Vulnerabilities

CVE-2026-65374 is an out-of-bounds write (memory corruption) flaw in Apple macOS's handling of WebDAV connections, rated 8.8 (high) with network vector, low attack complexity, no privileges required, but user interaction required. It is triggered when a victim connects to an attacker-controlled WebDAV server — for example by clicking a webdav:// link or mounting an untrusted WebDAV share via Finder's 'Connect to Server' — and the malformed server responses corrupt memory in the WebDAV client code. Successful exploitation can yield arbitrary code execution with the privileges of the connecting user, impacting confidentiality, integrity, and availability. All Macs running macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27 are affected; Apple addressed the issue with improved validation. No public proof-of-concept is known and the flaw is not on the CISA KEV catalog, so there is no evidence of in-the-wild exploitation at this time.

Do: Patch to macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27 (System Settings > Software Update), prioritizing fleets where users mount network shares. Advise users not to click webdav:// links or connect to WebDAV servers from untrusted sources, since the flaw requires user interaction. Egress/URL filtering can also block or flag webdav:// schemes and unexpected outbound WebDAV (TCP 80/443 with WebDAV methods) as a defense-in-depth measure.

CVE-2026-65330 is an improper memory handling flaw (CWE-119) in the Apple kernel that allows an app to cause unexpected system termination or corrupt kernel memory. Triggering it requires running a malicious or compromised app on the device, which the CVSS vector reflects as network-delivered code needing user interaction (AV:N/PR:N/UI:R) with high availability impact. An attacker gains at minimum a reliable crash/DoS primitive and potentially a path to further kernel-level compromise via memory corruption, though no confidentiality or integrity impact is scored. Everyone running the affected Apple platforms is exposed: iOS and iPadOS before 26.6.1, macOS Sequoia before 15.8, macOS Tahoe before 26.6.2, and tvOS, visionOS, and watchOS before version 27. A public proof-of-concept is available on GitHub, but there is no confirmed in-the-wild exploitation — the flaw is absent from CISA KEV and EPSS estimates only a ~0.3% chance of exploitation in the next 30 days.

Do: Update devices to iOS/iPadOS 26.6.1, macOS Sequoia 15.8 or macOS Tahoe 26.6.2, tvOS 27, visionOS 27, and watchOS 27 as soon as possible. Until patched, avoid installing apps from untrusted sources, since exploitation requires running a malicious app on the device. Verify installed versions via Settings > General > Software Update (or System Settings on macOS) and confirm the new build is in place after updating.

NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's SANs. NIOSSL provides access to a buffer assumed to be backed by an ASN1_STRING, but not all SANs are backed by ASN1_STRING, so accessing the buffer for such a type can lead to out-of-bounds memory access. This vulnerability is addressed in swift-nio-ssl version 2.37.2.