Vulnerabilities

CVE-2026-84561 is a double-free memory-corruption flaw (CWE-415) in the kernel of Apple's operating systems, resolved through improved memory management. Although the CVSS vector is scored with a network attack vector, Apple's advisory describes a locally running app as the trigger: a malicious or compromised app on the device can trip the double free in kernel code. The result, per Apple, is unexpected system termination or corruption of kernel memory — a denial-of-service condition, with kernel memory corruption potentially usable as a building block for further exploitation. All users of iPhones, iPads, Macs, Apple TVs, Apple Vision Pro headsets and Apple Watches running versions older than the fixed releases are affected. There is currently no evidence of in-the-wild exploitation, no CISA KEV listing, and no known public proof-of-concept.

Do: Update devices to iOS/iPadOS 26.7 or 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 or watchOS 27. Verify fleet OS versions via MDM or Settings > General > Software Update and prioritize user-facing iOS/macOS devices. Until patched, limit risk by avoiding untrusted app installs, since a local app is the documented trigger; no other workaround is available.

CVE-2026-65381 is a missing-authorization flaw (CWE-862) in Apple macOS's entitlement verification, where the system failed to properly validate the entitlements of a running process. Per Apple's advisory, the practical trigger is a malicious app already executing on a Mac: by abusing the weak entitlement check, the app can break out of its App Sandbox confinement. A successful escape lets the attacker's code operate outside the sandbox's restrictions, potentially exposing resources and privileges the sandbox was meant to contain, though Apple does not detail a specific escalation to kernel or root. All Mac users running affected macOS releases are exposed in principle: macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before version 27. There is no evidence of exploitation: the issue is not in CISA KEV, and no public proof-of-concept or in-the-wild reports are known. Note that the feed's CVSS 3.1 score of 10 uses a network vector (AV:N), while Apple's description frames exploitation as requiring a locally running malicious app, so real-world exploitability depends on getting a malicious app onto the target.

Do: Update affected Macs to macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27 (or later) via System Settings > Software Update. Until patched, avoid installing or running untrusted third-party applications, since exploitation requires a malicious app to execute locally. Check fleet inventory for devices stuck on pre-fix Sequoia or Tahoe builds and prioritize them for patching.

A single crafted SSH message gives an unauthenticated network attacker an out-of-bounds stack write of attacker-controlled length and content against any application built on swift-nio-ssh. This vulnerability is addressed in swift-nio-ssh version 0.14.1.