sensitive user data or bypass security checks like Gatekeeper. CVE-2026-84545, a use-after-free vulnerability, could allow an app to escape its sandbox and execute code with root privileges.

No vulnerabilities in this batch were reported as actively exploited in the wild according to related coverage N2, N3.

Patches were released for multiple versions, including macOS Tahoe 26.7.2, macOS Golden Gate 27 and 27.2, and macOS Sequoia 15.8.2, among others. Users of macOS Tahoe should update to version 26.7.2 to address these vulnerabilities. The comprehensive nature of this patch batch underscores Apple's ongoing commitment to security and the importance of timely updates for users to protect against potential exploitation. N1, N2, N3, N4

Synthesized by Vypr AI