macos vulnerabilities and fixes

Q: How do I fix macos vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Q: Is macos being exploited right now?

Yes: 2 macos CVEs are on the CISA Known Exploited Vulnerabilities list, so patch those first.

Q: Which macos CVE should I patch first?

CVE-2026-65400 currently ranks highest (87/100): Apple macOS Improper Authentication Vulnerability.

Recent CVEs affecting macos, with upgrade or downgrade steps. 78 tracked.

macos has 78 tracked vulnerabilities, 27 critical and 2 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 78. Most recent: 2026-09-28. Highest priority: CVE-2026-65400 (score 87/100).

CVE-2026-43682 CRITICAL 9.8 UPGRADE The issue was addressed with improved memory handling
CVE-2026-64695 CRITICAL 9.8 UPGRADE The issue was addressed with improved memory handling
CVE-2026-64696 CRITICAL 9.8 UPGRADE The issue was addressed with improved memory handling
CVE-2026-28982 CRITICAL 9.8 UPGRADE A race condition was addressed with improved locking
CVE-2026-39873 CRITICAL 9.8 UPGRADE The issue was addressed with improved memory handling
CVE-2026-43694 CRITICAL 9.8 UPGRADE The issue was addressed with improved memory handling
CVE-2026-43710 CRITICAL 9.8 UPGRADE The issue was addressed with improved memory handling
CVE-2026-43748 CRITICAL 9.8 UPGRADE An out-of-bounds write issue was addressed with improved bounds checking
CVE-2026-43757 CRITICAL 9.8 UPGRADE An out-of-bounds read was addressed with improved bounds checking
CVE-2026-43764 CRITICAL 9.8 UPGRADE An integer overflow was addressed with improved input validation
CVE-2026-43773 CRITICAL 9.8 UPGRADE An out-of-bounds read was addressed with improved bounds checking
CVE-2026-43793 CRITICAL 9.8 UPGRADE An issue existed in the handling of environment variables
CVE-2026-43802 CRITICAL 9.8 UPGRADE An out-of-bounds write issue was addressed with improved bounds checking
CVE-2026-43809 CRITICAL 9.8 UPGRADE An out-of-bounds read was addressed with improved bounds checking
CVE-2026-64694 CRITICAL 9.8 UPGRADE An integer overflow was addressed with improved input validation
CVE-2026-64698 CRITICAL 9.8 UPGRADE The issue was addressed with improved memory handling
CVE-2026-64703 CRITICAL 9.8 UPGRADE A use after free issue was addressed with improved memory management
CVE-2026-64731 CRITICAL 9.8 UPGRADE A path handling issue was addressed with improved validation
CVE-2026-64738 CRITICAL 9.8 UPGRADE A permissions issue was addressed with additional restrictions
CVE-2026-43750 CRITICAL 9.8 UPGRADE A buffer overflow was addressed with improved bounds checking
CVE-2026-28911 CRITICAL 9.8 UPGRADE The issue was addressed with improved memory handling
CVE-2026-43779 CRITICAL 9.8 UPGRADE A logic issue was addressed with improved restrictions
CVE-2026-64691 CRITICAL 9.8 UPGRADE A buffer overflow was addressed with improved size validation
CVE-2026-64697 CRITICAL 9.8 UPGRADE The issue was addressed with improved memory handling
CVE-2026-64704 CRITICAL 9.8 UPGRADE A type confusion issue was addressed with improved memory handling
CVE-2026-64702 CRITICAL 9.8 UPGRADE An access issue was addressed with additional sandbox restrictions
CVE-2026-43760 HIGH 8.6 UPGRADE An access issue was addressed with improved access restrictions
CVE-2026-43777 HIGH 7.5 UPGRADE This issue was addressed with improved input validation
CVE-2026-43728 HIGH 7.5 UPGRADE This issue was addressed through improved state management
CVE-2026-43772 HIGH 8.2 UPGRADE A path traversal issue was addressed with improved input validation
CVE-2026-28981 HIGH 7.8 UPGRADE A buffer overflow was addressed with improved bounds checking
CVE-2026-43698 HIGH 7.8 UPGRADE An injection issue was addressed with improved validation
CVE-2026-64737 HIGH 8.2 UPGRADE An authorization issue was addressed with improved state management
CVE-2026-28896 HIGH 7.7 UPGRADE The issue was addressed with improved memory handling
CVE-2026-28912 HIGH 7.8 UPGRADE A logic issue was addressed with improved restrictions
CVE-2026-39877 HIGH 7.8 UPGRADE A memory corruption issue was addressed with improved memory handling
CVE-2026-43749 HIGH 7.8 UPGRADE A parsing issue in the handling of directory paths was addressed with improved path validation
CVE-2026-39874 HIGH 7.8 UPGRADE A permissions issue was addressed with additional restrictions
