The vulnpocalypse rains iBugs down on Apple with record-setting number of patches
Apple's record patch cycle fixes 260+ CVEs across iOS 27 and macOS 27, including CUPS remote code execution, with no active exploitation reported.
55
Vulnerability2 · 1 read
CVE-2026-65376
Out-of-Bounds Read in Apple macOS Enables App-Triggered System Crashes
- CVSS 3.1
- 5.5 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-65376 is an out-of-bounds read vulnerability in Apple's macOS caused by insufficient bounds checking, which Apple addressed with improved validation. It is triggered when an app on an affected Mac performs the out-of-bounds memory read, allowing that app to cause unexpected system termination — effectively a denial-of-service crash of the machine. While out-of-bounds reads can sometimes expose memory contents, Apple's advisory only documents the crash impact, so data disclosure should not be assumed. Users on any macOS version older than Golden Gate 27, Sequoia 15.8, or Tahoe 26.7 are affected, and the flaw was disclosed amid a record-setting wave of Apple security patches. No public proof of concept exists, the issue is not on the CISA KEV list, and no exploitation in the wild has been reported.
What to do: Update to macOS Tahoe 26.7, macOS Sequoia 15.8, or macOS Golden Gate 27 via Software Update as soon as the fixed builds are available. Because exploitation requires running a malicious app, keep Gatekeeper enabled and restrict installations to App Store or notarized software. On unpatched Macs, investigate unexpected system terminations or crash logs as a potential indicator of abuse.
| Product | Affected |
|---|---|
| Apple macOS Golden Gate | versions prior to 27 |
| Apple macOS Sequoia | versions prior to 15.8 |
| Apple macOS Tahoe | versions prior to 26.7 |
Estimated exposure
mass≈100M+ Macs (Apple's active Mac installed base across three supported macOS generations) — Apple's active Mac installed base is estimated at well over 100 million devices, and the flaw spans three currently supported macOS releases, so the majority of that base is plausibly exposed.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination.