SB2026021188 - Multiple vulnerabilities in Apple macOS Tahoe
Published: February 11, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 57 secuirty vulnerabilities.
1) Improper input validation (CVE-ID: CVE-2026-20618)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to insufficient input validation in System Settings. A local application can trick the victim into opening a specially crafted file and access user-sensitive data.
2) Improper input validation (CVE-ID: CVE-2026-20656)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to insufficient input validation in Safari. A local application can access a user\'s Safari history.
3) Permissions, privileges, and access controls (CVE-ID: CVE-2026-20628)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to improperly imposed security restrictions in Sandbox. A local application can break out of its sandbox.
4) Input validation error (CVE-ID: CVE-2026-20658)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to insufficient package validation in Security. A local application can gain rot privileges on the system.
5) Improper link resolution before file access ('link following') (CVE-ID: CVE-2026-20610)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to insecure symbolic link following in Setup Assistant. A local application can gain root privileges.
6) Improper limitation of a pathname to a restricted directory ('path traversal') (CVE-ID: CVE-2026-20653)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to incorrect handling of path names in Shortcuts. A local application can trick the victim into opening a specially crafted file and access sensitive user data.
7) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-20648)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improperly imposed security restrictions in Siri. A local application can access notifications from other iCloud devices.
8) State issues (CVE-ID: CVE-2026-20662)
The vulnerability allows an attacker with physical access to the system to gain access to sensitive information.
The vulnerability exists due to a state management issue in Siri. An attacker with physical access to the system can view sensitive user information.
9) Exposure of sensitive information to an unauthorized actor (CVE-ID: CVE-2026-20647)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to excessive data output in Siri. A local application can access sensitive user data.
10) Information disclosure (CVE-ID: CVE-2026-20680)
The vulnerability allows a local application to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output in Spotlight. A local application can access sensitive user data.
11) Improper access control (CVE-ID: CVE-2026-20612)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in Spotlight. A local application can access sensitive user data.
12) Information disclosure (CVE-ID: CVE-2026-20641)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to excessive data output by StoreKit. A local application can identify what other apps a user has installed.
13) Information exposure through log files (CVE-ID: CVE-2026-20619)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to inclusion of sensitive information into a log file in System Settings. A local application can access sensitive user data.
14) Protection Mechanism Failure (CVE-ID: CVE-2026-20606)
The vulnerability allows a local application to bypass privacy preferences.
The vulnerability exists due to insufficient implementation of security measures in UIKit. A local application can bypass certain Privacy preferences.
15) State issues (CVE-ID: CVE-2026-20666)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a state management issue in NSOpenPanel. A local application can access sensitive user data.
16) Memory corruption (CVE-ID: CVE-2026-20605)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in Voice Control. A local application can crash a system process.
17) Information exposure through log files (CVE-ID: CVE-2026-20646)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to inclusion of sensitive information into a log file in Weather. A local application can read sensitive location information.
18) Buffer overflow (CVE-ID: CVE-2026-20652)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a boundary error in WebKit when processing HTML content. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
19) Buffer overflow (CVE-ID: CVE-2026-20608)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a boundary error in WebKit when processing HTML content. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
20) State Issues (CVE-ID: CVE-2026-20676)
The vulnerability allows a remote attacker to track website users.
The vulnerability exists due to a state issue in WebKit. A remote attacker can track users through Safari web extensions.
21) Buffer overflow (CVE-ID: CVE-2026-20644)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a boundary error in WebKit when processing HTML content. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
22) Buffer overflow (CVE-ID: CVE-2026-20636)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a boundary error in WebKit when processing HTML content. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
23) Buffer overflow (CVE-ID: CVE-2026-20635)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a boundary error in WebKit when processing HTML content. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
24) Memory corruption (CVE-ID: CVE-2026-20621)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error in Wi-Fi. A local application can cause unexpected system termination or corrupt kernel memory.
25) Improper input validation (CVE-ID: CVE-2026-20602)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation in WindowServer. A local application can cause a denial-of-service.
26) Improper limitation of a pathname to a restricted directory ('path traversal') (CVE-ID: CVE-2026-20614)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to incorrect handling of path names in Remote Management. A local application can gain root privileges.
27) Exposure of sensitive information to an unauthorized actor (CVE-ID: CVE-2026-20603)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to excessive data output in Notification Center. A local application can access private information.
28) Improper limitation of a pathname to a restricted directory ('path traversal') (CVE-ID: CVE-2026-20669)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to incorrect handling of path names in Admin Framework. A local application can trick the victim into opening a specially crafted file and access sensitive user data.
29) Improper input validation (CVE-ID: CVE-2026-20629)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to insufficient input validation in Foundation. A local application can trick the victim into opening a specially crafted file and access user-sensitive data.
30) Improper limitation of a pathname to a restricted directory ('path traversal') (CVE-ID: CVE-2026-20625)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to incorrect handling of path names in AppleMobileFileIntegrity. A local application can trick the victim into opening a specially crafted file and access sensitive user data.
