CVE-2026-84539
Low risk· EPSS 11%Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
An out-of-bounds write issue in macOS allows an app to cause unexpected system termination. The issue was addressed with improved bounds checking and is fixed in macOS Golden Gate 27 and macOS Tahoe 26.7.2.
Risk Assessment
An app could crash the system, causing denial of service. The risk affects unpatched devices running untrusted apps.
Recommendation
Update macOS systems to Golden Gate 27 or Tahoe 26.7.2. Restrict execution of apps from unverified sources.
Other vulnerabilities in macOS
See all- CVE-2026-86868Critical
An authentication issue in macOS was addressed with improved state management. An attacker may be able to impersonate other users.
- CVE-2026-65414Critical
An out-of-bounds write issue in Apple products was addressed with improved bounds checking. A remote attacker may be able to cause unexpected app termination or arbitrary code execution. This issue is fixed in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27.
- CVE-2026-65381Critical
A validation issue in entitlement verification in macOS Golden Gate 27, Sequoia 15.8, and Tahoe 26.7. A malicious app may break out of its sandbox.
- CVE-2026-65400CriticalActively exploited
An authentication issue in Apple products was addressed with improved state management. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, and macOS Tahoe 26.7.
- CVE-2026-64767Critical
A buffer overflow in Apple products was addressed with improved bounds checking. The issue is fixed in macOS Sequoia 15.7.8, macOS Sequoia 15.8.2, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.
- CVE-2026-43773Critical
An out-of-bounds read was fixed with improved bounds checking. Fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory.
- CVE-2026-43764Critical
An integer overflow was addressed with improved input validation. An app may cause unexpected system termination.
- CVE-2026-43750Critical
A buffer overflow in macOS allows an app to execute arbitrary code out of its sandbox or with elevated privileges. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6.
- CVE-2026-43748Critical
An out-of-bounds write issue in Apple products was addressed with improved bounds checking. An app may be able to cause unexpected system termination. This issue is fixed in iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, and macOS Tahoe 26.6.
- CVE-2026-43710Critical
Vulnerability in macOS (Sequoia, Sonoma, Tahoe) allowing an attacker to cause unexpected system termination or corrupt kernel memory. Fixed with improved memory handling.
Original NVD description (English source)
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS