Apple
macOS Sonoma 14.8.8
128072 Jul 27, 2026 Source: Vendor
Imported by the Apple release catcher from https://support.apple.com/en-us/128072. 127 CVE entries, 12 additional recognitions. Available for: macOS Sonoma. Draft — review before publishing.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://support.apple.com/en-us/128072
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
227 lines
Showing 1–50 of 227 , page 1 of 5
CVE-2026-43749
BR2026-0000-004579
Accounts
unclaimed
An app may be able to gain root privileges
Credited as Adam Franke
CVE-2026-43749
BR2026-0000-004580
Accounts
unclaimed
An app may be able to gain root privileges
Credited as Trung Nguyen (@everping) of CyStack
CVE-2026-43749
BR2026-0000-004581
Accounts
unclaimed
An app may be able to gain root privileges
Credited as Ashish Kunwar
CVE-2026-64767
BR2026-0000-004582
afpfs
unclaimed
A remote attacker may be able to cause unexpected system termination or corrupt kernel memory
Credited as Dave G.
CVE-2026-23918
BR2026-0000-004583
apache
unclaimed
A remote attacker may be able to cause a denial-of-service
Credited as Юлия Мерцалова
CVE-2026-64695
BR2026-0000-004584
APFS
unclaimed
A remote user may be able to cause unexpected system termination or corrupt kernel memory
Credited as Peter Malone
CVE-2026-43801
BR2026-0000-004585
App Store
unclaimed
An app may be able to access sensitive user data
Credited as Rahul Raj
CVE-2026-43781
BR2026-0000-004586
Apple Account
unclaimed
An app may be able to access sensitive user data
Credited as Pinak Oza
CVE-2026-64737
BR2026-0000-004587
Apple Account
unclaimed
A malicious app may be able to break out of its sandbox
Credited as Robert Mindo
CVE-2026-43681
BR2026-0000-004588
AppleRAID
unclaimed
A local user may be able to read kernel memory
Credited as impost0r (ret2plt)
CVE-2026-43681
BR2026-0000-004589
AppleRAID
unclaimed
A local user may be able to read kernel memory
Credited as David Ige - Beryllium Security
CVE-2026-43672
BR2026-0000-004590
Assets
unclaimed
A malicious application may be able to bypass Privacy preferences
Credited as 이재영
CVE-2026-43763
BR2026-0000-004591
ATS
✓ Claimed by @pavanchow
vendor credited Pavan Nallamothu
An app may be able to read files outside of its sandbox
Credited as Pavan Nallamothu
CVE-2026-43763
BR2026-0000-004592
ATS
unclaimed
An app may be able to read files outside of its sandbox
Credited as Jared Reyes
CVE-2026-64702
BR2026-0000-004593
Audio
unclaimed
An app may be able to break out of its sandbox
Credited as John Lussier
CVE-2026-64725
BR2026-0000-004594
Audio
unclaimed
An app may be able to cause a denial-of-service
Credited as Seonung Park
CVE-2026-64725
BR2026-0000-004595
Audio
unclaimed
An app may be able to cause a denial-of-service
Credited as ALTV!ST (altvi.st/)
CVE-2026-64747
BR2026-0000-004596
AVEVideoEncoder
unclaimed
An app may be able to execute arbitrary code with kernel privileges
Credited as Franco Belman at Blackwing Intelligence
CVE-2026-64762
BR2026-0000-004597
AVEVideoEncoder
unclaimed
An app may be able to cause unexpected system termination
Credited as Franco Belman at Blackwing Intelligence
CVE-2026-64762
BR2026-0000-004598
AVEVideoEncoder
unclaimed
An app may be able to cause unexpected system termination
Credited as Dun
CVE-2026-64707
BR2026-0000-004599
BackgroundAssets
unclaimed
An app may be able to delete files for which it does not have permission
Credited as YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab
CVE-2026-28849
BR2026-0000-004600
BOM
unclaimed
A maliciously crafted ZIP archive may bypass Gatekeeper checks
Credited as Andreas Jaegersberger
CVE-2026-28849
BR2026-0000-004601
BOM
unclaimed
A maliciously crafted ZIP archive may bypass Gatekeeper checks
Credited as Ro Achterberg of Nosebeard Labs
CVE-2026-64698
BR2026-0000-004602
cd9660
unclaimed
An app may be able to cause unexpected system termination or read kernel memory