CVE-2026-39875 HIGH 7.8 UPGRADE A permissions issue was addressed with additional restrictions
CVE-2026-43771 HIGH 7.1 UPGRADE A stack overflow was addressed with improved input validation
CVE-2026-28945 HIGH 7.1 UPGRADE A permissions issue was addressed with additional sandbox restrictions
CVE-2026-43672 HIGH 7.1 UPGRADE An authorization issue was addressed with improved state management
CVE-2026-43681 HIGH 7.1 UPGRADE A buffer overflow was addressed with improved bounds checking
CVE-2026-43747 HIGH 7.1 UPGRADE An out-of-bounds read was addressed with improved bounds checking
CVE-2026-28926 HIGH 7.0 UPGRADE A race condition was addressed with improved state handling
CVE-2026-43693 HIGH 7.0 UPGRADE A race condition was addressed with improved state handling
CVE-2026-43755 HIGH 7.0 UPGRADE A race condition was addressed with improved state management
CVE-2026-20672 MEDIUM 5.5 UPGRADE An information disclosure issue was addressed with improved privacy controls
CVE-2026-28932 MEDIUM 5.5 UPGRADE A logic issue existed resulting in memory corruption
CVE-2026-43738 MEDIUM 5.5 UPGRADE The issue was addressed with improved memory handling
CVE-2026-43754 MEDIUM 5.5 UPGRADE This issue was addressed with improved redaction of sensitive information
CVE-2026-43765 MEDIUM 5.5 UPGRADE This issue was addressed with improved handling of symlinks
CVE-2026-43768 MEDIUM 5.5 UPGRADE The issue was addressed with improved memory handling
CVE-2026-43774 MEDIUM 5.5 UPGRADE An out-of-bounds read was addressed with improved bounds checking
CVE-2026-43782 MEDIUM 5.5 UPGRADE This issue was addressed with improved checks
CVE-2026-64699 MEDIUM 5.5 UPGRADE A memory initialization issue was addressed with improved memory handling
CVE-2026-64708 MEDIUM 5.5 UPGRADE A file quarantine bypass was addressed with additional checks
CVE-2026-64710 MEDIUM 5.5 UPGRADE A privacy issue was addressed by removing sensitive data
CVE-2026-64744 MEDIUM 5.5 UPGRADE An information leakage was addressed with additional validation
CVE-2026-28849 MEDIUM 5.5 UPGRADE The issue was addressed with improved checks
CVE-2026-28900 MEDIUM 5.5 UPGRADE A file quarantine bypass was addressed with additional checks
CVE-2026-43665 MEDIUM 5.5 UPGRADE This issue was addressed with additional entitlement checks
CVE-2026-43756 MEDIUM 5.5 UPGRADE A logic issue was addressed with improved validation
CVE-2026-43763 MEDIUM 5.5 UPGRADE A permissions issue was addressed by removing the vulnerable code
CVE-2026-43775 MEDIUM 5.5 UPGRADE An authorization issue was addressed with improved state management
CVE-2026-43806 MEDIUM 5.5 UPGRADE A denial of service issue was addressed by removing the vulnerable code
CVE-2026-43819 MEDIUM 5.5 UPGRADE An access issue was addressed with additional sandbox restrictions
CVE-2026-64723 MEDIUM 5.5 UPGRADE A logic issue was addressed with improved checks
CVE-2026-43766 MEDIUM 4.6 UPGRADE An authorization issue was addressed with improved state management
CVE-2026-43767 MEDIUM 5.0 UPGRADE The issue was addressed with improved memory handling
CVE-2026-43781 MEDIUM 4.7 UPGRADE A race condition was addressed with improved state handling
CVE-2026-64745 LOW 2.4 UPGRADE This issue was addressed with additional restrictions on the lock screen
CVE-2023-28319 HIGH 7.5 UPGRADE UPGRADE A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH ser
CVE-2022-43552 MEDIUM 5.9 UPGRADE UPGRADE A use after free vulnerability exists in curl <7.87.0
CVE-2023-28320 MEDIUM 5.9 UPGRADE UPGRADE A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backend
CVE-2023-28322 LOW 3.7 UPGRADE MITIGATE An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might err
CVE-2026-65400 CRITICAL 9.8 EXPLOITED UPGRADE Apple macOS Improper Authentication Vulnerability
CVE-2026-86950 HIGH 8.8 EXPLOITED UPGRADE UPGRADE Apple Multiple Products Out-of-Bounds Write Vulnerability

FAQ

How do I fix macos vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is macos being exploited right now?

Yes: 2 macos CVEs are on the CISA Known Exploited Vulnerabilities list, so patch those first.

Which macos CVE should I patch first?

CVE-2026-65400 currently ranks highest (87/100): Apple macOS Improper Authentication Vulnerability.

← Back to latest CVEs