31) Improper input validation (CVE-ID: CVE-2026-20624)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to insufficient input validation in AppleMobileFileIntegrity. A local application can access sensitive user data.
32) Input validation error (CVE-ID: CVE-2026-20650)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in Bluetooth. A remote attacker in a privileged network position can send specially crafted Bluetooth packets to the system and perform a denial of service (DoS) attack.
33) Improper limitation of a pathname to a restricted directory ('path traversal') (CVE-ID: CVE-2026-20660)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to incorrect handling of path names in CFNetwork. A local user can trick the victim into opening a specially crafted file and write arbitrary files.
34) Information exposure through log files (CVE-ID: CVE-2026-20681)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to inclusion of sensitive information into a log file in Contacts. A local application can access information about a user\'s contacts.
35) Memory corruption (CVE-ID: CVE-2026-20611)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error in CoreAudio. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination or corrupt process memory.
36) Memory corruption (CVE-ID: CVE-2026-20609)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in CoreMedia. A remote attacker can trick the victim into opening a specially crafted file and perform a denial-of-service or potentially disclose memory contents.
37) State issues (CVE-ID: CVE-2026-20617)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a state management issue in CoreServices. A local application can gain root privileges.
38) Improper limitation of a pathname to a restricted directory ('path traversal') (CVE-ID: CVE-2026-20615)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to incorrect handling of path names in CoreServices. A local application can gain root privileges.
39) Improper input validation (CVE-ID: CVE-2026-20627)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to insufficient input validation in CoreServices. A local application can access sensitive user data.
40) Out-of-bounds write (CVE-ID: CVE-2025-14174)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error in ANGLE. A remote attacker can trick the victim into visiting a specially crafted website, trigger an out-of-bounds write and execute arbitrary code on the target system.
Note, the vulnerability is being actively exploited in the wild.
41) Use-after-free (CVE-ID: CVE-2025-43529)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing HTML content. A remote attacker can trick the victim into visiting a specially crafted website, trigger a use-after-free error and execute arbitrary code on the system.
Note, the vulnerability is being actively exploited in the wild.
42) Buffer overflow (CVE-ID: CVE-2026-20700)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error in dyld. A local user can trigger memory corruption and execute arbitrary code on the target system.
Note, the vulnerability is being actively exploited in the wild in conjunction with vulnerabilities #VU119833 (CVE-2025-14174) and #VU119902 (CVE-2025-43529).
43) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-20601)
The vulnerability allows a local application to monitor user's keystrokes.
The vulnerability exists due to improperly imposed security restrictions in Foundation. A local application can monitor keystrokes without user permission.
44) Out-of-bounds write (CVE-ID: CVE-2026-20616)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to an out-of-bounds write in Model I/O. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.
45) Improper input validation (CVE-ID: CVE-2026-20623)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to insufficient input validation in Foundation. A local application can access protected user data.
46) Information disclosure (CVE-ID: CVE-2026-20649)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to excessive data output by the Game Center. A local user can view sensitive user information.
47) Out-of-bounds read (CVE-ID: CVE-2026-20620)
The vulnerability allows a local aplication to gain access to potentially sensitive information or crash the system.
The vulnerability exists due to a boundary condition in GPU drivers. A local application can trigger an out-of-bounds read error and read contents of kernel memory or crash the system.
48) Memory corruption (CVE-ID: CVE-2026-20675)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to a boundary error in ImageIO. A local user can trick the victim into opening a specially crafted file and perform disclosure of user information.
49) Memory corruption (CVE-ID: CVE-2026-20634)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a boundary error in ImageIO. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.
50) Memory corruption (CVE-ID: CVE-2026-20654)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in Kernel. A local application can cause unexpected system termination.
51) Improper access control (CVE-ID: CVE-2026-20626)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to improper access restrictions in Kernel. A local application can gain root privileges.
52) Man-in-the-Middle (MitM) attack (CVE-ID: CVE-2026-20671)
The vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists due to a logic issue in the OS kernel. A remote attacker on the local network can intercept network traffic.
53) Permissions, privileges, and access controls (CVE-ID: CVE-2026-20630)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improperly imposed security restrictions in LaunchServices. A local application can access protected user data.
54) Resource exhaustion (CVE-ID: CVE-2025-59375)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger large dynamic memory allocations via a small document and perform a denial of service (DoS) attack.
55) Improper access control (CVE-ID: CVE-2026-20667)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to improper access restrictions in libxpc. A local application can break out of its sandbox.
56) Protection Mechanism Failure (CVE-ID: CVE-2026-20673)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient implementation of security measures in Mail. Turning off the "Load remote content in messages" may not apply to all mail previews, leading to information exposure.
57) Race condition (CVE-ID: CVE-2026-20677)
The vulnerability allows a local user to bypass implemented security restrictions.
The vulnerability exists due to a race condition in Messages when handling symbolic links in shortcuts. A local user can bypass sandbox restrictions.
Remediation
Install update from vendor's website.