Credited as Richard Zana
CVE-2026-64698
BR2026-0000-004603
cd9660
unclaimed
An app may be able to cause unexpected system termination or read kernel memory
Credited as Peter Malone
CVE-2026-64698
BR2026-0000-004604
cd9660
unclaimed
An app may be able to cause unexpected system termination or read kernel memory
Credited as Nathaniel Oh (@calysteon)
CVE-2026-64734
BR2026-0000-004605
Contacts
unclaimed
Processing a maliciously crafted contact may leak sensitive data
Credited as Daniel Williams
CVE-2026-43756
BR2026-0000-004606
Control Center
unclaimed
An app may be able to access user-sensitive data
Credited as 이재영
CVE-2026-43693
BR2026-0000-004607
Core Services
unclaimed
An app may be able to gain root privileges
Credited as Gergely Kalman (@gergely_kalman)
CVE-2026-43673
BR2026-0000-004608
CoreAudio
unclaimed
Processing a maliciously crafted audio file may corrupt process memory
Credited as Anonymous working with TrendAI Zero Day Initiative
CVE-2026-43744
BR2026-0000-004609
CoreAudio
unclaimed
Processing an audio stream in a maliciously crafted media file may terminate the process
Credited as Mathis Mansière
CVE-2026-43803
BR2026-0000-004610
CoreAudio
unclaimed
A remote attacker may be able to cause unexpected system termination
Credited as Rahul Raj
CVE-2026-43711
BR2026-0000-004611
CoreMedia
unclaimed
Processing a maliciously crafted video file may lead to unexpected app termination
Credited as James Duffy (@0x4A616D657344)
CVE-2026-28936
BR2026-0000-004612
CoreServices
unclaimed
Processing a maliciously crafted file may lead to unexpected app termination
Credited as Andreas Jaegersberger
CVE-2026-28936
BR2026-0000-004613
CoreServices
unclaimed
Processing a maliciously crafted file may lead to unexpected app termination
Credited as Ro Achterberg of Nosebeard Labs
CVE-2026-43738
BR2026-0000-004614
CoreUI
unclaimed
Processing a maliciously crafted asset catalog may result in disclosure of process memory
Credited as Peter Malone
CVE-2026-64710
BR2026-0000-004615
Crash Reporter
unclaimed
An app may be able to leak sensitive user information
Credited as Matthew Schneider
CVE-2026-39875
BR2026-0000-004616
CUPS
unclaimed
A malicious app may be able to gain root privileges
Credited as XBreach.ai
CVE-2026-39875
BR2026-0000-004617
CUPS
unclaimed
A malicious app may be able to gain root privileges
Credited as Dallas Dubs
CVE-2026-39875
BR2026-0000-004618
CUPS
unclaimed
A malicious app may be able to gain root privileges
Credited as Andreas Jaegersberger
CVE-2026-39875
BR2026-0000-004619
CUPS
unclaimed
A malicious app may be able to gain root privileges
Credited as Ro Achterberg of Nosebeard Labs
CVE-2026-39875
BR2026-0000-004620
CUPS
unclaimed
A malicious app may be able to gain root privileges
Credited as Aaron Grattafiori - NVIDIA AI Red Team
CVE-2026-43698
BR2026-0000-004621
CUPS
unclaimed
An app may be able to gain root privileges
Credited as Andreas Jaegersberger
CVE-2026-43698
BR2026-0000-004622
CUPS
unclaimed
An app may be able to gain root privileges
Credited as Ro Achterberg of Nosebeard Labs
CVE-2026-43758
BR2026-0000-004623
Data Detectors UI
unclaimed
An app may be able to access sensitive user data
Credited as HvxyZLF
CVE-2026-64708
BR2026-0000-004624
DesktopServices
unclaimed
An app may bypass Gatekeeper checks
Credited as Lance Cain - Offensive Security Engineer
CVE-2026-64708
BR2026-0000-004625
DesktopServices
unclaimed
An app may bypass Gatekeeper checks
Credited as SpecterOps Inc.
CVE-2026-28926
BR2026-0000-004626
Disk Images
unclaimed
An app may be able to elevate privileges
Credited as Jonathan Bar Or (@yo_yo_yo_jbo)
CVE-2026-43747
BR2026-0000-004627
Disk Images
unclaimed
Parsing a maliciously crafted file may lead to an unexpected app termination
Credited as Anthony Laou Hine Tsuei (@anarcheuz)
CVE-2026-64694
BR2026-0000-004628
Disk Images
unclaimed
An app may be able to cause unexpected system termination
Credited as Gil Portnoy